ce7cb702218693d08ea6d83464d2457c9250027c

services/stalwart/k8s/normal/controller/deploy.yaml

@@ -0,0 +1,133 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: stalwart-controller
+  namespace: stalwart
+spec:
+  replicas: 2
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 0
+  template:
+    spec:
+      topologySpreadConstraints:
+        - maxSkew: 1
+          minDomains: 2
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: DoNotSchedule
+          labelSelector:
+            matchLabels:
+              app.kubernetes.io/name: stalwart-controller
+              app.kubernetes.io/instance: stalwart
+      containers:
+        - name: controller
+          args:
+            - --dsn-file
+            - /run/database/dsn
+            - --plan
+            - /desired/plan.json
+            - --secret-root
+            - /run/control
+            - --stalwart-url
+            - http://stalwart-admin.stalwart.svc.cluster.local:8080
+            - --certificate-san
+            - mail.quorate.dev
+            - --oidc-issuer-file
+            - /run/control/oidc_issuer_url
+            - --oidc-audience-file
+            - /run/control/oidc_audience
+            - --oidc-client-id-file
+            - /run/control/oidc_client_id
+            - --oidc-client-secret-file
+            - /run/control/oidc_client_secret
+            - --app-passwords
+            - /desired/app-passwords.json
+            - --vault-address
+            - https://vault.vault.svc.cluster.local:8200
+            - --vault-role
+            - stalwart-cred-writer
+            - --vault-token-file
+            - /run/vault/token
+            - --vault-ca-cert-file
+            - /run/control/internal_ca_cert
+            - --status-address
+            - 0.0.0.0:9090
+            - --interval
+            - 5m
+            - --initial-backoff
+            - 5s
+            - --max-backoff
+            - 5m
+            - --reconcile-timeout
+            - 2m
+            - --persistent-failure-after
+            - "5"
+            - --standby-ready
+          volumeMounts:
+            - name: control
+              mountPath: /run/control
+              readOnly: true
+            - name: vault-token
+              mountPath: /run/vault
+              readOnly: true
+      volumes:
+        - name: control
+          projected:
+            defaultMode: 0440
+            sources:
+              - secret:
+                  name: stalwart-oidc
+                  items:
+                    - key: audience
+                      path: oidc_audience
+                    - key: client_id
+                      path: oidc_client_id
+                    - key: client_secret
+                      path: oidc_client_secret
+                    - key: controller_subject
+                      path: oidc_controller_subject
+                    - key: human_admin_subject
+                      path: oidc_human_admin_subject
+                    - key: issuer_url
+                      path: oidc_issuer_url
+                    - key: notifier_subject
+                      path: oidc_notifier_subject
+                    - key: notifier_client_id
+                      path: notifier_client_id
+                    - key: notifier_client_secret
+                      path: notifier_client_secret
+                    - key: sender_subject
+                      path: oidc_sender_subject
+                    - key: sender_client_id
+                      path: sender_client_id
+                    - key: sender_client_secret
+                      path: sender_client_secret
+                    - key: test_client_id
+                      path: test_client_id
+                    - key: test_client_secret
+                      path: test_client_secret
+                    - key: test_subject
+                      path: oidc_test_subject
+              - secret:
+                  name: stalwart-runtime
+                  items:
+                    - key: dragonfly_url
+                      path: dragonfly_url
+                    - key: internal_ca_cert
+                      path: internal_ca_cert
+              - secret:
+                  name: stalwart-delivery
+                  items:
+                    - key: relay_endpoint
+                      path: relay_endpoint
+                    - key: relay_username
+                      path: relay_username
+        - name: vault-token
+          projected:
+            defaultMode: 0440
+            sources:
+              - serviceAccountToken:
+                  path: token
+                  expirationSeconds: 600

services/stalwart/k8s/normal/controller/pdb.yaml

@@ -0,0 +1,11 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: stalwart-controller
+  namespace: stalwart
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: stalwart-controller
+      app.kubernetes.io/instance: stalwart

services/stalwart/k8s/normal/controller/policy.yaml

@@ -0,0 +1,30 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: stalwart-controller-continuous
+  namespace: stalwart
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: stalwart-controller
+      app.kubernetes.io/instance: stalwart
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: stalwart
+            app.kubernetes.io/name: stalwart
+            app.kubernetes.io/instance: stalwart
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: vault
+            app.kubernetes.io/name: vault
+            app.kubernetes.io/instance: vault
+            component: server
+      toPorts:
+        - ports:
+            - port: "8200"
+              protocol: TCP