ce7cb702218693d08ea6d83464d2457c9250027c

services/oci-l4-relay/k8s/deployment.yaml

@@ -0,0 +1,147 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: oci-l4-relay
+spec:
+  replicas: 2
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: oci-l4-relay
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: oci-l4-relay
+    spec:
+      serviceAccountName: oci-l4-relay
+      automountServiceAccountToken: true
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  app.kubernetes.io/name: oci-l4-relay
+              topologyKey: kubernetes.io/hostname
+      priorityClassName: system-node-critical
+      terminationGracePeriodSeconds: 35
+      containers:
+        - name: relay-agent
+          image: registry.quorate.internal/quorate/oci-l4-relay-agent@sha256:c5d82adbde80a5a3c3e3ecbbc5aebf53d449474cbcfc2e7a7988576edf068dfc
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: POD_UID
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.uid
+            - name: POD_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIP
+            - name: POD_NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            - name: RELAY_TUNNEL_ADDRESS
+              value: 10.153.238.225/30
+            - name: RELAY_TARGETS
+              value: '[{"address":"10.104.40.127","ports":[80,443]}]'
+            - name: RELAY_MAIL_UPSTREAM
+              value: stalwart-relay.stalwart.svc.cluster.local
+            - name: RELAY_LOCAL_RETURN_CIDRS
+              value: 10.63.81.107/24,10.162.8.60/24
+            - name: RELAY_METRICS_LISTEN_ADDRESS
+              value: :19100
+            - name: OCI_RELAY_METRICS_URL
+              value: http://10.40.68.115:19100/metrics
+            - name: OCI_RELAY_ENDPOINT_IP
+              valueFrom:
+                secretKeyRef:
+                  name: oci-l4-relay-oci-wireguard
+                  key: endpoint_ip
+            - name: OCI_RELAY_LISTEN_PORT
+              valueFrom:
+                secretKeyRef:
+                  name: oci-l4-relay-oci-wireguard
+                  key: listen_port
+            - name: OCI_RELAY_PUBLIC_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: oci-l4-relay-oci-wireguard
+                  key: public_key
+          ports:
+            - name: metrics
+              containerPort: 19100
+              protocol: TCP
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+              add:
+                - NET_ADMIN
+                - NET_BIND_SERVICE
+            readOnlyRootFilesystem: true
+            runAsNonRoot: false
+            runAsUser: 0
+            seccompProfile:
+              type: RuntimeDefault
+          readinessProbe:
+            exec:
+              command:
+                - /oci-l4-relay-agent
+                - health
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            failureThreshold: 3
+          livenessProbe:
+            exec:
+              command:
+                - /oci-l4-relay-agent
+                - health
+            initialDelaySeconds: 15
+            periodSeconds: 10
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              memory: 128Mi
+          volumeMounts:
+            - name: home-wireguard
+              mountPath: /run/secrets/wireguard
+              readOnly: true
+            - name: runtime
+              mountPath: /run/relay-agent
+      volumes:
+        - name: home-wireguard
+          secret:
+            secretName: oci-l4-relay-home-wireguard
+            defaultMode: 0400
+        - name: runtime
+          emptyDir:
+            medium: Memory
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: oci-l4-relay
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: oci-l4-relay

services/oci-l4-relay/k8s/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: kube-system
+resources:
+  - service-account.yaml
+  - lease-rbac.yaml
+  - vault-secret.yaml
+  - deployment.yaml
+  - metrics-endpoint-slice.yaml
+  - service.yaml

services/oci-l4-relay/k8s/lease-rbac.yaml

@@ -0,0 +1,42 @@
+apiVersion: coordination.k8s.io/v1
+kind: Lease
+metadata:
+  name: oci-l4-relay
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: oci-l4-relay-lease
+rules:
+  - apiGroups:
+      - coordination.k8s.io
+    resources:
+      - leases
+    resourceNames:
+      - oci-l4-relay
+    verbs:
+      - get
+      - update
+      - patch
+  - apiGroups:
+      - discovery.k8s.io
+    resources:
+      - endpointslices
+    resourceNames:
+      - oci-l4-relay-metrics
+    verbs:
+      - get
+      - update
+      - patch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: oci-l4-relay-lease
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: oci-l4-relay-lease
+subjects:
+  - kind: ServiceAccount
+    name: oci-l4-relay

services/oci-l4-relay/k8s/metrics-endpoint-slice.yaml

@@ -0,0 +1,12 @@
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: oci-l4-relay-metrics
+  labels:
+    kubernetes.io/service-name: oci-l4-relay-metrics
+addressType: IPv4
+ports:
+  - name: metrics
+    protocol: TCP
+    port: 19100
+endpoints: []

services/oci-l4-relay/k8s/service-account.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: oci-l4-relay
+automountServiceAccountToken: true
+imagePullSecrets:
+  - name: quay-cluster-pull

services/oci-l4-relay/k8s/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: oci-l4-relay-metrics
+  labels:
+    app.kubernetes.io/name: oci-l4-relay
+    app.kubernetes.io/component: metrics
+spec:
+  ports:
+    - name: metrics
+      port: 19100
+      targetPort: metrics
+      protocol: TCP

services/oci-l4-relay/k8s/vault-secret.yaml

@@ -0,0 +1,92 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: oci-l4-relay
+spec:
+  method: kubernetes
+  mount: kubernetes
+  kubernetes:
+    role: oci-l4-relay
+    serviceAccount: oci-l4-relay
+  vaultConnectionRef: vault/vault
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: oci-l4-relay-home-wireguard
+spec:
+  type: kv-v2
+  mount: secret
+  path: oci/relay/home-wireguard
+  destination:
+    name: oci-l4-relay-home-wireguard
+    create: true
+    overwrite: true
+    transformation:
+      excludeRaw: true
+      excludes:
+        - .*
+      templates:
+        private_key:
+          text: '{{ get .Secrets "private_key" }}'
+  rolloutRestartTargets:
+    - kind: Deployment
+      name: oci-l4-relay
+  vaultAuthRef: oci-l4-relay
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: quay-cluster-pull
+spec:
+  type: kv-v2
+  mount: secret
+  path: quay/robots/cluster_pull
+  destination:
+    name: quay-cluster-pull
+    create: true
+    overwrite: true
+    type: kubernetes.io/dockerconfigjson
+    transformation:
+      excludeRaw: true
+      excludes:
+        - .*
+      templates:
+        .dockerconfigjson:
+          text: >-
+            {"auths":{"registry.quorate.internal":{"auth":"{{ printf "%s:%s" (get .Secrets "username") (get .Secrets "token") | b64enc }}"}}}
+  refreshAfter: 1h
+  rolloutRestartTargets:
+    - kind: Deployment
+      name: oci-l4-relay
+    - kind: Deployment
+      name: oci-l4-relay-wan-controller
+  vaultAuthRef: oci-l4-relay
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: oci-l4-relay-oci-wireguard
+spec:
+  type: kv-v2
+  mount: secret
+  path: oci/relay/peer
+  destination:
+    name: oci-l4-relay-oci-wireguard
+    create: true
+    overwrite: true
+    transformation:
+      excludeRaw: true
+      excludes:
+        - .*
+      templates:
+        endpoint_ip:
+          text: '{{ get .Secrets "endpoint_ip" }}'
+        listen_port:
+          text: '{{ get .Secrets "listen_port" }}'
+        public_key:
+          text: '{{ get .Secrets "public_key" }}'
+  rolloutRestartTargets:
+    - kind: Deployment
+      name: oci-l4-relay
+  vaultAuthRef: oci-l4-relay