ce7cb702218693d08ea6d83464d2457c9250027c
This commit is contained in:
commit
34c5f8963c
7 changed files with 145336 additions and 0 deletions
94
vendor/platform/layshaft/crd.yaml
vendored
Normal file
94
vendor/platform/layshaft/crd.yaml
vendored
Normal file
|
|
@ -0,0 +1,94 @@
|
|||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: unlocknodes.layshaft.quorate.dev
|
||||
spec:
|
||||
group: layshaft.quorate.dev
|
||||
scope: Namespaced
|
||||
names:
|
||||
plural: unlocknodes
|
||||
singular: unlocknode
|
||||
kind: UnlockNode
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
type: object
|
||||
required: [spec]
|
||||
properties:
|
||||
spec:
|
||||
type: object
|
||||
required: [address, unlocker, rotator, periodSeconds, clientPeriodSeconds]
|
||||
properties:
|
||||
address: {type: string, format: uri}
|
||||
unlocker: {type: string, minLength: 1}
|
||||
rotator: {type: string, minLength: 1}
|
||||
keyPath: {type: string, minLength: 1}
|
||||
periodSeconds: {type: integer, minimum: 1}
|
||||
clientPeriodSeconds: {type: integer, minimum: 1}
|
||||
status:
|
||||
type: object
|
||||
properties:
|
||||
unlock:
|
||||
type: object
|
||||
required: [current, due]
|
||||
properties:
|
||||
current: {type: integer, format: int64}
|
||||
target: {type: integer, format: int64, nullable: true}
|
||||
retiring: {type: integer, format: int64, nullable: true}
|
||||
due: {type: string, format: date-time}
|
||||
unlocker: &client
|
||||
type: object
|
||||
required: [current, due]
|
||||
properties:
|
||||
current: {type: string, minLength: 1}
|
||||
target: {type: string, nullable: true, minLength: 1}
|
||||
due: {type: string, format: date-time}
|
||||
rotator: *client
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: controllerstates.layshaft.quorate.dev
|
||||
spec:
|
||||
group: layshaft.quorate.dev
|
||||
scope: Namespaced
|
||||
names:
|
||||
plural: controllerstates
|
||||
singular: controllerstate
|
||||
kind: ControllerState
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
type: object
|
||||
properties:
|
||||
spec: {type: object}
|
||||
status:
|
||||
type: object
|
||||
required: [current, known, retiring, peers, due]
|
||||
properties:
|
||||
current: {type: string, minLength: 1}
|
||||
known:
|
||||
type: array
|
||||
items: {type: string, minLength: 1}
|
||||
retiring:
|
||||
type: array
|
||||
items: {type: string, minLength: 1}
|
||||
due: {type: string, format: date-time}
|
||||
peers:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: object
|
||||
required: [current]
|
||||
properties:
|
||||
current: {type: string, minLength: 1}
|
||||
target: {type: string, nullable: true, minLength: 1}
|
||||
31
vendor/platform/layshaft/kustomization.yaml
vendored
Normal file
31
vendor/platform/layshaft/kustomization.yaml
vendored
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- crd.yaml
|
||||
- rbac.yaml
|
||||
- secrets.yaml
|
||||
- server.yaml
|
||||
- network-policy.yaml
|
||||
labels:
|
||||
- pairs:
|
||||
app.kubernetes.io/name: layshaft
|
||||
app.kubernetes.io/instance: layshaft
|
||||
configMapGenerator:
|
||||
- name: settings
|
||||
namespace: layshaft
|
||||
literals:
|
||||
- KUBE_URL=https://kubernetes.default.svc.cluster.local:443
|
||||
- KUBE_CA=/ca/kube/ca.crt
|
||||
- KUBE_JWT_FILE=/auth/kube/token
|
||||
- NAMESPACE=layshaft
|
||||
- VAULT_URL=https://vault-active.vault.svc.cluster.local:8200
|
||||
- VAULT_CA=/ca/vault/ca.crt
|
||||
- VAULT_MOUNT=layshaft
|
||||
- VAULT_AUTH_MOUNT=kubernetes
|
||||
- VAULT_ROLE=layshaft
|
||||
- VAULT_JWT_FILE=/auth/vault/token
|
||||
- TLS_KEY_PATH=server
|
||||
- TLS_STATE_NAME=server
|
||||
- TLS_PERIOD_SECONDS=86400
|
||||
- LISTEN_PORT=8443
|
||||
8
vendor/platform/layshaft/namespace.yaml
vendored
Normal file
8
vendor/platform/layshaft/namespace.yaml
vendored
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: layshaft
|
||||
labels:
|
||||
pod-security.kubernetes.io/enforce: restricted
|
||||
pod-security.kubernetes.io/audit: restricted
|
||||
pod-security.kubernetes.io/warn: restricted
|
||||
129
vendor/platform/layshaft/network-policy.yaml
vendored
Normal file
129
vendor/platform/layshaft/network-policy.yaml
vendored
Normal file
|
|
@ -0,0 +1,129 @@
|
|||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: default-deny
|
||||
namespace: layshaft
|
||||
spec:
|
||||
podSelector: {}
|
||||
policyTypes: [Ingress, Egress]
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: layshaft
|
||||
namespace: layshaft
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: layshaft
|
||||
app.kubernetes.io/instance: layshaft
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- host
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "8443"
|
||||
protocol: TCP
|
||||
- fromCIDR:
|
||||
- 10.115.187.218/24
|
||||
- 10.140.110.30/24
|
||||
- 10.186.160.23/24
|
||||
- 10.63.81.107/24
|
||||
- 10.162.8.60/24
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "8443"
|
||||
protocol: TCP
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "443"
|
||||
protocol: TCP
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "53"
|
||||
protocol: UDP
|
||||
- port: "53"
|
||||
protocol: TCP
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: vault
|
||||
app.kubernetes.io/name: vault
|
||||
component: server
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "8200"
|
||||
protocol: TCP
|
||||
- toCIDR:
|
||||
- 10.115.187.218/24
|
||||
- 10.140.110.30/24
|
||||
- 10.186.160.23/24
|
||||
- 10.63.81.107/24
|
||||
- 10.162.8.60/24
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "8443"
|
||||
protocol: TCP
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: host-egress-layshaft
|
||||
spec:
|
||||
nodeSelector: {}
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: layshaft
|
||||
app.kubernetes.io/name: layshaft
|
||||
app.kubernetes.io/instance: layshaft
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "8443"
|
||||
protocol: TCP
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: host-ingress-layshaft-replies
|
||||
spec:
|
||||
nodeSelector: {}
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: layshaft
|
||||
app.kubernetes.io/name: layshaft
|
||||
app.kubernetes.io/instance: layshaft
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "32768"
|
||||
endPort: 60999
|
||||
protocol: TCP
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: layshaft
|
||||
namespace: vault
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: vault
|
||||
component: server
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: layshaft
|
||||
io.cilium.k8s.policy.serviceaccount: layshaft
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "8200"
|
||||
protocol: TCP
|
||||
44
vendor/platform/layshaft/rbac.yaml
vendored
Normal file
44
vendor/platform/layshaft/rbac.yaml
vendored
Normal file
|
|
@ -0,0 +1,44 @@
|
|||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: layshaft
|
||||
namespace: layshaft
|
||||
automountServiceAccountToken: false
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: layshaft
|
||||
namespace: layshaft
|
||||
rules:
|
||||
- apiGroups: [layshaft.quorate.dev]
|
||||
resources: [unlocknodes]
|
||||
verbs: [get, list]
|
||||
- apiGroups: [layshaft.quorate.dev]
|
||||
resources: [unlocknodes/status]
|
||||
verbs: [update]
|
||||
- apiGroups: [layshaft.quorate.dev]
|
||||
resources: [controllerstates]
|
||||
verbs: [create]
|
||||
- apiGroups: [layshaft.quorate.dev]
|
||||
resources: [controllerstates]
|
||||
resourceNames: [server]
|
||||
verbs: [get]
|
||||
- apiGroups: [layshaft.quorate.dev]
|
||||
resources: [controllerstates/status]
|
||||
resourceNames: [server]
|
||||
verbs: [update]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: layshaft
|
||||
namespace: layshaft
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: layshaft
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: layshaft
|
||||
namespace: layshaft
|
||||
74
vendor/platform/layshaft/secrets.yaml
vendored
Normal file
74
vendor/platform/layshaft/secrets.yaml
vendored
Normal file
|
|
@ -0,0 +1,74 @@
|
|||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: layshaft-vso
|
||||
namespace: layshaft
|
||||
automountServiceAccountToken: false
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultAuth
|
||||
metadata:
|
||||
name: layshaft
|
||||
namespace: layshaft
|
||||
spec:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
kubernetes:
|
||||
role: layshaft-vso
|
||||
serviceAccount: layshaft-vso
|
||||
vaultConnectionRef: vault/vault
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: quay-cluster-pull
|
||||
namespace: layshaft
|
||||
spec:
|
||||
type: kv-v2
|
||||
mount: secret
|
||||
path: quay/robots/cluster_pull
|
||||
refreshAfter: 1h
|
||||
destination:
|
||||
name: quay-cluster-pull
|
||||
create: true
|
||||
overwrite: true
|
||||
type: kubernetes.io/dockerconfigjson
|
||||
labels:
|
||||
app.kubernetes.io/name: layshaft
|
||||
app.kubernetes.io/instance: layshaft
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
excludes: [.*]
|
||||
templates:
|
||||
.dockerconfigjson:
|
||||
text: >-
|
||||
{"auths":{"registry.quorate.internal":{"auth":"{{ printf "%s:%s" (get .Secrets "username") (get .Secrets "token") | b64enc }}"}}}
|
||||
vaultAuthRef: layshaft
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: vault-ca
|
||||
namespace: layshaft
|
||||
spec:
|
||||
type: kv-v1
|
||||
mount: pki
|
||||
path: cert/ca
|
||||
refreshAfter: 1h
|
||||
destination:
|
||||
name: vault-ca
|
||||
create: true
|
||||
overwrite: true
|
||||
labels:
|
||||
app.kubernetes.io/name: layshaft
|
||||
app.kubernetes.io/instance: layshaft
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
excludes: [.*]
|
||||
templates:
|
||||
ca.crt:
|
||||
text: '{{ get .Secrets "certificate" }}'
|
||||
rolloutRestartTargets:
|
||||
- kind: Deployment
|
||||
name: layshaft
|
||||
vaultAuthRef: layshaft
|
||||
133
vendor/platform/layshaft/server.yaml
vendored
Normal file
133
vendor/platform/layshaft/server.yaml
vendored
Normal file
|
|
@ -0,0 +1,133 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: layshaft
|
||||
namespace: layshaft
|
||||
spec:
|
||||
replicas: 2
|
||||
selector:
|
||||
matchLabels: &labels
|
||||
app.kubernetes.io/name: layshaft
|
||||
app.kubernetes.io/instance: layshaft
|
||||
template:
|
||||
metadata:
|
||||
labels: *labels
|
||||
spec:
|
||||
serviceAccountName: layshaft
|
||||
automountServiceAccountToken: false
|
||||
imagePullSecrets:
|
||||
- name: quay-cluster-pull
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
fsGroup: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchLabels: *labels
|
||||
topologyKey: kubernetes.io/hostname
|
||||
dnsConfig:
|
||||
options:
|
||||
- name: ndots
|
||||
value: "1"
|
||||
initContainers:
|
||||
- name: seed
|
||||
image: &image registry.quorate.internal/quorate/layshaft@sha256:a35a0d0ef907fa1e15b586e65da9c6bc7daf923ad7507b79f6dc6a0745e23d16
|
||||
args: [seed]
|
||||
envFrom: &settings
|
||||
- configMapRef:
|
||||
name: settings
|
||||
resources: &resources
|
||||
requests: {cpu: 100m, memory: 64Mi}
|
||||
limits: {memory: 256Mi}
|
||||
securityContext: &restricted
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities: {drop: [ALL]}
|
||||
volumeMounts:
|
||||
- &kube-ca {name: kube-ca, mountPath: /ca/kube, readOnly: true}
|
||||
- &vault-ca {name: vault-ca, mountPath: /ca/vault, readOnly: true}
|
||||
- &vault-auth {name: vault-auth, mountPath: /auth/vault, readOnly: true}
|
||||
containers:
|
||||
- name: server
|
||||
image: *image
|
||||
args: [serve]
|
||||
envFrom: *settings
|
||||
resources: *resources
|
||||
securityContext: *restricted
|
||||
ports:
|
||||
- {name: tls, containerPort: 8443}
|
||||
readinessProbe:
|
||||
tcpSocket: {port: tls}
|
||||
volumeMounts:
|
||||
- *kube-ca
|
||||
- *vault-ca
|
||||
- *vault-auth
|
||||
- {name: kube-auth, mountPath: /auth/kube, readOnly: true}
|
||||
volumes:
|
||||
- name: kube-ca
|
||||
configMap:
|
||||
name: kube-root-ca.crt
|
||||
- name: vault-ca
|
||||
secret:
|
||||
secretName: vault-ca
|
||||
defaultMode: 0440
|
||||
- name: kube-auth
|
||||
projected:
|
||||
defaultMode: 0440
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: token
|
||||
expirationSeconds: 1800
|
||||
- name: vault-auth
|
||||
projected:
|
||||
defaultMode: 0440
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: token
|
||||
audience: layshaft-vault
|
||||
expirationSeconds: 1800
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: layshaft
|
||||
namespace: layshaft
|
||||
labels:
|
||||
io.cilium/bgp-announce: "true"
|
||||
annotations:
|
||||
lbipam.cilium.io/ips: "10.232.82.173"
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
externalTrafficPolicy: Local
|
||||
loadBalancerSourceRanges:
|
||||
- 10.115.187.218/24
|
||||
- 10.140.110.30/24
|
||||
- 10.186.160.23/24
|
||||
- 10.63.81.107/24
|
||||
- 10.162.8.60/24
|
||||
selector:
|
||||
app.kubernetes.io/name: layshaft
|
||||
app.kubernetes.io/instance: layshaft
|
||||
ports:
|
||||
- name: tls
|
||||
port: 443
|
||||
targetPort: tls
|
||||
protocol: TCP
|
||||
appProtocol: https
|
||||
---
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: layshaft
|
||||
namespace: layshaft
|
||||
spec:
|
||||
minAvailable: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: layshaft
|
||||
app.kubernetes.io/instance: layshaft
|
||||
Loading…
Reference in a new issue