feat: Added lldap

2025-12-18 03:50:58 +01:00
42 changed files with 26 additions and 456 deletions
@@ -19,8 +19,3 @@ spec:
      copy:
        - from: "@foundation/apps/lldap/**"
          to: "@artifact/"
-    - name: authelia
-      originRevision: "@foundation"
-      copy:
-        - from: "@foundation/apps/authelia/**"
-          to: "@artifact/"
@@ -1,20 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: authelia
-  namespace: flux-system
-spec:
-  interval: 1h
-  retryInterval: 2m
-  timeout: 5m
-  dependsOn:
-    - name: cnpg
-    - name: lldap-controller
-    - name: dragonfly-operator
-    - name: authelia-controller
-  sourceRef:
-    kind: ExternalArtifact
-    name: authelia
-  path: ./${cluster_env}
-  prune: true
-  wait: true
@@ -1,16 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: db
-spec:
-  bootstrap:
-    recovery:
-      source: source
-  externalClusters:
-    - name: source
-      plugin:
-        name: barman-cloud.cloudnative-pg.io
-        parameters:
-          barmanObjectName: garage-store
-          serverName: db
-  plugins: []
@@ -1,15 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: db
-  namespace: authelia
-  # TODO: Add labels?
-spec:
-  storage:
-    size: 8Gi
-    storageClass: local-path
-  plugins:
-    - name: barman-cloud.cloudnative-pg.io
-      isWALArchiver: true
-      parameters:
-        barmanObjectName: garage-store
@@ -1,29 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: authelia
-  namespace: authelia
-spec:
-  interval: 12h
-  install:
-    strategy:
-      name: RetryOnFailure
-      retryInterval: 2m
-  upgrade:
-    strategy:
-      name: RetryOnFailure
-      retryInterval: 3m
-  chart:
-    spec:
-      chart: authelia
-      version: "0.10.x"
-      sourceRef:
-        kind: HelmRepository
-        name: authelia
-      interval: 24h
-  valuesFrom:
-    - kind: ConfigMap
-      name: values-base
-    - kind: ConfigMap
-      name: values-overlay
-      optional: true
@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: authelia
-  namespace: authelia
-spec:
-  interval: 24h
-  url: https://charts.authelia.com
@@ -1,25 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - namespace.yaml
-  - cluster.yaml
-  - service-user.yaml
-  - helm-repository.yaml
-  - helm-release.yaml
-  - secret-s3-garage.yaml
-  - object-store.yaml
-
-configurations:
-  - name-reference.yaml
-
-configMapGenerator:
-  - name: values-base
-    namespace: authelia
-    files:
-      - values.yaml
-
-# Uncomment to restore database from backup
-# patches:
-#   - path: cluster-restore.yaml
-#     target:
-#       kind: Cluster
@@ -1,6 +0,0 @@
-nameReference:
-  - kind: ConfigMap
-    version: v1
-    fieldSpecs:
-      - path: spec/valuesFrom/name
-        kind: HelmRelease
@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: authelia
-  namespace: authelia
@@ -1,20 +0,0 @@
-apiVersion: barmancloud.cnpg.io/v1
-kind: ObjectStore
-metadata:
-  name: garage-store
-  namespace: authelia
-spec:
-  configuration:
-    destinationPath: s3://cnpg-backup/authelia
-    s3Credentials:
-      accessKeyId:
-        name: s3-garage
-        key: ACCESS_KEY_ID
-      secretAccessKey:
-        name: s3-garage
-        key: ACCESS_SECRET_KEY
-      region:
-        name: s3-garage
-        key: REGION
-    wal:
-      compression: gzip
@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: s3-garage
-  namespace: authelia
-  annotations:
-    reflector.v1.k8s.emberstack.com/reflects: "cnpg-system/s3-garage"
-type: Opaque
-data: {}
@@ -1,6 +0,0 @@
-apiVersion: lldap.huizinga.dev/v1
-kind: ServiceUser
-metadata:
-  name: authelia
-  namespace: authelia
-spec: {}
@@ -1,61 +0,0 @@
-pod:
-  kind: Deployment
-  replicas: 2
-ingress:
-  enabled: true
-  gatewayAPI:
-    enabled: true
-    parentRefs:
-      - name: gateway
-        namespace: default
-
-secret:
-  additionalSecrets:
-    db-app:
-      key: db-app
-    authelia-lldap-credentials:
-      key: authelia-lldap-credentials
-
-configMap:
-  authentication_backend:
-    ldap:
-      enabled: true
-      implementation: lldap
-      address: ldap://lldap.lldap.svc.cluster.local:3890
-      base_dn: dc=huizinga,dc=dev
-      additional_users_dn: ou=people
-      users_filter: "(&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))"
-      additional_groups_dn: ou=groups
-      groups_filter: "(member={dn})"
-      attributes:
-        display_name: displayName
-        username: uid
-        group_name: cn
-        mail: mail
-      user: uid=authelia.authelia,ou=people,dc=huizinga,dc=dev
-      password:
-        secret_name: authelia-lldap-credentials
-        path: password
-
-  session:
-    redis:
-      enabled: true
-      host: dragonfly.authelia
-
-  storage:
-    postgres:
-      enabled: true
-      address: tcp://db-rw.authelia:5432
-      database: app
-      username: app
-      password:
-        secret_name: db-app
-        path: password
-
-  notifier:
-    filesystem:
-      enabled: true
-
-  access_control:
-    secret:
-      existingSecret: authelia-acl
@@ -1,6 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: db
-spec:
-  instances: 2
@@ -1,7 +0,0 @@
-apiVersion: dragonflydb.io/v1alpha1
-kind: Dragonfly
-metadata:
-  name: dragonfly
-  namespace: authelia
-spec:
-  replicas: 2
@@ -1,16 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-  - dragonfly.yaml
-
-patches:
-  - path: cluster.yaml
-    target:
-      kind: Cluster
-
-configMapGenerator:
-  - name: values-overlay
-    namespace: authelia
-    files:
-      - values.yaml
@@ -1,8 +0,0 @@
-pod:
-  replicas: 2
-
-configMap:
-  session:
-    cookies:
-      - subdomain: auth
-        domain: huizinga.dev
@@ -1,6 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: db
-spec:
-  instances: 1
@@ -1,7 +0,0 @@
-apiVersion: dragonflydb.io/v1alpha1
-kind: Dragonfly
-metadata:
-  name: dragonfly
-  namespace: authelia
-spec:
-  replicas: 1
@@ -1,19 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-  - dragonfly.yaml
-
-patches:
-  - path: cluster.yaml
-    target:
-      kind: Cluster
-  - path: object-store.yaml
-    target:
-      kind: ObjectStore
-
-configMapGenerator:
-  - name: values-overlay
-    namespace: authelia
-    files:
-      - values.yaml
@@ -1,8 +0,0 @@
-apiVersion: barmancloud.cnpg.io/v1
-kind: ObjectStore
-metadata:
-  name: garage-store
-  namespace: lldap
-spec:
-  configuration:
-    endpointURL: http://192.168.1.1:3900
@@ -1,11 +0,0 @@
-pod:
-  replicas: 1
-
-configMap:
-  log:
-    level: debug
-
-  session:
-    cookies:
-      - subdomain: auth
-        domain: staging.huizinga.dev
@@ -1,16 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: db
-spec:
-  bootstrap:
-    recovery:
-      source: source
-  externalClusters:
-    - name: source
-      plugin:
-        name: barman-cloud.cloudnative-pg.io
-        parameters:
-          barmanObjectName: garage-store
-          serverName: db
-  plugins: []
@@ -1,7 +1,7 @@
 apiVersion: postgresql.cnpg.io/v1
 kind: Cluster
 metadata:
-  name: db
+  name: lldap-db
  namespace: lldap
  # TODO: Add labels?
 spec:
@@ -56,7 +56,7 @@ spec:
            - name: LLDAP_DATABASE_URL
              valueFrom:
                secretKeyRef:
-                  name: db-app
+                  name: lldap-db-app
                  key: uri
            - name: TZ
              value: CET
@@ -9,9 +9,3 @@ resources:
  - http-route.yaml
  - secret-s3-garage.yaml
  - object-store.yaml
-
-# Uncomment to restore database from backup
-# patches:
-#   - path: cluster-restore.yaml
-#     target:
-#       kind: Cluster
@@ -5,7 +5,8 @@ metadata:
  namespace: lldap
 spec:
  configuration:
-    destinationPath: s3://cnpg-backup/lldap
+    destinationPath: s3://cnpg-backup/
+    endpointURL: http://192.168.1.1:3900
    s3Credentials:
      accessKeyId:
        name: s3-garage
@@ -1,6 +1,6 @@
 apiVersion: postgresql.cnpg.io/v1
 kind: Cluster
 metadata:
-  name: db
+  name: lldap-db
 spec:
  instances: 2
@@ -1,6 +1,6 @@
 apiVersion: postgresql.cnpg.io/v1
 kind: Cluster
 metadata:
-  name: db
+  name: lldap-db
 spec:
  instances: 1
@@ -10,9 +10,6 @@ patches:
  - path: cluster.yaml
    target:
      kind: Cluster
-  - path: object-store.yaml
-    target:
-      kind: ObjectStore
  - path: http-route.yaml
    target:
      kind: HTTPRoute
@@ -1,8 +0,0 @@
-apiVersion: barmancloud.cnpg.io/v1
-kind: ObjectStore
-metadata:
-  name: garage-store
-  namespace: lldap
-spec:
-  configuration:
-    endpointURL: http://192.168.1.1:3900
@@ -10,9 +10,6 @@ resources:
  - ../../controllers/local-path-provisioner/local-path-provisioner.yaml
  - ../../controllers/cnpg/cnpg.yaml
  - ../../controllers/reflector/reflector.yaml
-  - ../../controllers/lldap-controller/lldap-controller.yaml
-  - ../../controllers/authelia-controller/authelia-controller.yaml
-  - ../../controllers/dragonfly-operator/dragonfly-operator.yaml

  - ../../configs/artifacts.yaml
  - ../../configs/cilium-config/cilium-config.yaml
@@ -23,4 +20,3 @@ resources:
  - ../../apps/artifacts.yaml
  - ../../apps/spegel/spegel.yaml
  - ../../apps/lldap/lldap.yaml
-  - ../../apps/authelia/authelia.yaml
@@ -44,8 +44,3 @@ spec:
      copy:
        - from: "@foundation/controllers/reflector/**"
          to: "@artifact/"
-    - name: dragonfly-operator
-      originRevision: "@foundation"
-      copy:
-        - from: "@foundation/controllers/dragonfly-operator/**"
-          to: "@artifact/"
@@ -1,26 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: OCIRepository
-metadata:
-  name: authelia-controller
-  namespace: flux-system
-spec:
-  interval: 1m0s
-  url: oci://git.huizinga.dev/infra/authelia-controller/manifests
-  ref:
-    tag: edge
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: authelia-controller
-  namespace: flux-system
-spec:
-  interval: 1h
-  retryInterval: 2m
-  timeout: 5m
-  sourceRef:
-    kind: OCIRepository
-    name: authelia-controller
-  path: ./
-  prune: true
-  wait: true
@@ -13,14 +13,9 @@ spec:
    strategy:
      name: RetryOnFailure
      retryInterval: 3m
-  chart:
-    spec:
-      chart: cert-manager
-      version: "1.19.x"
-      sourceRef:
-        kind: HelmRepository
-        name: cert-manager
-      interval: 24h
+  chartRef:
+    kind: OCIRepository
+    name: cert-manager
  values:
    crds:
      enabled: true
@@ -1,9 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: cert-manager
-  namespace: cert-manager
-spec:
-  type: "oci"
-  interval: 24h
-  url: oci://quay.io/jetstack/charts/
@@ -1,6 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - namespace.yaml
-  - helm-repository.yaml
-  - helm-release.yaml
+  - ./namespace.yaml
+  - ./oci-repository.yaml
+  - ./helm-release.yaml
@@ -0,0 +1,13 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  interval: 24h
+  url: oci://quay.io/jetstack/charts/cert-manager
+  layerSelector:
+    mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip"
+    operation: copy
+  ref:
+    semver: "1.19.x"
@@ -17,9 +17,7 @@ spec:
  chart:
    spec:
      chart: cilium
-      # Regression in cilium causes issues, so we stay on .7
-      version: "1.18.7"
-      # version: "1.18.x"
+      version: "1.18.x"
      sourceRef:
        kind: HelmRepository
        name: cilium
@@ -1,15 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: dragonfly-operator
-  namespace: flux-system
-spec:
-  interval: 1h
-  retryInterval: 2m
-  timeout: 5m
-  sourceRef:
-    kind: ExternalArtifact
-    name: dragonfly-operator
-  path: .
-  prune: true
-  wait: true
@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - https://raw.githubusercontent.com/dragonflydb/dragonfly-operator/v1.3.1/manifests/dragonfly-operator.yaml
@@ -1,28 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: OCIRepository
-metadata:
-  name: lldap-controller
-  namespace: flux-system
-spec:
-  interval: 1m0s
-  url: oci://git.huizinga.dev/infra/lldap-controller/manifests
-  ref:
-    tag: edge
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: lldap-controller
-  namespace: flux-system
-spec:
-  interval: 1h
-  retryInterval: 2m
-  timeout: 5m
-  dependsOn:
-    - name: lldap
-  sourceRef:
-    kind: OCIRepository
-    name: lldap-controller
-  path: ./
-  prune: true
-  wait: true