ms2k/quorate
SHA256
Watch
0
Code Releases Activity

ce7cb702218693d08ea6d83464d2457c9250027c

Browse source
This commit is contained in:
ms2k 2026-11-12 20:46:28 +09:00
commit 34c5f8963c
74 changed files with 145336 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

35
vendor/infrastructure/cert-manager/config/issuers.yaml vendored Normal file
View file

@ -0,0 +1,35 @@
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: vault-internal
spec:
vault:
path: pki_int/sign/cert-manager
server: https://vault-active-tls.vault.svc.cluster.local:443
serverName: vault-active-direct.vault.svc.cluster.local
caBundleSecretRef:
name: vault-root-ca
key: ca.crt
auth:
kubernetes:
role: cert-manager
mountPath: /v1/auth/kubernetes
serviceAccountRef:
name: cert-manager
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt
spec:
acme:
server: https://acme-v02.api.letsencrypt.org/directory
email: [email protected]
privateKeySecretRef:
name: letsencrypt-account-key
solvers:
- dns01:
cloudflare:
apiTokenSecretRef:
name: cloudflare-api-token
key: api-token

7
vendor/infrastructure/cert-manager/config/kustomization.yaml vendored Normal file
View file

@ -0,0 +1,7 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- vault-root-ca.yaml
- vso.yaml
- vault-auth.yaml
- issuers.yaml

24
vendor/infrastructure/cert-manager/config/vault-auth.yaml vendored Normal file
View file

@ -0,0 +1,24 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: vault-auth
namespace: cert-manager
rules:
- apiGroups: [""]
resources: [serviceaccounts/token]
resourceNames: [cert-manager]
verbs: [create]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: vault-auth
namespace: cert-manager
subjects:
- kind: ServiceAccount
name: cert-manager
namespace: cert-manager
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: vault-auth

20
vendor/infrastructure/cert-manager/config/vault-root-ca.yaml vendored Normal file
View file

@ -0,0 +1,20 @@
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultDynamicSecret
metadata:
name: vault-root-ca
namespace: cert-manager
spec:
vaultAuthRef: kv
mount: pki
path: cert/ca
requestHTTPMethod: GET
refreshAfter: 1h
destination:
create: true
overwrite: true
name: vault-root-ca
transformation:
excludeRaw: true
templates:
ca.crt:
text: '{{ get .Secrets "certificate" }}'

31
vendor/infrastructure/cert-manager/config/vso.yaml vendored Normal file
View file

@ -0,0 +1,31 @@
---
# VSO syncs the Cloudflare API token from Vault KV -> cert-manager namespace
# so the letsencrypt ClusterIssuer can use it for DNS-01 challenges.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultAuth
metadata:
name: kv
namespace: cert-manager
spec:
method: kubernetes
mount: kubernetes
kubernetes:
role: cert-manager-kv
serviceAccount: cert-manager
vaultConnectionRef: vault/vault
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
name: cloudflare-api-token
namespace: cert-manager
spec:
type: kv-v2
mount: secret
path: cloudflare/cert-manager-dns01
destination:
name: cloudflare-api-token
create: true
overwrite: true
refreshAfter: 1h
vaultAuthRef: kv

45
vendor/infrastructure/cert-manager/helm-release.yaml vendored Normal file
View file

@ -0,0 +1,45 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: cert-manager
namespace: cert-manager
spec:
interval: 15m
releaseName: cert-manager
targetNamespace: cert-manager
chart:
spec:
chart: cert-manager
version: v1.21.3
sourceRef:
kind: HelmRepository
name: jetstack-oci
namespace: flux-system
install:
createNamespace: true
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
crds:
enabled: true
replicaCount: 2
webhook:
replicaCount: 2
podDisruptionBudget:
enabled: true
cainjector:
replicaCount: 2
podDisruptionBudget:
enabled: true
podDisruptionBudget:
enabled: true
extraArgs:
- --dns01-recursive-nameservers-only
- --dns01-recursive-nameservers=1.1.1.1:53,1.0.0.1:53
resources:
requests:
cpu: 10m
memory: 32Mi

6
vendor/infrastructure/cert-manager/kustomization.yaml vendored Normal file
View file

@ -0,0 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- helm-release.yaml
- network-policies.yaml

4
vendor/infrastructure/cert-manager/namespace.yaml vendored Normal file
View file

@ -0,0 +1,4 @@
apiVersion: v1
kind: Namespace
metadata:
name: cert-manager

145
vendor/infrastructure/cert-manager/network-policies.yaml vendored Normal file
View file

@ -0,0 +1,145 @@
---
# cert-manager controller: metrics from host (9403), apiserver.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: cert-manager
namespace: cert-manager
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/component: controller
ingress:
- fromEntities:
- host
toPorts:
- ports:
- port: "9403"
protocol: TCP
egress:
- toEntities:
- kube-apiserver
toPorts:
- ports:
- port: "6443"
protocol: TCP
- toEntities:
- world
toPorts:
- ports:
- port: "80"
protocol: TCP
- port: "443"
protocol: TCP
- port: "53"
protocol: UDP
- port: "53"
protocol: TCP
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- port: "53"
protocol: UDP
- port: "53"
protocol: TCP
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: vault
app.kubernetes.io/name: vault
component: server
toPorts:
- ports:
- port: "8200"
protocol: TCP
---
# cert-manager webhook: called by kube-apiserver on 6080, also needs apiserver.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: cert-manager-webhook
namespace: cert-manager
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/component: webhook
ingress:
- fromEntities:
- kube-apiserver
- host
- remote-node
toPorts:
- ports:
- port: "6080"
protocol: TCP
- port: "10250"
protocol: TCP
egress:
- toEntities:
- kube-apiserver
toPorts:
- ports:
- port: "6443"
protocol: TCP
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- port: "53"
protocol: UDP
- port: "53"
protocol: TCP
---
# Host egress to cert-manager pods (webhook, metrics).
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: host-egress-cert-manager
spec:
nodeSelector: {}
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: cert-manager
toPorts:
- ports:
- port: "6080"
protocol: TCP
- port: "9403"
protocol: TCP
- port: "10250"
protocol: TCP
---
# cert-manager cainjector: only needs apiserver.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: cert-manager-cainjector
namespace: cert-manager
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/component: cainjector
ingress: []
egress:
- toEntities:
- kube-apiserver
toPorts:
- ports:
- port: "6443"
protocol: TCP
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- port: "53"
protocol: UDP
- port: "53"
protocol: TCP

81
vendor/infrastructure/cilium/config/gateway-relay.yaml vendored Normal file
View file

@ -0,0 +1,81 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: gateway-relay-tls
namespace: kube-system
spec:
secretName: gateway-relay-tls
secretTemplate:
annotations:
reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: zitadel,stalwart
reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: zitadel
issuerRef:
name: letsencrypt
kind: ClusterIssuer
commonName: quorate.dev
dnsNames:
- quorate.dev
- "*.quorate.dev"
duration: 2160h
renewBefore: 360h
privateKey:
algorithm: ECDSA
size: 256
rotationPolicy: Always
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: gateway-relay
namespace: kube-system
annotations:
io.cilium/lb-ipam-ips: "10.104.40.127"
spec:
gatewayClassName: cilium
listeners:
- name: https
port: 443
protocol: HTTPS
hostname: "*.quorate.dev"
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: gateway-relay-tls
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
gateway.quorate.internal/allow-public: "true"
- name: http
port: 80
protocol: HTTP
hostname: "*.quorate.dev"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
gateway.quorate.internal/allow-public: "true"
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: https-redirect-relay
namespace: kube-system
spec:
parentRefs:
- name: gateway-relay
namespace: kube-system
sectionName: http
hostnames:
- "*.quorate.dev"
rules:
- filters:
- type: RequestRedirect
requestRedirect:
scheme: https
statusCode: 301

89
vendor/infrastructure/cilium/config/gateway.yaml vendored Normal file
View file

@ -0,0 +1,89 @@
---
# Shared Gateways live in kube-system; label for allowedRoutes Selector.
apiVersion: v1
kind: Namespace
metadata:
name: kube-system
labels:
gateway.quorate.internal/allow-internal: "true"
gateway.quorate.internal/allow-public: "true"
---
# Wildcard TLS cert for all *.quorate.internal services on Gateway I.
# cert-manager issues this via the vault-internal ClusterIssuer.
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: gateway-internal-tls
namespace: kube-system
spec:
secretName: gateway-internal-tls
issuerRef:
name: vault-internal
kind: ClusterIssuer
commonName: quorate.internal
dnsNames:
- quorate.internal
- "*.quorate.internal"
duration: 2160h
renewBefore: 360h
privateKey:
algorithm: ECDSA
size: 256
rotationPolicy: Always
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: gateway-internal
namespace: kube-system
annotations:
io.cilium/lb-ipam-ips: "10.90.141.119"
spec:
gatewayClassName: cilium
listeners:
- name: https
port: 443
protocol: HTTPS
hostname: "*.quorate.internal"
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: gateway-internal-tls
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
gateway.quorate.internal/allow-internal: "true"
- name: http
port: 80
protocol: HTTP
hostname: "*.quorate.internal"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
gateway.quorate.internal/allow-internal: "true"
---
# Redirect all HTTP *.quorate.internal traffic to HTTPS.
# cert.quorate.internal is excluded by hostname specificity — its own route wins.
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: https-redirect
namespace: kube-system
spec:
parentRefs:
- name: gateway-internal
namespace: kube-system
sectionName: http
hostnames:
- "*.quorate.internal"
rules:
- filters:
- type: RequestRedirect
requestRedirect:
scheme: https
statusCode: 301

7
vendor/infrastructure/cilium/config/kustomization.yaml vendored Normal file
View file

@ -0,0 +1,7 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- l2.yaml
- gateway.yaml
- gateway-relay.yaml
- policies/global.yaml

65
vendor/infrastructure/cilium/config/l2.yaml vendored Normal file
View file

@ -0,0 +1,65 @@
apiVersion: cilium.io/v2
kind: CiliumLoadBalancerIPPool
metadata:
name: lb-pool
spec:
blocks:
- cidr: 10.90.141.119/16
---
apiVersion: cilium.io/v2
kind: CiliumBGPPeerConfig
metadata:
name: opnsense-peer-settings
spec:
ebgpMultihop: 10
gracefulRestart:
enabled: true
restartTimeSeconds: 15
families:
- afi: ipv4
safi: unicast
advertisements:
matchLabels:
advertise: "opnsense-policy"
---
apiVersion: cilium.io/v2
kind: CiliumBGPClusterConfig
metadata:
name: bgp-to-opnsense
spec:
nodeSelector:
matchLabels: {}
bgpInstances:
- name: "cilium"
localASN: 64513
peers:
- name: "opnsense-router"
peerASN: 64512
peerAddress: "10.77.102.91"
peerConfigRef:
name: "opnsense-peer-settings"
---
apiVersion: cilium.io/v2
kind: CiliumBGPAdvertisement
metadata:
name: advertise-selected-services
labels:
advertise: "opnsense-policy"
spec:
advertisements:
- advertisementType: "Service"
service:
addresses:
- LoadBalancerIP
selector:
matchExpressions:
- key: io.cilium/bgp-announce
operator: Exists
- advertisementType: "Service"
service:
addresses:
- LoadBalancerIP
selector:
matchExpressions:
- key: gateway.networking.k8s.io/gateway-name
operator: Exists

51
vendor/infrastructure/cilium/config/policies/global.yaml vendored Normal file
View file

@ -0,0 +1,51 @@
# CiliumClusterwideNetworkPolicies — endpointSelector-based only.
# These are safe to apply at any time independently of host-firewall.yaml.
#
# nodeSelector-based host firewall policies (etcd, BGP, SSH, etc.) live
# exclusively in host-firewall.yaml and must be applied as a unit.
---
# Allow all pods to reach the kube-apiserver regardless of which entity identity
# the node IP resolves to (kube-apiserver vs host in K3s embedded mode).
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: allow-kube-apiserver-egress
spec:
endpointSelector: {}
egress:
- toEntities:
- kube-apiserver
- host
toPorts:
- ports:
- port: "6443"
protocol: TCP
# API hostname resolves to the OPNsense/HAProxy VIP. Cilium classifies
# that address as reserved:world/cidr, not kube-apiserver.
- toCIDR:
- 10.72.123.235/32
toPorts:
- ports:
- port: "6443"
protocol: TCP
---
# Cilium health checks: covers both node-level probes and the reserved:health
# endpoints that each Cilium agent creates (pod-CIDR IPs, identity=health).
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: allow-cilium-health
spec:
endpointSelector:
matchLabels:
reserved:health: ""
ingress:
- fromEntities:
- remote-node
- host
egress:
- toEntities:
- remote-node
- host

74
vendor/infrastructure/cilium/helm-release.yaml vendored Normal file
View file

@ -0,0 +1,74 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: cilium
namespace: kube-system
spec:
interval: 15m
releaseName: cilium
targetNamespace: kube-system
chart:
spec:
chart: cilium
version: 1.20.4
sourceRef:
kind: HelmRepository
name: cilium
namespace: flux-system
upgrade:
remediation:
retries: 3
values:
updateStrategy:
rollingUpdate:
maxUnavailable: 1
envoy:
updateStrategy:
rollingUpdate:
maxUnavailable: 1
upgradeCompatibility: "1.19"
ipam:
operator:
clusterPoolIPv4PodCIDRList: 172.19.28.14/12
cluster:
name: "********"
bpf:
masquerade: true
resources:
limits:
memory: 4Gi
requests:
cpu: 100m
memory: 512Mi
bgpControlPlane:
enabled: true
kubeProxyReplacement: true
policyEnforcementMode: always
gatewayAPI:
enabled: true
enableAlpn: true
enableAppProtocol: true
encryption:
enabled: true
type: wireguard
hostFirewall:
enabled: true
hubble:
export:
static:
enabled: true
filePath: stdout
allowList:
- '{"verdict":["DROPPED","AUDIT"]}'
relay:
enabled: true
replicas: 2
ui:
enabled: true
replicas: 2
k8sServiceHost: k3s.********.internal
k8sServicePort: 6443
operator:
replicas: 2
routingMode: tunnel
tunnelProtocol: vxlan

357
vendor/infrastructure/cilium/host-firewall/host-firewall.yaml vendored Normal file
View file

@ -0,0 +1,357 @@
# CiliumClusterwideNetworkPolicies for the host network stack (nodeSelector-based).
# CCNPs are additive — node-specific policies extend host-base, not replace it.
# Entity/endpoint selectors are preferred over CIDRs. CIDRs only match reserved:world
# identity — use them only for genuinely external IPs (SSH, BGP, DNS gateway).
---
# Base policy: every node.
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: host-base
annotations:
kustomize.toolkit.fluxcd.io/prune: disabled
spec:
nodeSelector: {}
ingress:
- fromEntities:
- host
- remote-node
- kube-apiserver
toPorts:
- ports:
- port: "4240"
protocol: TCP
- port: "4244"
protocol: TCP
- fromEntities:
- host
- remote-node
- kube-apiserver
icmps:
- fields:
- type: 8
family: IPv4
# Pods with Cilium identities (e.g. hubble-relay) need fromEndpoints;
# fromCIDR with pod CIDR compiles to reserved:world and doesn't match.
- fromEndpoints:
- {}
toPorts:
- ports:
- port: "4244"
protocol: TCP
- fromEntities:
- host
- remote-node
toPorts:
- ports:
- port: "51871"
protocol: UDP
- port: "8472"
protocol: UDP
- fromCIDR:
- 10.63.81.107/24
- 10.162.8.60/24
toPorts:
- ports:
- port: "22"
protocol: TCP
- fromCIDR:
- 10.77.102.91/32
- 10.212.111.120/32
toPorts:
- ports:
- port: "179"
protocol: TCP
- fromEntities:
- kube-apiserver
- remote-node
toPorts:
- ports:
- port: "10250"
protocol: TCP
# metrics-server pod scrapes kubelet on 10250.
- fromEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s:k8s-app: metrics-server
toPorts:
- ports:
- port: "10250"
protocol: TCP
egress:
- toEntities:
- host
- remote-node
- kube-apiserver
toPorts:
- ports:
- port: "4240"
protocol: TCP
- port: "4244"
protocol: TCP
- port: "51871"
protocol: UDP
- port: "8472"
protocol: UDP
- toEntities:
- host
- remote-node
- kube-apiserver
icmps:
- fields:
- type: 8
family: IPv4
- fields:
- type: 11
family: IPv4
- toCIDR:
- 10.212.111.120/32
toPorts:
- ports:
- port: "53"
protocol: UDP
- port: "53"
protocol: TCP
- toEntities:
- world
toPorts:
- ports:
- port: "67"
protocol: UDP
- port: "123"
protocol: UDP
# HTTPS: host package repositories and registries use CDN-backed endpoints
# with changing IPs, so keep this entity-based instead of CIDR-based.
- toEntities:
- world
toPorts:
- ports:
- port: "443"
protocol: TCP
- toCIDR:
- 10.77.102.91/32
- 10.212.111.120/32
toPorts:
- ports:
- port: "179"
protocol: TCP
- toEntities:
- kube-apiserver
toPorts:
- ports:
- port: "6443"
protocol: TCP
# API hostname resolves to the OPNsense/HAProxy VIP. Cilium classifies
# that address as reserved:world/cidr, not kube-apiserver.
- toCIDR:
- 10.72.123.235/32
toPorts:
- ports:
- port: "6443"
protocol: TCP
# Cilium health checks
- toEntities:
- health
toPorts:
- ports:
- port: "4240"
protocol: TCP
- port: "4244"
protocol: TCP
- toEntities:
- health
icmps:
- fields:
- type: 8
family: IPv4
---
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: host-kubelet
annotations:
kustomize.toolkit.fluxcd.io/prune: disabled
spec:
nodeSelector: {}
ingress:
- fromEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: victoriametrics
app.kubernetes.io/name: vmagent
app.kubernetes.io/instance: main
toPorts:
- ports:
- port: "10250"
protocol: TCP
---
# Control-plane nodes: apiserver ingress + etcd client/peer traffic.
# All other rules inherited from host-base.
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: host-control-plane
annotations:
kustomize.toolkit.fluxcd.io/prune: disabled
spec:
nodeSelector:
matchLabels:
node-role.kubernetes.io/control-plane: "true"
ingress:
# All nodes, pods, and external clients (kubectl) need apiserver access.
- fromEntities:
- remote-node
- host
- kube-apiserver
- world
toPorts:
- ports:
- port: "6443"
protocol: TCP
- fromEndpoints:
- {}
toPorts:
- ports:
- port: "6443"
protocol: TCP
- fromEntities:
- host
- remote-node
- kube-apiserver
toPorts:
- ports:
- port: "2379"
protocol: TCP
- port: "2380"
protocol: TCP
- fromCIDR:
- 10.115.187.218/24
toPorts:
- ports:
- port: "2379"
protocol: TCP
- port: "2380"
protocol: TCP
egress:
- toEntities:
- host
- remote-node
toPorts:
- ports:
- port: "2379"
protocol: TCP
- port: "2380"
protocol: TCP
- toCIDR:
- 10.115.187.218/24
toPorts:
- ports:
- port: "2379"
protocol: TCP
- port: "2380"
protocol: TCP
- toCIDR:
- 10.212.111.120/32
toPorts:
- ports:
- port: "8443"
protocol: TCP
---
# Gateway API: LoadBalancer VIP traffic is processed via the host network path
# by Cilium's kube-proxy replacement, so host endpoint policy governs it
# even though the Envoy proxy runs as a regular pod.
# Allow LAN/WireGuard and public WAN traffic to ports 80 and 443 on all nodes.
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: host-gateway
annotations:
kustomize.toolkit.fluxcd.io/prune: disabled
spec:
nodeSelector: {}
ingress:
- fromCIDR:
- 10.115.187.218/24
- 10.63.81.107/24
- 10.162.8.60/24
toPorts:
- ports:
- port: "80"
protocol: TCP
- port: "443"
protocol: TCP
- fromEntities:
- world
toPorts:
- ports:
- port: "80"
protocol: TCP
- port: "443"
protocol: TCP
---
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: host-oci-l4-relay
annotations:
kustomize.toolkit.fluxcd.io/prune: disabled
spec:
nodeSelector: {}
ingress:
- fromEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: victoriametrics
app.kubernetes.io/name: vmagent
app.kubernetes.io/instance: main
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
app.kubernetes.io/name: oci-l4-relay-wan-controller
toPorts:
- ports:
- port: "19100"
protocol: TCP
- fromEntities:
- world
toPorts:
- ports:
- port: "25"
protocol: TCP
- port: "465"
protocol: TCP
- port: "993"
protocol: TCP
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- port: "53"
protocol: UDP
- port: "53"
protocol: TCP
- toServices:
- k8sService:
namespace: stalwart
serviceName: stalwart-relay
toPorts:
- ports:
- port: "25"
protocol: TCP
- port: "465"
protocol: TCP
- port: "993"
protocol: TCP
- toCIDR:
- 64.110.109.70/32
toPorts:
- ports:
- port: "51820"
protocol: UDP
- toCIDR:
- 10.40.68.115/32
toPorts:
- ports:
- port: "19100"
protocol: TCP

4
vendor/infrastructure/cilium/host-firewall/kustomization.yaml vendored Normal file
View file

@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- host-firewall.yaml

4
vendor/infrastructure/cilium/kustomization.yaml vendored Normal file
View file

@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- helm-release.yaml

84
vendor/infrastructure/flux-core/flux-instance.yaml vendored Normal file
View file

@ -0,0 +1,84 @@
apiVersion: fluxcd.controlplane.io/v1
kind: FluxInstance
metadata:
name: flux
namespace: flux-system
annotations:
fluxcd.controlplane.io/reconcileEvery: 1h
fluxcd.controlplane.io/reconcileTimeout: 5m
spec:
distribution:
version: 2.10.0
registry: ghcr.io/fluxcd
components:
- source-controller
- kustomize-controller
- helm-controller
- notification-controller
cluster:
type: kubernetes
size: small
multitenant: false
networkPolicy: true
domain: cluster.local
kustomize:
patches:
- target:
kind: Deployment
name: helm-controller
patch: |
- op: replace
path: /spec/template/spec/containers/0/image
value: ghcr.io/fluxcd/helm-controller:v1.7.1@sha256:54526cc6ed1202d71d44c310676448065664f3255ad671d9a69ac26f904e617a
- op: replace
path: /spec/replicas
value: 2
- op: replace
path: /spec/template/spec/containers/0/resources/requests/cpu
value: 25m
- target:
kind: Deployment
name: kustomize-controller
patch: |
- op: replace
path: /spec/template/spec/containers/0/image
value: ghcr.io/fluxcd/kustomize-controller:v1.10.1@sha256:37db29b25dae35b881a5e064acedb0cc954442da453a39eaa0eab7a90dbecc4e
- op: replace
path: /spec/replicas
value: 2
- target:
kind: Deployment
name: notification-controller
patch: |
- op: replace
path: /spec/template/spec/containers/0/image
value: ghcr.io/fluxcd/notification-controller:v1.10.0@sha256:9f58b9532ec9d3ccf539cd3ccdf283477a5dcb7777b922db5477d8bbd4d3767c
- op: replace
path: /spec/replicas
value: 2
- op: replace
path: /spec/template/spec/containers/0/resources/requests/cpu
value: 10m
- target:
kind: Deployment
name: source-controller
patch: |
- op: replace
path: /spec/template/spec/containers/0/image
value: ghcr.io/fluxcd/source-controller:v1.10.1@sha256:611b6bca3eae95bcff471414d1fb14a4ab83d7f14e609cccef2bd389c121f37e
- target:
kind: ClusterRole
name: crd-controller-flux-system
patch: |
- op: test
path: /rules/11
value: {apiGroups: [authorization.k8s.io], resources: [subjectaccessreviews], verbs: [create]}
- op: remove
path: /rules/11
sync:
kind: GitRepository
url: ssh://[email protected]/quorate/cluster.git
ref: refs/heads/master
path: clusters/main
pullSecret: git-ssh-auth
interval: 1m

68
vendor/infrastructure/flux-core/helm-release.yaml vendored Normal file
View file

@ -0,0 +1,68 @@
apiVersion: source.toolkit.fluxcd.io/v1
kind: OCIRepository
metadata:
name: flux-operator
namespace: flux-system
spec:
interval: 1h
url: oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator
ref:
digest: sha256:35f074fba9be748dd9f6439a7f2495a10ec6b753550b950e8be68affc5c7457d
layerSelector:
mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
operation: copy
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: flux-operator
namespace: flux-system
spec:
interval: 30m
timeout: 5m
releaseName: flux-operator
serviceAccountName: flux-operator
chartRef:
kind: OCIRepository
name: flux-operator
install:
remediation:
retries: 3
upgrade:
strategy:
name: RetryOnFailure
remediation:
retries: 3
driftDetection:
mode: enabled
postRenderers:
- kustomize:
patches:
- target:
kind: Deployment
name: flux-operator
patch: |
apiVersion: apps/v1
kind: Deployment
metadata:
name: flux-operator
spec:
replicas: 2
template:
spec:
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchLabels:
app.kubernetes.io/instance: flux-operator
app.kubernetes.io/name: flux-operator
topologyKey: kubernetes.io/hostname
values:
resources:
limits:
cpu: 2000m
memory: 1Gi
requests:
cpu: 15m
memory: 336Mi

Some files were not shown because too many files have changed in this diff Show more