ce7cb702218693d08ea6d83464d2457c9250027c

services/bot-redirect/k8s/network-policy.yaml

@@ -0,0 +1,32 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: bot-redirect
+  namespace: argo
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: bot-redirect
+  egress:
+    - toEntities: [kube-apiserver]
+      toPorts:
+        - ports:
+            - { port: "6443", protocol: TCP }
+            - { port: "443", protocol: TCP }
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - { port: "53", protocol: UDP }
+            - { port: "53", protocol: TCP }
+          rules:
+            dns:
+              - matchName: api.cloudflare.com
+              - matchName: kubernetes.default.svc.cluster.local
+    - toFQDNs:
+        - matchName: api.cloudflare.com
+      toPorts:
+        - ports:
+            - { port: "443", protocol: TCP }

services/bot-redirect/k8s/rbac.yaml

@@ -0,0 +1,61 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: bot-redirect
+  namespace: argo
+imagePullSecrets:
+  - name: bot-redirect-pull
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: bot-redirect-vso
+  namespace: argo
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: bot-redirect
+  namespace: forgejo-public
+rules:
+  - apiGroups: [gateway.networking.k8s.io]
+    resources: [httproutes]
+    verbs: [get, list, patch, create, delete]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: bot-redirect
+  namespace: forgejo-public
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: bot-redirect
+subjects:
+  - kind: ServiceAccount
+    name: bot-redirect
+    namespace: argo
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: bot-redirect
+  namespace: argo
+rules:
+  - apiGroups: [argoproj.io]
+    resources: [workflowtaskresults]
+    verbs: [create, patch]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: bot-redirect
+  namespace: argo
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: bot-redirect
+subjects:
+  - kind: ServiceAccount
+    name: bot-redirect
+    namespace: argo

services/bot-redirect/k8s/vso.yaml

@@ -0,0 +1,58 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: bot-redirect
+  namespace: argo
+spec:
+  method: kubernetes
+  mount: kubernetes
+  kubernetes:
+    role: bot-redirect
+    serviceAccount: bot-redirect-vso
+  vaultConnectionRef: vault/vault
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: bot-redirect
+  namespace: argo
+spec:
+  type: kv-v2
+  mount: secret
+  path: cloudflare/radar
+  refreshAfter: 1h
+  vaultAuthRef: bot-redirect
+  destination:
+    name: bot-redirect
+    create: true
+    overwrite: true
+    transformation:
+      excludeRaw: true
+      excludes: [.*]
+      templates:
+        token:
+          text: '{{ get .Secrets "api-token" }}'
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: bot-redirect-pull
+  namespace: argo
+spec:
+  type: kv-v2
+  mount: secret
+  path: quay/robots/cluster_pull
+  refreshAfter: 1h
+  vaultAuthRef: bot-redirect
+  destination:
+    name: bot-redirect-pull
+    create: true
+    overwrite: true
+    type: kubernetes.io/dockerconfigjson
+    transformation:
+      excludeRaw: true
+      excludes: [.*]
+      templates:
+        .dockerconfigjson:
+          text: >-
+            {"auths":{"registry.quorate.internal":{"auth":"{{ printf "%s:%s" (get .Secrets "username") (get .Secrets "token") | b64enc }}"}}}

services/bot-redirect/k8s/workflow.yaml

@@ -0,0 +1,47 @@
+apiVersion: argoproj.io/v1alpha1
+kind: WorkflowTemplate
+metadata:
+  name: bot-redirect
+  namespace: argo
+spec:
+  entrypoint: reconcile
+  serviceAccountName: bot-redirect
+  podMetadata:
+    labels:
+      app.kubernetes.io/name: bot-redirect
+  volumes:
+    - name: source
+      configMap:
+        name: bot-redirect
+    - name: radar
+      secret:
+        secretName: bot-redirect
+  templates:
+    - name: reconcile
+      container:
+        image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+        command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
+        args: [/source/run.fsx]
+        env:
+          - name: SSL_CERT_FILE
+            value: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+        volumeMounts:
+          - name: source
+            mountPath: /source
+            readOnly: true
+          - name: radar
+            mountPath: /radar
+            readOnly: true
+---
+apiVersion: argoproj.io/v1alpha1
+kind: CronWorkflow
+metadata:
+  name: bot-redirect
+  namespace: argo
+spec:
+  schedules: ["17 18 * * *"]
+  timezone: UTC
+  concurrencyPolicy: Forbid
+  workflowSpec:
+    workflowTemplateRef:
+      name: bot-redirect