ce7cb702218693d08ea6d83464d2457c9250027c

services/short/k8s/bootstrap/accounts.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: short-vso
+  namespace: short
+automountServiceAccountToken: false
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: short-seed
+  namespace: short
+imagePullSecrets:
+- name: pull

services/short/k8s/bootstrap/job.yaml

@@ -0,0 +1,55 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: seed
+  namespace: short
+  annotations:
+    kustomize.toolkit.fluxcd.io/force: Enabled
+spec:
+  completions: 2
+  parallelism: 2
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: seed
+        app.kubernetes.io/instance: short
+    spec:
+      serviceAccountName: short-seed
+      restartPolicy: Never
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+      - name: seed
+        image: short-image
+        args:
+        - seed
+        env:
+        - name: VAULT_ADDR
+          value: https://vault.vault.svc.cluster.local:8200
+        - name: SSL_CERT_FILE
+          value: /ca/ca.crt
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+            - ALL
+        resources:
+          requests:
+            cpu: 50m
+            memory: 32Mi
+          limits:
+            memory: 128Mi
+        volumeMounts:
+        - name: ca
+          mountPath: /ca
+          readOnly: true
+      volumes:
+      - name: ca
+        secret:
+          secretName: ca

services/short/k8s/bootstrap/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - accounts.yaml
+  - vault.yaml
+  - job.yaml
+  - policy.yaml
+  - vault-access.yaml

services/short/k8s/bootstrap/namespace.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: short
+  labels: {gateway.quorate.internal/allow-short: "true"}

services/short/k8s/bootstrap/policy.yaml

@@ -0,0 +1,31 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: seed
+  namespace: short
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: seed
+  egress:
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: kube-system
+        k8s:k8s-app: kube-dns
+    toPorts:
+    - ports:
+      - port: '53'
+        protocol: UDP
+      - port: '53'
+        protocol: TCP
+      rules:
+        dns:
+        - matchPattern: '*'
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: vault
+        app.kubernetes.io/name: vault
+    toPorts:
+    - ports:
+      - port: '8200'
+        protocol: TCP

services/short/k8s/bootstrap/vault-access.yaml

@@ -0,0 +1,17 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata: {name: short, namespace: vault}
+spec:
+  endpointSelector:
+    matchLabels: {app.kubernetes.io/name: vault, component: server}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: short
+            app.kubernetes.io/instance: short
+          matchExpressions:
+            - key: app.kubernetes.io/name
+              operator: In
+              values: [seed, controller]
+      toPorts:
+        - ports: [{port: "8200", protocol: TCP}]

services/short/k8s/bootstrap/vault.yaml

@@ -0,0 +1,60 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: short
+  namespace: short
+spec:
+  method: kubernetes
+  mount: kubernetes
+  kubernetes:
+    role: short-vso
+    serviceAccount: short-vso
+  vaultConnectionRef: vault/vault
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: pull
+  namespace: short
+spec:
+  vaultAuthRef: short
+  type: kv-v2
+  mount: secret
+  path: quay/robots/cluster_pull
+  refreshAfter: 1h
+  destination:
+    create: true
+    overwrite: true
+    name: pull
+    type: kubernetes.io/dockerconfigjson
+    transformation:
+      excludeRaw: true
+      excludes:
+      - .*
+      templates:
+        .dockerconfigjson:
+          text: '{"auths":{"registry.quorate.internal":{"auth":"{{ printf "%s:%s"
+            (get .Secrets "username") (get .Secrets "token") | b64enc }}"}}}'
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultDynamicSecret
+metadata:
+  name: ca
+  namespace: short
+spec:
+  vaultAuthRef: short
+  mount: pki
+  path: cert/ca
+  requestHTTPMethod: GET
+  refreshAfter: 1h
+  destination:
+    create: true
+    overwrite: true
+    name: ca
+    transformation:
+      excludeRaw: true
+      excludes:
+      - .*
+      templates:
+        ca.crt:
+          text: '{{ get .Secrets "certificate" }}'