ce7cb702218693d08ea6d83464d2457c9250027c

services/short/k8s/control/deployment.yaml

@@ -0,0 +1,114 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: controller
+  namespace: short
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: controller
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: controller
+        app.kubernetes.io/instance: short
+    spec:
+      serviceAccountName: short-controller
+      imagePullSecrets:
+      - name: pull
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - topologyKey: kubernetes.io/hostname
+            labelSelector:
+              matchLabels:
+                app.kubernetes.io/name: controller
+                app.kubernetes.io/instance: short
+      containers:
+      - name: controller
+        image: short-image
+        args:
+        - controller
+        env:
+        - name: POD_UID
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.uid
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: VAULT_ADDR
+          value: https://vault.vault.svc.cluster.local:8200
+        - name: OPNSENSE_URL
+          value: https://10.212.111.120:8443
+        - name: SSL_CERT_FILE
+          value: /ca/ca.crt
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+            - ALL
+        resources:
+          requests:
+            cpu: 50m
+            memory: 64Mi
+          limits:
+            memory: 192Mi
+        volumeMounts:
+        - name: config
+          mountPath: /config
+          readOnly: true
+        - name: ca
+          mountPath: /ca
+          readOnly: true
+      volumes:
+      - name: ca
+        secret:
+          secretName: ca
+      - name: config
+        projected:
+          defaultMode: 288
+          sources:
+          - secret:
+              name: api
+              items:
+              - key: private_key
+                path: private_key
+          - secret:
+              name: cloud
+              items:
+              - key: config
+                path: cloud.json
+          - secret:
+              name: opnsense
+              items:
+              - key: key
+                path: opnsense/key
+              - key: secret
+                path: opnsense/secret
+          - secret:
+              name: ca-opnsense
+              items:
+              - key: ca.crt
+                path: opnsense/ca.crt
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: controller
+  namespace: short
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: controller

services/short/k8s/control/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - deployment.yaml
+  - rbac.yaml
+  - vault.yaml
+  - policy.yaml

services/short/k8s/control/policy.yaml

@@ -0,0 +1,43 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: controller
+  namespace: short
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: controller
+  egress:
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: kube-system
+        k8s:k8s-app: kube-dns
+    toPorts:
+    - ports:
+      - port: '53'
+        protocol: UDP
+      - port: '53'
+        protocol: TCP
+      rules:
+        dns:
+        - matchPattern: '*'
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: vault
+        app.kubernetes.io/name: vault
+    toPorts:
+    - ports:
+      - port: '8200'
+        protocol: TCP
+  - toCIDR:
+    - 10.212.111.120/32
+    toPorts:
+    - ports:
+      - port: '8443'
+        protocol: TCP
+  - toFQDNs:
+    - matchPattern: iaas.*.oraclecloud.com
+    toPorts:
+    - ports:
+      - port: '443'
+        protocol: TCP

services/short/k8s/control/rbac.yaml

@@ -0,0 +1,107 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: short-controller
+  namespace: short
+---
+apiVersion: coordination.k8s.io/v1
+kind: Lease
+metadata:
+  name: controller
+  namespace: short
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: controller
+  namespace: short
+rules:
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  resourceNames:
+  - controller
+  verbs:
+  - get
+  - update
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: controller
+  namespace: short
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: controller
+subjects:
+- kind: ServiceAccount
+  name: short-controller
+  namespace: short
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: short
+  annotations:
+    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
+spec:
+  externalCIDRs: []
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: short-peers
+rules:
+- apiGroups:
+  - cilium.io
+  resources:
+  - ciliumcidrgroups
+  resourceNames:
+  - short
+  verbs:
+  - get
+  - update
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: short-peers
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: short-peers
+subjects:
+- kind: ServiceAccount
+  name: short-controller
+  namespace: short
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: short-gateway
+  namespace: kube-system
+rules:
+- apiGroups:
+  - ''
+  resources:
+  - services
+  resourceNames:
+  - cilium-gateway-gateway-short
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: short-gateway
+  namespace: kube-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: short-gateway
+subjects:
+- kind: ServiceAccount
+  name: short-controller
+  namespace: short

services/short/k8s/control/vault.yaml

@@ -0,0 +1,111 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: api
+  namespace: short
+spec:
+  vaultAuthRef: short
+  type: kv-v2
+  mount: secret
+  path: short/api
+  refreshAfter: 1m
+  destination:
+    create: true
+    overwrite: true
+    name: api
+    transformation:
+      excludeRaw: true
+      excludes:
+      - .*
+      templates:
+        private_key:
+          text: '{{ get .Secrets "private_key" }}'
+  rolloutRestartTargets:
+  - kind: Deployment
+    name: controller
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: cloud
+  namespace: short
+spec:
+  vaultAuthRef: short
+  type: kv-v2
+  mount: secret
+  path: short/cloud
+  refreshAfter: 1m
+  destination:
+    create: true
+    overwrite: true
+    name: cloud
+    transformation:
+      excludeRaw: true
+      excludes:
+      - .*
+      templates:
+        config:
+          text: '{{ get .Secrets "config" }}'
+  rolloutRestartTargets:
+  - kind: Deployment
+    name: controller
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: opnsense
+  namespace: short
+spec:
+  vaultAuthRef: short
+  type: kv-v2
+  mount: secret
+  path: opnsense/interface-watcher
+  refreshAfter: 1h
+  destination:
+    create: true
+    overwrite: true
+    name: opnsense
+    transformation:
+      excludeRaw: true
+      excludes:
+      - .*
+      templates:
+        key:
+          text: '{{ get .Secrets "key" }}'
+        secret:
+          text: '{{ get .Secrets "secret" }}'
+  rolloutRestartTargets:
+  - kind: Deployment
+    name: controller
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: opnsense-ca
+  namespace: short
+spec:
+  vaultAuthRef: short
+  type: kv-v2
+  mount: secret
+  path: ca/opnsense
+  hmacSecretData: true
+  refreshAfter: 1h
+  destination:
+    create: true
+    overwrite: true
+    name: ca-opnsense
+    transformation:
+      excludeRaw: true
+      excludes:
+      - .*
+      templates:
+        ca.crt:
+          text: >-
+            {{- $ca := get .Secrets "certificate" -}}
+            {{- if not (hasPrefix "-----BEGIN CERTIFICATE-----" $ca) -}}
+            {{- fail "CA publication is pending" -}}
+            {{- end -}}
+            {{- $ca -}}
+  rolloutRestartTargets:
+  - kind: Deployment
+    name: controller