ce7cb702218693d08ea6d83464d2457c9250027c

2026-11-12 20:46:28 +09:00 · 2026-11-12 20:46:28 +09:00 · 34c5f8963c
commit 34c5f8963c
5 changed files with 145336 additions and 0 deletions
--- a/services/oci-l4-relay-wan-controller/k8s/deployment.yaml
+++ b/services/oci-l4-relay-wan-controller/k8s/deployment.yaml
@ -0,0 +1,109 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: oci-l4-relay-wan-controller
+  namespace: kube-system
+spec:
+  replicas: 2
+  strategy:
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: oci-l4-relay-wan-controller
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: oci-l4-relay-wan-controller
+    spec:
+      serviceAccountName: oci-l4-relay-wan-controller
+      automountServiceAccountToken: true
+      securityContext:
+        fsGroup: 65532
+        fsGroupChangePolicy: OnRootMismatch
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  app.kubernetes.io/name: oci-l4-relay-wan-controller
+              topologyKey: kubernetes.io/hostname
+      containers:
+        - name: controller
+          image: registry.quorate.internal/quorate/oci-l4-relay-wan-controller@sha256:395e68f424e6fddcfb72cee8f83887ed219b47e16cd87562c4073325b3598803
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: OPNSENSE_URL
+              value: https://10.212.111.120:8443
+            - name: OPNSENSE_INTERFACE
+              value: WAN
+            - name: POLL_INTERVAL
+              value: 10s
+            - name: MINIMUM_OBSERVATIONS
+              value: "2"
+            - name: WIREGUARD_PORT
+              value: "51820"
+            - name: OPNSENSE_KEY_PATH
+              value: /run/secrets/opnsense/key
+            - name: OPNSENSE_SECRET_PATH
+              value: /run/secrets/opnsense/secret
+            - name: OPNSENSE_CA_PATH
+              value: /run/secrets/opnsense-ca/ca.crt
+            - name: OCI_TENANCY_OCID_PATH
+              value: /run/secrets/oci/tenancy_ocid
+            - name: OCI_USER_OCID_PATH
+              value: /run/secrets/oci/user_ocid
+            - name: OCI_FINGERPRINT_PATH
+              value: /run/secrets/oci/fingerprint
+            - name: OCI_PRIVATE_KEY_PATH
+              value: /run/secrets/oci/private_key
+            - name: OCI_REGION_PATH
+              value: /run/secrets/oci/region
+            - name: OCI_NSG_OCID_PATH
+              value: /run/secrets/oci/network_security_group_id
+            - name: OCI_SECURITY_RULE_ID_PATH
+              value: /run/secrets/oci/security_rule_id
+            - name: WG_STATUS_URL
+              value: http://oci-l4-relay-metrics.kube-system.svc.cluster.local:19100/metrics
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 65532
+            seccompProfile:
+              type: RuntimeDefault
+          resources:
+            requests:
+              cpu: 4m
+              memory: 20Mi
+            limits:
+              memory: 128Mi
+          volumeMounts:
+            - name: opnsense
+              mountPath: /run/secrets/opnsense
+              readOnly: true
+            - name: opnsense-ca
+              mountPath: /run/secrets/opnsense-ca
+              readOnly: true
+            - name: oci
+              mountPath: /run/secrets/oci
+              readOnly: true
+      volumes:
+        - name: opnsense
+          secret:
+            secretName: opnsense-interface-watcher
+            defaultMode: 0440
+        - name: opnsense-ca
+          secret:
+            secretName: ca-opnsense
+            defaultMode: 0440
+        - name: oci
+          secret:
+            secretName: oci-l4-relay-wan-controller-api
+            defaultMode: 0440
--- a/services/oci-l4-relay-wan-controller/k8s/kustomization.yaml
+++ b/services/oci-l4-relay-wan-controller/k8s/kustomization.yaml
@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: kube-system
+resources:
+  - service-account.yaml
+  - vault-secret.yaml
+  - deployment.yaml
+  - network-policy.yaml
--- a/services/oci-l4-relay-wan-controller/k8s/network-policy.yaml
+++ b/services/oci-l4-relay-wan-controller/k8s/network-policy.yaml
@ -0,0 +1,59 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: oci-l4-relay-wan-controller
+  namespace: kube-system
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: oci-l4-relay-wan-controller
+  ingress: []
+  egress:
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+    - toServices:
+        - k8sService:
+            namespace: kube-system
+            serviceName: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+    - toCIDR:
+        - 10.212.111.120/32
+      toPorts:
+        - ports:
+            - port: "8443"
+              protocol: TCP
+    - toEntities:
+        - host
+        - remote-node
+      toPorts:
+        - ports:
+            - port: "19100"
+              protocol: TCP
+    - toFQDNs:
+        - matchPattern: iaas.*.oraclecloud.com
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
--- a/services/oci-l4-relay-wan-controller/k8s/service-account.yaml
+++ b/services/oci-l4-relay-wan-controller/k8s/service-account.yaml
@ -0,0 +1,44 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: oci-l4-relay-wan-controller
+  namespace: kube-system
+automountServiceAccountToken: true
+imagePullSecrets:
+  - name: quay-cluster-pull
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: oci-l4-relay-wan-controller
+  namespace: kube-system
+rules:
+  - apiGroups:
+      - coordination.k8s.io
+    resources:
+      - leases
+    verbs:
+      - create
+  - apiGroups:
+      - coordination.k8s.io
+    resourceNames:
+      - wan-controller
+    resources:
+      - leases
+    verbs:
+      - get
+      - update
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: oci-l4-relay-wan-controller
+  namespace: kube-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: oci-l4-relay-wan-controller
+subjects:
+  - kind: ServiceAccount
+    name: oci-l4-relay-wan-controller
+    namespace: kube-system
--- a/services/oci-l4-relay-wan-controller/k8s/vault-secret.yaml
+++ b/services/oci-l4-relay-wan-controller/k8s/vault-secret.yaml
@ -0,0 +1,109 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: oci-l4-relay-wan-controller
+  namespace: kube-system
+spec:
+  method: kubernetes
+  mount: kubernetes
+  kubernetes:
+    role: oci-l4-relay-wan-controller
+    serviceAccount: oci-l4-relay-wan-controller
+  vaultConnectionRef: vault/vault
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: opnsense-interface-watcher
+  namespace: kube-system
+spec:
+  type: kv-v2
+  mount: secret
+  path: opnsense/interface-watcher
+  destination:
+    name: opnsense-interface-watcher
+    create: true
+    overwrite: true
+    transformation:
+      excludeRaw: true
+      excludes:
+        - .*
+      templates:
+        key:
+          text: '{{ get .Secrets "key" }}'
+        secret:
+          text: '{{ get .Secrets "secret" }}'
+  rolloutRestartTargets:
+    - kind: Deployment
+      name: oci-l4-relay-wan-controller
+  vaultAuthRef: oci-l4-relay-wan-controller
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: opnsense-root-ca
+  namespace: kube-system
+spec:
+  type: kv-v2
+  mount: secret
+  path: ca/opnsense
+  hmacSecretData: true
+  refreshAfter: 1h
+  destination:
+    name: ca-opnsense
+    create: true
+    overwrite: true
+    transformation:
+      excludeRaw: true
+      excludes:
+        - .*
+      templates:
+        ca.crt:
+          text: >-
+            {{- $ca := get .Secrets "certificate" -}}
+            {{- if not (hasPrefix "-----BEGIN CERTIFICATE-----" $ca) -}}
+            {{- fail "CA publication is pending" -}}
+            {{- end -}}
+            {{- $ca -}}
+  rolloutRestartTargets:
+    - kind: Deployment
+      name: oci-l4-relay-wan-controller
+  vaultAuthRef: oci-l4-relay-wan-controller
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: oci-l4-relay-wan-controller-api
+  namespace: kube-system
+spec:
+  type: kv-v2
+  mount: secret
+  path: oci/relay/wan-controller-api
+  destination:
+    name: oci-l4-relay-wan-controller-api
+    create: true
+    overwrite: true
+    transformation:
+      excludeRaw: true
+      excludes:
+        - .*
+      templates:
+        tenancy_ocid:
+          text: '{{ get .Secrets "tenancy_ocid" }}'
+        user_ocid:
+          text: '{{ get .Secrets "user_ocid" }}'
+        fingerprint:
+          text: '{{ get .Secrets "fingerprint" }}'
+        private_key:
+          text: |
+            {{ get .Secrets "private_key" }}
+        region:
+          text: '{{ get .Secrets "region" }}'
+        network_security_group_id:
+          text: '{{ get .Secrets "network_security_group_id" }}'
+        security_rule_id:
+          text: '{{ get .Secrets "security_rule_id" }}'
+  rolloutRestartTargets:
+    - kind: Deployment
+      name: oci-l4-relay-wan-controller
+  vaultAuthRef: oci-l4-relay-wan-controller