ms2k/quorate
SHA256
Watch
0
Code Releases Activity

ce7cb702218693d08ea6d83464d2457c9250027c

Browse source
This commit is contained in:
ms2k 2026-11-12 20:46:28 +09:00
commit 34c5f8963c
9 changed files with 145336 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

81
vendor/infrastructure/cilium/config/gateway-relay.yaml vendored Normal file
View file

@ -0,0 +1,81 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: gateway-relay-tls
namespace: kube-system
spec:
secretName: gateway-relay-tls
secretTemplate:
annotations:
reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: zitadel,stalwart
reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: zitadel
issuerRef:
name: letsencrypt
kind: ClusterIssuer
commonName: quorate.dev
dnsNames:
- quorate.dev
- "*.quorate.dev"
duration: 2160h
renewBefore: 360h
privateKey:
algorithm: ECDSA
size: 256
rotationPolicy: Always
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: gateway-relay
namespace: kube-system
annotations:
io.cilium/lb-ipam-ips: "10.104.40.127"
spec:
gatewayClassName: cilium
listeners:
- name: https
port: 443
protocol: HTTPS
hostname: "*.quorate.dev"
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: gateway-relay-tls
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
gateway.quorate.internal/allow-public: "true"
- name: http
port: 80
protocol: HTTP
hostname: "*.quorate.dev"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
gateway.quorate.internal/allow-public: "true"
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: https-redirect-relay
namespace: kube-system
spec:
parentRefs:
- name: gateway-relay
namespace: kube-system
sectionName: http
hostnames:
- "*.quorate.dev"
rules:
- filters:
- type: RequestRedirect
requestRedirect:
scheme: https
statusCode: 301

89
vendor/infrastructure/cilium/config/gateway.yaml vendored Normal file
View file

@ -0,0 +1,89 @@
---
# Shared Gateways live in kube-system; label for allowedRoutes Selector.
apiVersion: v1
kind: Namespace
metadata:
name: kube-system
labels:
gateway.quorate.internal/allow-internal: "true"
gateway.quorate.internal/allow-public: "true"
---
# Wildcard TLS cert for all *.quorate.internal services on Gateway I.
# cert-manager issues this via the vault-internal ClusterIssuer.
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: gateway-internal-tls
namespace: kube-system
spec:
secretName: gateway-internal-tls
issuerRef:
name: vault-internal
kind: ClusterIssuer
commonName: quorate.internal
dnsNames:
- quorate.internal
- "*.quorate.internal"
duration: 2160h
renewBefore: 360h
privateKey:
algorithm: ECDSA
size: 256
rotationPolicy: Always
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: gateway-internal
namespace: kube-system
annotations:
io.cilium/lb-ipam-ips: "10.90.141.119"
spec:
gatewayClassName: cilium
listeners:
- name: https
port: 443
protocol: HTTPS
hostname: "*.quorate.internal"
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: gateway-internal-tls
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
gateway.quorate.internal/allow-internal: "true"
- name: http
port: 80
protocol: HTTP
hostname: "*.quorate.internal"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
gateway.quorate.internal/allow-internal: "true"
---
# Redirect all HTTP *.quorate.internal traffic to HTTPS.
# cert.quorate.internal is excluded by hostname specificity — its own route wins.
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: https-redirect
namespace: kube-system
spec:
parentRefs:
- name: gateway-internal
namespace: kube-system
sectionName: http
hostnames:
- "*.quorate.internal"
rules:
- filters:
- type: RequestRedirect
requestRedirect:
scheme: https
statusCode: 301

7
vendor/infrastructure/cilium/config/kustomization.yaml vendored Normal file
View file

@ -0,0 +1,7 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- l2.yaml
- gateway.yaml
- gateway-relay.yaml
- policies/global.yaml

65
vendor/infrastructure/cilium/config/l2.yaml vendored Normal file
View file

@ -0,0 +1,65 @@
apiVersion: cilium.io/v2
kind: CiliumLoadBalancerIPPool
metadata:
name: lb-pool
spec:
blocks:
- cidr: 10.90.141.119/16
---
apiVersion: cilium.io/v2
kind: CiliumBGPPeerConfig
metadata:
name: opnsense-peer-settings
spec:
ebgpMultihop: 10
gracefulRestart:
enabled: true
restartTimeSeconds: 15
families:
- afi: ipv4
safi: unicast
advertisements:
matchLabels:
advertise: "opnsense-policy"
---
apiVersion: cilium.io/v2
kind: CiliumBGPClusterConfig
metadata:
name: bgp-to-opnsense
spec:
nodeSelector:
matchLabels: {}
bgpInstances:
- name: "cilium"
localASN: 64513
peers:
- name: "opnsense-router"
peerASN: 64512
peerAddress: "10.77.102.91"
peerConfigRef:
name: "opnsense-peer-settings"
---
apiVersion: cilium.io/v2
kind: CiliumBGPAdvertisement
metadata:
name: advertise-selected-services
labels:
advertise: "opnsense-policy"
spec:
advertisements:
- advertisementType: "Service"
service:
addresses:
- LoadBalancerIP
selector:
matchExpressions:
- key: io.cilium/bgp-announce
operator: Exists
- advertisementType: "Service"
service:
addresses:
- LoadBalancerIP
selector:
matchExpressions:
- key: gateway.networking.k8s.io/gateway-name
operator: Exists

51
vendor/infrastructure/cilium/config/policies/global.yaml vendored Normal file
View file

@ -0,0 +1,51 @@
# CiliumClusterwideNetworkPolicies — endpointSelector-based only.
# These are safe to apply at any time independently of host-firewall.yaml.
#
# nodeSelector-based host firewall policies (etcd, BGP, SSH, etc.) live
# exclusively in host-firewall.yaml and must be applied as a unit.
---
# Allow all pods to reach the kube-apiserver regardless of which entity identity
# the node IP resolves to (kube-apiserver vs host in K3s embedded mode).
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: allow-kube-apiserver-egress
spec:
endpointSelector: {}
egress:
- toEntities:
- kube-apiserver
- host
toPorts:
- ports:
- port: "6443"
protocol: TCP
# API hostname resolves to the OPNsense/HAProxy VIP. Cilium classifies
# that address as reserved:world/cidr, not kube-apiserver.
- toCIDR:
- 10.72.123.235/32
toPorts:
- ports:
- port: "6443"
protocol: TCP
---
# Cilium health checks: covers both node-level probes and the reserved:health
# endpoints that each Cilium agent creates (pod-CIDR IPs, identity=health).
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: allow-cilium-health
spec:
endpointSelector:
matchLabels:
reserved:health: ""
ingress:
- fromEntities:
- remote-node
- host
egress:
- toEntities:
- remote-node
- host

74
vendor/infrastructure/cilium/helm-release.yaml vendored Normal file
View file

@ -0,0 +1,74 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: cilium
namespace: kube-system
spec:
interval: 15m
releaseName: cilium
targetNamespace: kube-system
chart:
spec:
chart: cilium
version: 1.20.4
sourceRef:
kind: HelmRepository
name: cilium
namespace: flux-system
upgrade:
remediation:
retries: 3
values:
updateStrategy:
rollingUpdate:
maxUnavailable: 1
envoy:
updateStrategy:
rollingUpdate:
maxUnavailable: 1
upgradeCompatibility: "1.19"
ipam:
operator:
clusterPoolIPv4PodCIDRList: 172.19.28.14/12
cluster:
name: "********"
bpf:
masquerade: true
resources:
limits:
memory: 4Gi
requests:
cpu: 100m
memory: 512Mi
bgpControlPlane:
enabled: true
kubeProxyReplacement: true
policyEnforcementMode: always
gatewayAPI:
enabled: true
enableAlpn: true
enableAppProtocol: true
encryption:
enabled: true
type: wireguard
hostFirewall:
enabled: true
hubble:
export:
static:
enabled: true
filePath: stdout
allowList:
- '{"verdict":["DROPPED","AUDIT"]}'
relay:
enabled: true
replicas: 2
ui:
enabled: true
replicas: 2
k8sServiceHost: k3s.********.internal
k8sServicePort: 6443
operator:
replicas: 2
routingMode: tunnel
tunnelProtocol: vxlan

357
vendor/infrastructure/cilium/host-firewall/host-firewall.yaml vendored Normal file
View file

@ -0,0 +1,357 @@
# CiliumClusterwideNetworkPolicies for the host network stack (nodeSelector-based).
# CCNPs are additive — node-specific policies extend host-base, not replace it.
# Entity/endpoint selectors are preferred over CIDRs. CIDRs only match reserved:world
# identity — use them only for genuinely external IPs (SSH, BGP, DNS gateway).
---
# Base policy: every node.
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: host-base
annotations:
kustomize.toolkit.fluxcd.io/prune: disabled
spec:
nodeSelector: {}
ingress:
- fromEntities:
- host
- remote-node
- kube-apiserver
toPorts:
- ports:
- port: "4240"
protocol: TCP
- port: "4244"
protocol: TCP
- fromEntities:
- host
- remote-node
- kube-apiserver
icmps:
- fields:
- type: 8
family: IPv4
# Pods with Cilium identities (e.g. hubble-relay) need fromEndpoints;
# fromCIDR with pod CIDR compiles to reserved:world and doesn't match.
- fromEndpoints:
- {}
toPorts:
- ports:
- port: "4244"
protocol: TCP
- fromEntities:
- host
- remote-node
toPorts:
- ports:
- port: "51871"
protocol: UDP
- port: "8472"
protocol: UDP
- fromCIDR:
- 10.63.81.107/24
- 10.162.8.60/24
toPorts:
- ports:
- port: "22"
protocol: TCP
- fromCIDR:
- 10.77.102.91/32
- 10.212.111.120/32
toPorts:
- ports:
- port: "179"
protocol: TCP
- fromEntities:
- kube-apiserver
- remote-node
toPorts:
- ports:
- port: "10250"
protocol: TCP
# metrics-server pod scrapes kubelet on 10250.
- fromEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s:k8s-app: metrics-server
toPorts:
- ports:
- port: "10250"
protocol: TCP
egress:
- toEntities:
- host
- remote-node
- kube-apiserver
toPorts:
- ports:
- port: "4240"
protocol: TCP
- port: "4244"
protocol: TCP
- port: "51871"
protocol: UDP
- port: "8472"
protocol: UDP
- toEntities:
- host
- remote-node
- kube-apiserver
icmps:
- fields:
- type: 8
family: IPv4
- fields:
- type: 11
family: IPv4
- toCIDR:
- 10.212.111.120/32
toPorts:
- ports:
- port: "53"
protocol: UDP
- port: "53"
protocol: TCP
- toEntities:
- world
toPorts:
- ports:
- port: "67"
protocol: UDP
- port: "123"
protocol: UDP
# HTTPS: host package repositories and registries use CDN-backed endpoints
# with changing IPs, so keep this entity-based instead of CIDR-based.
- toEntities:
- world
toPorts:
- ports:
- port: "443"
protocol: TCP
- toCIDR:
- 10.77.102.91/32
- 10.212.111.120/32
toPorts:
- ports:
- port: "179"
protocol: TCP
- toEntities:
- kube-apiserver
toPorts:
- ports:
- port: "6443"
protocol: TCP
# API hostname resolves to the OPNsense/HAProxy VIP. Cilium classifies
# that address as reserved:world/cidr, not kube-apiserver.
- toCIDR:
- 10.72.123.235/32
toPorts:
- ports:
- port: "6443"
protocol: TCP
# Cilium health checks
- toEntities:
- health
toPorts:
- ports:
- port: "4240"
protocol: TCP
- port: "4244"
protocol: TCP
- toEntities:
- health
icmps:
- fields:
- type: 8
family: IPv4
---
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: host-kubelet
annotations:
kustomize.toolkit.fluxcd.io/prune: disabled
spec:
nodeSelector: {}
ingress:
- fromEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: victoriametrics
app.kubernetes.io/name: vmagent
app.kubernetes.io/instance: main
toPorts:
- ports:
- port: "10250"
protocol: TCP
---
# Control-plane nodes: apiserver ingress + etcd client/peer traffic.
# All other rules inherited from host-base.
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: host-control-plane
annotations:
kustomize.toolkit.fluxcd.io/prune: disabled
spec:
nodeSelector:
matchLabels:
node-role.kubernetes.io/control-plane: "true"
ingress:
# All nodes, pods, and external clients (kubectl) need apiserver access.
- fromEntities:
- remote-node
- host
- kube-apiserver
- world
toPorts:
- ports:
- port: "6443"
protocol: TCP
- fromEndpoints:
- {}
toPorts:
- ports:
- port: "6443"
protocol: TCP
- fromEntities:
- host
- remote-node
- kube-apiserver
toPorts:
- ports:
- port: "2379"
protocol: TCP
- port: "2380"
protocol: TCP
- fromCIDR:
- 10.115.187.218/24
toPorts:
- ports:
- port: "2379"
protocol: TCP
- port: "2380"
protocol: TCP
egress:
- toEntities:
- host
- remote-node
toPorts:
- ports:
- port: "2379"
protocol: TCP
- port: "2380"
protocol: TCP
- toCIDR:
- 10.115.187.218/24
toPorts:
- ports:
- port: "2379"
protocol: TCP
- port: "2380"
protocol: TCP
- toCIDR:
- 10.212.111.120/32
toPorts:
- ports:
- port: "8443"
protocol: TCP
---
# Gateway API: LoadBalancer VIP traffic is processed via the host network path
# by Cilium's kube-proxy replacement, so host endpoint policy governs it
# even though the Envoy proxy runs as a regular pod.
# Allow LAN/WireGuard and public WAN traffic to ports 80 and 443 on all nodes.
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: host-gateway
annotations:
kustomize.toolkit.fluxcd.io/prune: disabled
spec:
nodeSelector: {}
ingress:
- fromCIDR:
- 10.115.187.218/24
- 10.63.81.107/24
- 10.162.8.60/24
toPorts:
- ports:
- port: "80"
protocol: TCP
- port: "443"
protocol: TCP
- fromEntities:
- world
toPorts:
- ports:
- port: "80"
protocol: TCP
- port: "443"
protocol: TCP
---
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: host-oci-l4-relay
annotations:
kustomize.toolkit.fluxcd.io/prune: disabled
spec:
nodeSelector: {}
ingress:
- fromEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: victoriametrics
app.kubernetes.io/name: vmagent
app.kubernetes.io/instance: main
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
app.kubernetes.io/name: oci-l4-relay-wan-controller
toPorts:
- ports:
- port: "19100"
protocol: TCP
- fromEntities:
- world
toPorts:
- ports:
- port: "25"
protocol: TCP
- port: "465"
protocol: TCP
- port: "993"
protocol: TCP
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- port: "53"
protocol: UDP
- port: "53"
protocol: TCP
- toServices:
- k8sService:
namespace: stalwart
serviceName: stalwart-relay
toPorts:
- ports:
- port: "25"
protocol: TCP
- port: "465"
protocol: TCP
- port: "993"
protocol: TCP
- toCIDR:
- 64.110.109.70/32
toPorts:
- ports:
- port: "51820"
protocol: UDP
- toCIDR:
- 10.40.68.115/32
toPorts:
- ports:
- port: "19100"
protocol: TCP

4
vendor/infrastructure/cilium/host-firewall/kustomization.yaml vendored Normal file
View file

@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- host-firewall.yaml

4
vendor/infrastructure/cilium/kustomization.yaml vendored Normal file
View file

@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- helm-release.yaml