ce7cb702218693d08ea6d83464d2457c9250027c

services/stalwart/k8s/bootstrap/controller/deploy.yaml

@@ -0,0 +1,85 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: stalwart-controller
+  namespace: stalwart
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  template:
+    spec:
+      containers:
+        - name: controller
+          args:
+            - --dsn-file
+            - /run/database/dsn
+            - --plan
+            - /desired/plan.json
+            - --secret-root
+            - /run/control
+            - --stalwart-url
+            - http://stalwart-bootstrap.stalwart.svc.cluster.local:8080
+            - --certificate-san
+            - mail.quorate.dev
+            - --bootstrap-user
+            - recovery
+            - --bootstrap-password-file
+            - /run/bootstrap/password
+            - --status-address
+            - 0.0.0.0:9090
+            - --interval
+            - 5m
+            - --initial-backoff
+            - 5s
+            - --max-backoff
+            - 5m
+            - --reconcile-timeout
+            - 2m
+            - --persistent-failure-after
+            - "5"
+          volumeMounts:
+            - name: control
+              mountPath: /run/control
+              readOnly: true
+            - name: bootstrap
+              mountPath: /run/bootstrap
+              readOnly: true
+      volumes:
+        - name: control
+          projected:
+            defaultMode: 0440
+            sources:
+              - secret:
+                  name: stalwart-oidc
+                  items:
+                    - key: audience
+                      path: oidc_audience
+                    - key: controller_subject
+                      path: oidc_controller_subject
+                    - key: human_admin_subject
+                      path: oidc_human_admin_subject
+                    - key: issuer_url
+                      path: oidc_issuer_url
+                    - key: notifier_subject
+                      path: oidc_notifier_subject
+                    - key: sender_subject
+                      path: oidc_sender_subject
+                    - key: test_subject
+                      path: oidc_test_subject
+              - secret:
+                  name: stalwart-runtime
+                  items:
+                    - key: dragonfly_url
+                      path: dragonfly_url
+              - secret:
+                  name: stalwart-delivery
+                  items:
+                    - key: relay_endpoint
+                      path: relay_endpoint
+                    - key: relay_username
+                      path: relay_username
+        - name: bootstrap
+          secret:
+            secretName: stalwart-bootstrap
+            defaultMode: 0440

services/stalwart/k8s/bootstrap/controller/policy.yaml

@@ -0,0 +1,30 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: stalwart-controller-bootstrap
+  namespace: stalwart
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: stalwart-controller
+      app.kubernetes.io/instance: stalwart
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: stalwart
+            app.kubernetes.io/name: stalwart-bootstrap
+            app.kubernetes.io/instance: stalwart
+      toPorts:
+        - ports:
+            - port: "9090"
+              protocol: TCP
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: stalwart
+            app.kubernetes.io/name: stalwart-bootstrap
+            app.kubernetes.io/instance: stalwart
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP