feat: Added lldap

feat: Added default gateway
feat: Move certificates to default namespace
2025-12-17 03:47:49 +01:00 · 2025-12-17 03:47:49 +01:00 · 2025-12-17 03:36:56 +01:00 · 2025-12-17 03:36:55 +01:00 · 2025-12-17 00:41:12 +01:00 · 2025-12-17 00:41:11 +01:00
46 changed files with 513 additions and 21 deletions
--- a/apps/artifacts.yaml
+++ b/apps/artifacts.yaml
@@ -0,0 +1,21 @@
+apiVersion: source.extensions.fluxcd.io/v1beta1
+kind: ArtifactGenerator
+metadata:
+  name: apps
+  namespace: flux-system
+spec:
+  sources:
+    - alias: foundation
+      kind: GitRepository
+      name: flux-system
+  artifacts:
+    - name: spegel
+      originRevision: "@foundation"
+      copy:
+        - from: "@foundation/apps/spegel/**"
+          to: "@artifact/"
+    - name: lldap
+      originRevision: "@foundation"
+      copy:
+        - from: "@foundation/apps/lldap/**"
+          to: "@artifact/"
--- a/apps/lldap/base/cluster.yaml
+++ b/apps/lldap/base/cluster.yaml
@@ -0,0 +1,10 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: db
+  namespace: lldap
+  # TODO: Add labels?
+spec:
+  storage:
+    size: 8Gi
+    storageClass: local-path
--- a/apps/lldap/base/deployment.yaml
+++ b/apps/lldap/base/deployment.yaml
@@ -0,0 +1,80 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: lldap
+  namespace: lldap
+  labels:
+    app.kubernetes.io/name: lldap
+    app.kubernetes.io/instance: lldap
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: lldap
+      app.kubernetes.io/instance: lldap
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: lldap
+        app.kubernetes.io/instance: lldap
+    spec:
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: DoNotSchedule
+          labelSelector:
+            matchLabels:
+              app.kubernetes.io/name: lldap
+              app.kubernetes.io/instance: lldap
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: lldap
+          image: lldap/lldap:2025-12-12-alpine-rootless
+          env:
+            - name: LLDAP_LDAP_BASE_DN
+              value: dc=huizinga,dc=dev
+            - name: LLDAP_LDAP_USER_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: credentials
+                  key: admin-pass
+            - name: LLDAP_KEY_SEED
+              valueFrom:
+                secretKeyRef:
+                  name: credentials
+                  key: key-seed
+            - name: LLDAP_JWT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: credentials
+                  key: jwt-secret
+            - name: LLDAP_DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: db-app
+                  key: uri
+            - name: TZ
+              value: CET
+          livenessProbe:
+            exec:
+              command:
+                - /app/lldap
+                - healthcheck
+            initialDelaySeconds: 5
+            periodSeconds: 30
+          ports:
+            - name: ldap
+              containerPort: 3890
+            - name: web
+              containerPort: 17170
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            capabilities:
+              drop:
+                - ALL
--- a/apps/lldap/base/http-route.yaml
+++ b/apps/lldap/base/http-route.yaml
@@ -0,0 +1,13 @@
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: HTTPRoute
+metadata:
+  name: lldap
+  namespace: lldap
+spec:
+  parentRefs:
+    - name: gateway
+      namespace: default
+  rules:
+    - backendRefs:
+        - name: lldap
+          port: 17170
--- a/apps/lldap/base/kustomization.yaml
+++ b/apps/lldap/base/kustomization.yaml
@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - cluster.yaml
+  - deployment.yaml
+  - service.yaml
+  - http-route.yaml
--- a/configs/certificates/base/namespace.yaml
+++ b/configs/certificates/base/namespace.yaml
@@ -1,4 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: certificates
+  name: lldap
--- a/apps/lldap/base/service.yaml
+++ b/apps/lldap/base/service.yaml
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: lldap
+  namespace: lldap
+  labels:
+    app.kubernetes.io/name: lldap
+    app.kubernetes.io/instance: lldap
+spec:
+  selector:
+    app.kubernetes.io/name: lldap
+    app.kubernetes.io/instance: lldap
+  ports:
+    - name: ldap
+      port: 3890
+      targetPort: ldap
+    - name: web
+      port: 17170
+      targetPort: web
--- a/configs/letsencrypt/letsencrypt.yaml
+++ b/configs/letsencrypt/letsencrypt.yaml
@@ -1,21 +1,21 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: letsencrypt
+  name: lldap
  namespace: flux-system
 spec:
  interval: 1h
  retryInterval: 2m
  timeout: 5m
  dependsOn:
-    - name: cert-manager
+    - name: cnpg
  sourceRef:
    kind: ExternalArtifact
-    name: letsencrypt
+    name: lldap
  decryption:
    provider: sops
    secretRef:
      name: sops-gpg
-  path: ./
+  path: ./${cluster_env}
  prune: true
  wait: true
--- a/apps/lldap/production/cluster.yaml
+++ b/apps/lldap/production/cluster.yaml
@@ -0,0 +1,6 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: postgres
+spec:
+  instances: 2
--- a/apps/lldap/production/deployment.yaml
+++ b/apps/lldap/production/deployment.yaml
@@ -0,0 +1,7 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: lldap
+  namespace: lldap
+spec:
+  replicas: 2
--- a/apps/lldap/production/http-route.yaml
+++ b/apps/lldap/production/http-route.yaml
@@ -0,0 +1,8 @@
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: HTTPRoute
+metadata:
+  name: lldap
+  namespace: lldap
+spec:
+  hostnames:
+    - "users.huizinga.dev"
--- a/apps/lldap/production/kustomization.yaml
+++ b/apps/lldap/production/kustomization.yaml
@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+  - secret-credentials.enc.yaml
+patches:
+  - path: deployment.yaml
+    target:
+      kind: Deployment
+  - path: cluster.yaml
+    target:
+      kind: Cluster
+  - path: http-route.yaml
+    target:
+      kind: HTTPRoute
--- a/apps/lldap/production/secret-credentials.enc.yaml
+++ b/apps/lldap/production/secret-credentials.enc.yaml
@@ -0,0 +1,58 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: credentials
+    namespace: lldap
+    labels:
+        app.kubernetes.io/name: lldap
+        app.kubernetes.io/instance: lldap
+type: Opaque
+data:
+    jwt-secret: ENC[AES256_GCM,data:cwKfSMzPPECNAba++x5ampK0pgCvOKRIEdPfLH5deDpnEASSlBjQZVo238YepBIAYu7Y0HCXCPppOtpX8zymD7Jxu1f5TrJoOJMwAlHYWT+IeBRVtpzgYA==,iv:bkNDqEriEnuSzvXxXAypGfwynPjYCVwN0NoAmcDftUc=,tag:DFkoIf92W8Ed60+azsfU+A==,type:str]
+    key-seed: ENC[AES256_GCM,data:bLpK9Tk5Eh2WBI5x94MssCyYEsMUMTJJymbdwsVeA6K/qBCxkPGkXf+kZZoaXkyLqW2lrPa8jIGv3LV6C4PqVJ+UOlgnvagQnCGnLylqX+3wkVhKLP5uYg==,iv:1RPLzof2Fwqm08Tfq7HR2esvPvkfBg0Uc+aM2SzpHhE=,tag:IsgLxUQriU9JUX2gEe/j8A==,type:str]
+    admin-pass: ENC[AES256_GCM,data:yWzQTjN8kuGroShan7NxAw==,iv:IHw237PAqNNZ7KXIy2D8XMCLWSi3kJpLEnILhGm/Xl4=,tag:N79GjKNZNh9qJO+dpa0InQ==,type:str]
+sops:
+    age:
+        - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCdVFuM2xvazBXY3kwTXVD
+            ZXdOS0pJLzVTVGJBb3RqYlhUN2IvNDNRSzNzCm8zcmlIU2h3RityUWFkZXU1R2xp
+            VUlobGZuOG1wbGxIMXVVekRaYTNGQUkKLS0tIHlMWkI0Qk9nUys1Sm4yNnVsakho
+            ZXl2RDhNNFZORW5lOGphSVY5WVJycWMKvnGem7wolSKMa8lshD90bMohdLMgYiTq
+            gHRN22irgd4pA2CpTcY47T2zhtVHU36PCXn+QFN936uF0vLf8Srwow==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkRHNUOXZFUGxEY0RRSGtz
+            OElnckFUVG1WOXhvZHhzczUxU3lZZlE5emo4Ck5qRnF6M1NCeGdkUVNuR0xzMWxs
+            SEdVL0lwOXJmWVdEZ0t3V2Jscy9lZG8KLS0tIGM0WC8vbEdHQ2puRVZIK3lXeUJJ
+            OVNqZnhRUEN5dTBBVXVlSDlidEU4K3cKhv2jSc+lJu+s3hbH6j1xrkaQSzds82rk
+            dlaisVQxQmxjKcyPHqudJZS6Qfq3kEn9cZOP4G8NYAh0zhzGvCKeqA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-17T00:53:29Z"
+    mac: ENC[AES256_GCM,data:6/I2J7u9fGUdz2SbAF7dL2j5XQMICx+AgEaUQ3HUN/RvlhMzn9J3EdcLFQ+d9YwbSpCzuGTQBfqsky2oaD6fQWWefCOXAVdElCp2rxHAGK9u2pqhPbgcvbHKAWfvK2kml8qhjjam346xpj2yeP8UdWq6+KZq8B5OBsKYtx4KuKM=,iv:EeLpcggrglMvpUdjvH6rOyNRj2EkuToIwc+uEPUnlvI=,tag:juTwo5RbhGnddB3MF3WirQ==,type:str]
+    pgp:
+        - created_at: "2025-12-17T00:53:29Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA51kG++kLewoAQ/7BepX/31nKyUHnKC/7VnqTJk0x/gLmhko1/NukkApraXe
+            ctmZVk4TlG9N+DqEPHUYeMt7pu/1rvnWckh/OR2JU7AK8E33tnWITvr4AzQjk0zH
+            /V8n36ZA5/8Ppt9LJJSMVLaFEFjqiFy39Ggt6bx0SUX/CczTGkUYp+aJQfmDn+uR
+            GcJk9wR9/bu7+iOq8kuOA+renxGmdIcfMd6GKiHYScgv5tDN7pg7upXh1NPrVB8u
+            3GTor40B1Ncjqv3L1Zbw1AZYdsmFRkSx1N2JJkxPZYbvI6cwuFMcFkXuX6JfuL8T
+            pW5ddsK/DF0qXAXSc378juOh/tRdktFz2QPv9X5CJnQUk0c19Beqb4tG4cVR9sF3
+            SXTpaNmR4GG3ilY3ispzso7CQe+7RvLWGgsZAgPD1uC9SJGOBfvReJvQZUXyxUGo
+            /riTbUgFaBHmY6XWGy7Ecni333GtfGeN8qSIgPRhHg5f/BJX9Rp5ZG373S7iLuI4
+            GpM12knQCjxfsMXjMs6/TtAwYhnIFG3WcCzJFzn+pqBiW7XJvegJPQAID5LDo4GG
+            EzCZylto1WCgRhdq+CNuybQTsj4TbvxzfPYf+gCURbisH8A3TTWp4eyyXHg5KS4z
+            0TECkXpUXR/sD71HuBjxz1jfZiXFruDBldZDzZ2tZDdqQxAtk/DJGXcLmWF+HMbS
+            XgEvCI5gci7pYlsi60yitBcTPV2eEBh4zbRV53e12RGuhPwkxenX+6YRSCi0liOk
+            5BizeCkfSRCLQHG1okeb1RIdnSoyOJ+KlrR4Y+1xeZp9ruWn/tPN7L3jCx8SX+Y=
+            =j+fd
+            -----END PGP MESSAGE-----
+          fp: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0
--- a/apps/lldap/staging/cluster.yaml
+++ b/apps/lldap/staging/cluster.yaml
@@ -0,0 +1,6 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: postgres
+spec:
+  instances: 1
--- a/apps/lldap/staging/deployment.yaml
+++ b/apps/lldap/staging/deployment.yaml
@@ -0,0 +1,7 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: lldap
+  namespace: lldap
+spec:
+  replicas: 1
--- a/apps/lldap/staging/http-route.yaml
+++ b/apps/lldap/staging/http-route.yaml
@@ -0,0 +1,8 @@
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: HTTPRoute
+metadata:
+  name: lldap
+  namespace: lldap
+spec:
+  hostnames:
+    - "users.staging.huizinga.dev"
--- a/apps/lldap/staging/kustomization.yaml
+++ b/apps/lldap/staging/kustomization.yaml
@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+  - secret-credentials.enc.yaml
+patches:
+  - path: deployment.yaml
+    target:
+      kind: Deployment
+  - path: cluster.yaml
+    target:
+      kind: Cluster
+  - path: http-route.yaml
+    target:
+      kind: HTTPRoute
--- a/apps/lldap/staging/secret-credentials.enc.yaml
+++ b/apps/lldap/staging/secret-credentials.enc.yaml
@@ -0,0 +1,58 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: credentials
+    namespace: lldap
+    labels:
+        app.kubernetes.io/name: lldap
+        app.kubernetes.io/instance: lldap
+type: Opaque
+data:
+    jwt-secret: ENC[AES256_GCM,data:cwKfSMzPPECNAba++x5ampK0pgCvOKRIEdPfLH5deDpnEASSlBjQZVo238YepBIAYu7Y0HCXCPppOtpX8zymD7Jxu1f5TrJoOJMwAlHYWT+IeBRVtpzgYA==,iv:bkNDqEriEnuSzvXxXAypGfwynPjYCVwN0NoAmcDftUc=,tag:DFkoIf92W8Ed60+azsfU+A==,type:str]
+    key-seed: ENC[AES256_GCM,data:bLpK9Tk5Eh2WBI5x94MssCyYEsMUMTJJymbdwsVeA6K/qBCxkPGkXf+kZZoaXkyLqW2lrPa8jIGv3LV6C4PqVJ+UOlgnvagQnCGnLylqX+3wkVhKLP5uYg==,iv:1RPLzof2Fwqm08Tfq7HR2esvPvkfBg0Uc+aM2SzpHhE=,tag:IsgLxUQriU9JUX2gEe/j8A==,type:str]
+    admin-pass: ENC[AES256_GCM,data:yWzQTjN8kuGroShan7NxAw==,iv:IHw237PAqNNZ7KXIy2D8XMCLWSi3kJpLEnILhGm/Xl4=,tag:N79GjKNZNh9qJO+dpa0InQ==,type:str]
+sops:
+    age:
+        - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCdVFuM2xvazBXY3kwTXVD
+            ZXdOS0pJLzVTVGJBb3RqYlhUN2IvNDNRSzNzCm8zcmlIU2h3RityUWFkZXU1R2xp
+            VUlobGZuOG1wbGxIMXVVekRaYTNGQUkKLS0tIHlMWkI0Qk9nUys1Sm4yNnVsakho
+            ZXl2RDhNNFZORW5lOGphSVY5WVJycWMKvnGem7wolSKMa8lshD90bMohdLMgYiTq
+            gHRN22irgd4pA2CpTcY47T2zhtVHU36PCXn+QFN936uF0vLf8Srwow==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkRHNUOXZFUGxEY0RRSGtz
+            OElnckFUVG1WOXhvZHhzczUxU3lZZlE5emo4Ck5qRnF6M1NCeGdkUVNuR0xzMWxs
+            SEdVL0lwOXJmWVdEZ0t3V2Jscy9lZG8KLS0tIGM0WC8vbEdHQ2puRVZIK3lXeUJJ
+            OVNqZnhRUEN5dTBBVXVlSDlidEU4K3cKhv2jSc+lJu+s3hbH6j1xrkaQSzds82rk
+            dlaisVQxQmxjKcyPHqudJZS6Qfq3kEn9cZOP4G8NYAh0zhzGvCKeqA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-17T00:53:29Z"
+    mac: ENC[AES256_GCM,data:6/I2J7u9fGUdz2SbAF7dL2j5XQMICx+AgEaUQ3HUN/RvlhMzn9J3EdcLFQ+d9YwbSpCzuGTQBfqsky2oaD6fQWWefCOXAVdElCp2rxHAGK9u2pqhPbgcvbHKAWfvK2kml8qhjjam346xpj2yeP8UdWq6+KZq8B5OBsKYtx4KuKM=,iv:EeLpcggrglMvpUdjvH6rOyNRj2EkuToIwc+uEPUnlvI=,tag:juTwo5RbhGnddB3MF3WirQ==,type:str]
+    pgp:
+        - created_at: "2025-12-17T00:53:29Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA51kG++kLewoAQ/7BepX/31nKyUHnKC/7VnqTJk0x/gLmhko1/NukkApraXe
+            ctmZVk4TlG9N+DqEPHUYeMt7pu/1rvnWckh/OR2JU7AK8E33tnWITvr4AzQjk0zH
+            /V8n36ZA5/8Ppt9LJJSMVLaFEFjqiFy39Ggt6bx0SUX/CczTGkUYp+aJQfmDn+uR
+            GcJk9wR9/bu7+iOq8kuOA+renxGmdIcfMd6GKiHYScgv5tDN7pg7upXh1NPrVB8u
+            3GTor40B1Ncjqv3L1Zbw1AZYdsmFRkSx1N2JJkxPZYbvI6cwuFMcFkXuX6JfuL8T
+            pW5ddsK/DF0qXAXSc378juOh/tRdktFz2QPv9X5CJnQUk0c19Beqb4tG4cVR9sF3
+            SXTpaNmR4GG3ilY3ispzso7CQe+7RvLWGgsZAgPD1uC9SJGOBfvReJvQZUXyxUGo
+            /riTbUgFaBHmY6XWGy7Ecni333GtfGeN8qSIgPRhHg5f/BJX9Rp5ZG373S7iLuI4
+            GpM12knQCjxfsMXjMs6/TtAwYhnIFG3WcCzJFzn+pqBiW7XJvegJPQAID5LDo4GG
+            EzCZylto1WCgRhdq+CNuybQTsj4TbvxzfPYf+gCURbisH8A3TTWp4eyyXHg5KS4z
+            0TECkXpUXR/sD71HuBjxz1jfZiXFruDBldZDzZ2tZDdqQxAtk/DJGXcLmWF+HMbS
+            XgEvCI5gci7pYlsi60yitBcTPV2eEBh4zbRV53e12RGuhPwkxenX+6YRSCi0liOk
+            5BizeCkfSRCLQHG1okeb1RIdnSoyOJ+KlrR4Y+1xeZp9ruWn/tPN7L3jCx8SX+Y=
+            =j+fd
+            -----END PGP MESSAGE-----
+          fp: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0
--- a/controllers/spegel/helm-release.yaml
+++ b/controllers/spegel/helm-release.yaml
--- a/controllers/spegel/helm-repository.yaml
+++ b/controllers/spegel/helm-repository.yaml
--- a/controllers/spegel/kustomization.yaml
+++ b/controllers/spegel/kustomization.yaml
--- a/controllers/spegel/namespace.yaml
+++ b/controllers/spegel/namespace.yaml
--- a/controllers/spegel/spegel.yaml
+++ b/controllers/spegel/spegel.yaml
--- a/clusters/testing/kustomization.yaml
+++ b/clusters/testing/kustomization.yaml
@@ -6,13 +6,16 @@ resources:
  - ../../controllers/artifacts.yaml
  - ../../controllers/cilium/cilium.yaml
  - ../../controllers/cert-manager/cert-manager.yaml
-  - ../../controllers/spegel/spegel.yaml
  - ../../controllers/longhorn/longhorn.yaml
  - ../../controllers/local-path-provisioner/local-path-provisioner.yaml
  - ../../controllers/cnpg/cnpg.yaml

  - ../../configs/artifacts.yaml
-  - ../../configs/letsencrypt/letsencrypt.yaml
+  - ../../configs/cilium-config/cilium-config.yaml
  - ../../configs/certificates/certificates.yaml
  - ../../configs/alerts/alerts.yaml
  - ../../configs/longhorn-jobs/longhorn-jobs.yaml
+
+  - ../../apps/artifacts.yaml
+  - ../../apps/spegel/spegel.yaml
+  - ../../apps/lldap/lldap.yaml
--- a/configs/artifacts.yaml
+++ b/configs/artifacts.yaml
@@ -9,10 +9,10 @@ spec:
      kind: GitRepository
      name: flux-system
  artifacts:
-    - name: letsencrypt
+    - name: cilium-config
      originRevision: "@foundation"
      copy:
-        - from: "@foundation/configs/letsencrypt/**"
+        - from: "@foundation/configs/cilium-config/**"
          to: "@artifact/"
    - name: certificates
      originRevision: "@foundation"
--- a/configs/certificates/base/certificate-huizinga-dev.yaml
+++ b/configs/certificates/base/certificate-huizinga-dev.yaml
@@ -2,7 +2,7 @@ apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: huizinga-dev
-  namespace: certificates
+  namespace: default
 spec:
  secretName: huizinga-dev-tls
  issuerRef:
--- a/configs/certificates/base/cluster-issuer.yaml
+++ b/configs/certificates/base/cluster-issuer.yaml
--- a/configs/certificates/base/kustomization.yaml
+++ b/configs/certificates/base/kustomization.yaml
@@ -1,5 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - namespace.yaml
  - certificate-huizinga-dev.yaml
+  - secret-cloudflare-token.enc.yaml
+  - cluster-issuer.yaml
--- a/configs/certificates/base/secret-cloudflare-token.enc.yaml
+++ b/configs/certificates/base/secret-cloudflare-token.enc.yaml
--- a/configs/certificates/certificates.yaml
+++ b/configs/certificates/certificates.yaml
@@ -8,10 +8,14 @@ spec:
  retryInterval: 2m
  timeout: 15m
  dependsOn:
-    - name: letsencrypt
+    - name: cert-manager
  sourceRef:
    kind: ExternalArtifact
    name: certificates
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
  path: ./${cluster_env}
  prune: true
  wait: true
--- a/configs/certificates/production/certificate-huizinga-dev.yaml
+++ b/configs/certificates/production/certificate-huizinga-dev.yaml
@@ -2,7 +2,7 @@ apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: huizinga-dev
-  namespace: certificates
+  namespace: default
 spec:
  commonName: "huizinga.dev"
  dnsNames:
--- a/configs/certificates/staging/certificate-huizinga-dev.yaml
+++ b/configs/certificates/staging/certificate-huizinga-dev.yaml
@@ -2,7 +2,7 @@ apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: huizinga-dev
-  namespace: certificates
+  namespace: default
 spec:
  commonName: "staging.huizinga.dev"
  dnsNames:
--- a/configs/cilium-config/base/cilium-l2-announcement-policy.yaml
+++ b/configs/cilium-config/base/cilium-l2-announcement-policy.yaml
@@ -0,0 +1,9 @@
+apiVersion: cilium.io/v2alpha1
+kind: CiliumL2AnnouncementPolicy
+metadata:
+  name: default-policy
+spec:
+  interfaces:
+    - ^eth[0-9]+
+  externalIPs: true
+  loadBalancerIPs: true
--- a/configs/cilium-config/base/gateway.yaml
+++ b/configs/cilium-config/base/gateway.yaml
@@ -0,0 +1,18 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: gateway
+  namespace: default
+spec:
+  gatewayClassName: cilium
+  listeners:
+    - name: https
+      protocol: HTTPS
+      port: 443
+      tls:
+        certificateRefs:
+          - kind: Secret
+            name: huizinga-dev-tls
+      allowedRoutes:
+        namespaces:
+          from: All
--- a/configs/cilium-config/base/kustomization.yaml
+++ b/configs/cilium-config/base/kustomization.yaml
@@ -1,5 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - secret-cloudflare-token.enc.yaml
-  - cluster-issuer.yaml
+  - cilium-l2-announcement-policy.yaml
+  - gateway.yaml
--- a/configs/cilium-config/cilium-config.yaml
+++ b/configs/cilium-config/cilium-config.yaml
@@ -0,0 +1,17 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cilium-config
+  namespace: flux-system
+spec:
+  interval: 1h
+  retryInterval: 2m
+  timeout: 15m
+  dependsOn:
+    - name: cilium
+  sourceRef:
+    kind: ExternalArtifact
+    name: cilium-config
+  path: ./${cluster_env}
+  prune: true
+  wait: true
--- a/configs/cilium-config/production/cilium-load-balancer-ip-pool.yaml
+++ b/configs/cilium-config/production/cilium-load-balancer-ip-pool.yaml
@@ -0,0 +1,7 @@
+apiVersion: cilium.io/v2alpha1
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: default-pool
+spec:
+  blocks:
+    - cidr: 10.0.2.100/24
--- a/configs/cilium-config/production/kustomization.yaml
+++ b/configs/cilium-config/production/kustomization.yaml
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+  - cilium-load-balancer-ip-pool.yaml
--- a/configs/cilium-config/staging/cilium-load-balancer-ip-pool.yaml
+++ b/configs/cilium-config/staging/cilium-load-balancer-ip-pool.yaml
@@ -0,0 +1,8 @@
+apiVersion: cilium.io/v2alpha1
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: default-pool
+spec:
+  blocks:
+    - start: 192.168.1.100
+      stop: 192.168.1.200
--- a/configs/cilium-config/staging/kustomization.yaml
+++ b/configs/cilium-config/staging/kustomization.yaml
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+  - cilium-load-balancer-ip-pool.yaml
--- a/controllers/artifacts.yaml
+++ b/controllers/artifacts.yaml
@@ -19,11 +19,6 @@ spec:
      copy:
        - from: "@foundation/controllers/cert-manager/**"
          to: "@artifact/"
-    - name: spegel
-      originRevision: "@foundation"
-      copy:
-        - from: "@foundation/controllers/spegel/**"
-          to: "@artifact/"
    - name: openebs
      originRevision: "@foundation"
      copy:
--- a/controllers/cnpg/base/kustomization.yaml
+++ b/controllers/cnpg/base/kustomization.yaml
@@ -4,6 +4,7 @@ resources:
  - namespace.yaml
  - helm-repository.yaml
  - helm-release.yaml
+  - https://github.com/cloudnative-pg/plugin-barman-cloud/releases/download/v0.9.0/manifest.yaml

 configurations:
  - name-reference.yaml
--- a/controllers/cnpg/cnpg.yaml
+++ b/controllers/cnpg/cnpg.yaml
@@ -7,6 +7,12 @@ spec:
  interval: 1h
  retryInterval: 2m
  timeout: 5m
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  dependsOn:
+    - name: cert-manager
  sourceRef:
    kind: ExternalArtifact
    name: cnpg
--- a/controllers/cnpg/staging/kustomization.yaml
+++ b/controllers/cnpg/staging/kustomization.yaml
@@ -2,6 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../base
+  - secret-s3-garage.enc.yaml
+  - object-store.yaml

 configMapGenerator:
  - name: values-overlay
--- a/controllers/cnpg/staging/object-store.yaml
+++ b/controllers/cnpg/staging/object-store.yaml
@@ -0,0 +1,18 @@
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: garage-store
+  namespace: cnpg-system
+spec:
+  configuration:
+    destinationPath: s3://cnpg-backup/
+    endpointURL: http://192.178.1.1:3900
+    s3Credentials:
+      accessKeyId:
+        name: s3-garage
+        key: ACCESS_KEY_ID
+      secretAccessKey:
+        name: s3-garage
+        key: ACCESS_SECRET_KEY
+    wal:
+      compression: gzip
--- a/controllers/cnpg/staging/secret-s3-garage.enc.yaml
+++ b/controllers/cnpg/staging/secret-s3-garage.enc.yaml
@@ -0,0 +1,54 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: s3-garage
+    namespace: cnpg-system
+type: Opaque
+stringData:
+    ACCESS_KEY_ID: ENC[AES256_GCM,data:TOEQMG/kHs5XUk77ijyV089ZTq1dKsoZUas=,iv:mVDOkl5qOxGdvCvdcXUuUjX85oKqbd+n5maHsKwCiFg=,tag:pho0oWPTwtM6lGQ2vA1d5A==,type:str]
+    SECRET_ACCESS_KEY: ENC[AES256_GCM,data:mc42T/AQ8NRi32SzvwGJA6LEq1x0Yz3Tu+CPDYPf+E2+C00zQcGRk6tACPvRoMxRzU4ZZpK346e2K/8ajU77hg==,iv:Isxe81aQEbI5xd1dRjXDKj/2Jp9eTHdv0/XVBBHoRyE=,tag:gtcmKmfUIfIy977Df11P4g==,type:str]
+sops:
+    age:
+        - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3cmd2NkxFOVB0a1R3MHVN
+            RWRwbFVVaHF6Mlo4UElIZ1ROd1pyV1czSEYwCmFQMGM3Nkw0U0hzcWdyQVpnZTZL
+            eFNLWW5iNWpZVU9BQm9KakV4dEJzaGsKLS0tIGZ0ajdRZjZIUnNRSElzeENYRG4r
+            eUJHQVAzeWJSUDZTYy8zbTJIQ3pscjAKERe7k/VVNqMhqe2rLLRA9dO71bjieffX
+            YMIzJ0/UNMo2el4bcefwRnqwl0oyPG+pMXZ3F6UXyEoZw3ZIc4Nzvg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhakxrQ1Zrd3FRekZwZkU4
+            MVBpdloxeTJWQm1GZjA4M2NFVk1IYWtrTG1RCnpaRGh1WDZ4dCtzeFhkK1YzczYz
+            dmFNSWQ1bXgwQjJ1VlkrQnFhMXJ3bGcKLS0tIDhpcWx0MklNazJ0SjUzRmlyV0Er
+            K09tZGI0Z2w0eXh5eHcvcEttMy82aU0K2fnCDfYIShzw2Zipof+C8zf9pcOmiDg9
+            2SCiIfAJs9MB3n078P068z77KpvdlJYOi9pUTKSBhNw+mBI24y6X6A==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-15T03:46:42Z"
+    mac: ENC[AES256_GCM,data:UG9rSQ4ep7Ln4g5QCtvD6U90Oc8iWpni+kypMpJ+AQM8LC0TTs9zFQgcxmo2wjZn38Fp+br/5KC172SqBNG4Q1yXhlRiqiIeyx9ynrZeceRSqHaaruB1hj83/0FwahqjB/t6yutWIfnp00UC92mMKGlef48UNZ8IW17e5uHE0m4=,iv:LvR4BEkgAr6PJ8fYATFois4j8/rgztn/Jggj/mFgCIk=,tag:W38qDd1RkCdK3bVMqOVnjA==,type:str]
+    pgp:
+        - created_at: "2025-12-11T23:56:15Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA51kG++kLewoARAA2+TLPMKYQFUjyuER+HZgY5Zl4qcF94sYcZuTdcvl/Pam
+            l//PcgU80DLb/3IZ1K12EYyuZ+QVdJxmUQt1OvBUWv2p0/5mU7zbkxc8YJ/vc46b
+            yMX7mmDnzuyU2Lss0hUl5dDDk3pdC4SgjrBz15g9TvS2jOWDTOwKCb1DEghfzB07
+            /9Yfj6Rfds2gqsUgfyxVCzHXzC0SNpuqqPLmnzNmjYiQGNFOCOdyxP6c2ehCI6Bq
+            Lu38n6rjTj2QWJZvtr57a2IVqmFVcD9wcy7ITUk8u9+ncYemLmx1LTQKD6n0WDHm
+            DwjRjziqdJRpHo70Q6TUanFppqTB2q1CReS4yk9sc3CINq9fRJrKtOeJxW8x81yZ
+            o3X++3gYbsRIrApVAFECJyKA4H6eK1gp4djNV7K0MmbQcR/7wSqaYrE6vTPml7jG
+            Ribd7eGvF2FnH5P/z3ckh6HH2Ln+i+iVy+ZeY+lgWuIrVNDWwR8mDH8AkjXuGTu4
+            K6ra+kCna6v7CAKwlGd31rk9i0CTNTqyHEQeqYuto/HTEC0Jj/lRyFPq+KuuvoAq
+            vxQlmP6VnYR0gTfkneBAny4neu3zrbYMuIMWoA9pAhZBNOLPuPXZtUwhAStHBS1V
+            Sdc6AI9CXSPFIP2WDn6iwjwXElkG5+iYyngf3tXrJUVXs0SQeFH05j3r5zVNT0zS
+            XgFAiWuLAOyWWvP+Jlre5dgKnbiaSs3wIVL9Qw9MuHIWdlXmTyuQ5SQKErQLSQ2j
+            b5ogtCcgcbVd+OsZCHWQbPtLI2yk/n0afA9D6cRvLHbNZGrWRZjdTYUHU2Drp0w=
+            =/yAN
+            -----END PGP MESSAGE-----
+          fp: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0
Author	SHA1	Message	Date
Dreaded_X	cb2e95409f	feat: Added lldap All checks were successful kustomization/cilium-config/09e7e40f reconciliation succeeded kustomization/flux-system/09e7e40f reconciliation succeeded	2025-12-17 03:47:49 +01:00
Dreaded_X	2cc36bacce	feat: Added default gateway	2025-12-17 03:47:49 +01:00
Dreaded_X	3f56000b40	feat: Move certificates to default namespace	2025-12-17 03:36:56 +01:00
Dreaded_X	0913887ecc	feat: Setup cilium L2 announcments and IP pool	2025-12-17 03:36:55 +01:00
Dreaded_X	0b7ba9c2a4	feat: Move spegel to apps All checks were successful kustomization/spegel/1498c208 reconciliation succeeded kustomization/cilium/1498c208 reconciliation succeeded kustomization/local-path-provisioner/1498c208 reconciliation succeeded kustomization/cert-manager/1498c208 reconciliation succeeded kustomization/longhorn/1498c208 reconciliation succeeded kustomization/longhorn-jobs/1498c208 reconciliation succeeded kustomization/cnpg/1498c208 reconciliation succeeded kustomization/certificates/1498c208 reconciliation succeeded kustomization/flux-system/1498c208 reconciliation succeeded kustomization/alerts/1498c208 reconciliation succeeded	2025-12-17 00:41:12 +01:00
Dreaded_X	cfa317caf4	feat: Put ClusterIssuer under certificates	2025-12-17 00:41:11 +01:00
Dreaded_X	8a83ae3ab3	feat: Added barman cloud plugin	2025-12-17 00:41:11 +01:00