ce7cb702218693d08ea6d83464d2457c9250027c

vendor/infrastructure/cilium/config/gateway-relay.yaml

@@ -0,0 +1,81 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: gateway-relay-tls
+  namespace: kube-system
+spec:
+  secretName: gateway-relay-tls
+  secretTemplate:
+    annotations:
+      reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: zitadel,stalwart
+      reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: zitadel
+  issuerRef:
+    name: letsencrypt
+    kind: ClusterIssuer
+  commonName: quorate.dev
+  dnsNames:
+    - quorate.dev
+    - "*.quorate.dev"
+  duration: 2160h
+  renewBefore: 360h
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+    rotationPolicy: Always
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: gateway-relay
+  namespace: kube-system
+  annotations:
+    io.cilium/lb-ipam-ips: "10.104.40.127"
+spec:
+  gatewayClassName: cilium
+  listeners:
+    - name: https
+      port: 443
+      protocol: HTTPS
+      hostname: "*.quorate.dev"
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - kind: Secret
+            name: gateway-relay-tls
+      allowedRoutes:
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels:
+              gateway.quorate.internal/allow-public: "true"
+    - name: http
+      port: 80
+      protocol: HTTP
+      hostname: "*.quorate.dev"
+      allowedRoutes:
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels:
+              gateway.quorate.internal/allow-public: "true"
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: https-redirect-relay
+  namespace: kube-system
+spec:
+  parentRefs:
+    - name: gateway-relay
+      namespace: kube-system
+      sectionName: http
+  hostnames:
+    - "*.quorate.dev"
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301

vendor/infrastructure/cilium/config/gateway.yaml

@@ -0,0 +1,89 @@
+---
+# Shared Gateways live in kube-system; label for allowedRoutes Selector.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kube-system
+  labels:
+    gateway.quorate.internal/allow-internal: "true"
+    gateway.quorate.internal/allow-public: "true"
+---
+# Wildcard TLS cert for all *.quorate.internal services on Gateway I.
+# cert-manager issues this via the vault-internal ClusterIssuer.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: gateway-internal-tls
+  namespace: kube-system
+spec:
+  secretName: gateway-internal-tls
+  issuerRef:
+    name: vault-internal
+    kind: ClusterIssuer
+  commonName: quorate.internal
+  dnsNames:
+    - quorate.internal
+    - "*.quorate.internal"
+  duration: 2160h
+  renewBefore: 360h
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+    rotationPolicy: Always
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: gateway-internal
+  namespace: kube-system
+  annotations:
+    io.cilium/lb-ipam-ips: "10.90.141.119"
+spec:
+  gatewayClassName: cilium
+  listeners:
+    - name: https
+      port: 443
+      protocol: HTTPS
+      hostname: "*.quorate.internal"
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - kind: Secret
+            name: gateway-internal-tls
+      allowedRoutes:
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels:
+              gateway.quorate.internal/allow-internal: "true"
+    - name: http
+      port: 80
+      protocol: HTTP
+      hostname: "*.quorate.internal"
+      allowedRoutes:
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels:
+              gateway.quorate.internal/allow-internal: "true"
+---
+# Redirect all HTTP *.quorate.internal traffic to HTTPS.
+# cert.quorate.internal is excluded by hostname specificity — its own route wins.
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: https-redirect
+  namespace: kube-system
+spec:
+  parentRefs:
+    - name: gateway-internal
+      namespace: kube-system
+      sectionName: http
+  hostnames:
+    - "*.quorate.internal"
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301

vendor/infrastructure/cilium/config/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - l2.yaml
+  - gateway.yaml
+  - gateway-relay.yaml
+  - policies/global.yaml

vendor/infrastructure/cilium/config/l2.yaml

@@ -0,0 +1,65 @@
+apiVersion: cilium.io/v2
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: lb-pool
+spec:
+  blocks:
+    - cidr: 10.90.141.119/16
+---
+apiVersion: cilium.io/v2
+kind: CiliumBGPPeerConfig
+metadata:
+  name: opnsense-peer-settings
+spec:
+  ebgpMultihop: 10
+  gracefulRestart:
+    enabled: true
+    restartTimeSeconds: 15
+  families:
+    - afi: ipv4
+      safi: unicast
+      advertisements:
+        matchLabels:
+          advertise: "opnsense-policy" 
+---
+apiVersion: cilium.io/v2
+kind: CiliumBGPClusterConfig
+metadata:
+  name: bgp-to-opnsense
+spec:
+  nodeSelector:
+    matchLabels: {} 
+  bgpInstances:
+    - name: "cilium"
+      localASN: 64513
+      peers:
+        - name: "opnsense-router"
+          peerASN: 64512
+          peerAddress: "10.77.102.91"
+          peerConfigRef:
+            name: "opnsense-peer-settings"
+---
+apiVersion: cilium.io/v2
+kind: CiliumBGPAdvertisement
+metadata:
+  name: advertise-selected-services
+  labels:
+    advertise: "opnsense-policy" 
+spec:
+  advertisements:
+    - advertisementType: "Service"
+      service:
+        addresses:
+          - LoadBalancerIP
+      selector:
+        matchExpressions:
+          - key: io.cilium/bgp-announce
+            operator: Exists
+    - advertisementType: "Service"
+      service:
+        addresses:
+          - LoadBalancerIP
+      selector:
+        matchExpressions:
+          - key: gateway.networking.k8s.io/gateway-name
+            operator: Exists

vendor/infrastructure/cilium/config/policies/global.yaml

@@ -0,0 +1,51 @@
+# CiliumClusterwideNetworkPolicies — endpointSelector-based only.
+# These are safe to apply at any time independently of host-firewall.yaml.
+#
+# nodeSelector-based host firewall policies (etcd, BGP, SSH, etc.) live
+# exclusively in host-firewall.yaml and must be applied as a unit.
+
+---
+# Allow all pods to reach the kube-apiserver regardless of which entity identity
+# the node IP resolves to (kube-apiserver vs host in K3s embedded mode).
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-kube-apiserver-egress
+spec:
+  endpointSelector: {}
+  egress:
+    - toEntities:
+        - kube-apiserver
+        - host
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+    # API hostname resolves to the OPNsense/HAProxy VIP. Cilium classifies
+    # that address as reserved:world/cidr, not kube-apiserver.
+    - toCIDR:
+        - 10.72.123.235/32
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+
+---
+# Cilium health checks: covers both node-level probes and the reserved:health
+# endpoints that each Cilium agent creates (pod-CIDR IPs, identity=health).
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-cilium-health
+spec:
+  endpointSelector:
+    matchLabels:
+      reserved:health: ""
+  ingress:
+    - fromEntities:
+        - remote-node
+        - host
+  egress:
+    - toEntities:
+        - remote-node
+        - host