ce7cb702218693d08ea6d83464d2457c9250027c

vendor/workloads/mta-sts/configmap.yaml

@@ -0,0 +1,41 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: mta-sts
+  namespace: mta-sts
+data:
+  nginx.conf: |
+    pid /tmp/nginx.pid;
+    error_log /dev/stderr notice;
+
+    events {}
+
+    http {
+      access_log /dev/stdout;
+      error_log /dev/stderr notice;
+      client_body_temp_path /tmp/client_body;
+      proxy_temp_path /tmp/proxy;
+      fastcgi_temp_path /tmp/fastcgi;
+      uwsgi_temp_path /tmp/uwsgi;
+      scgi_temp_path /tmp/scgi;
+
+      server {
+        listen 8080;
+        server_name _;
+
+        location = /healthz {
+          default_type text/plain;
+          return 200 "ok\n";
+        }
+
+        location = /.well-known/mta-sts.txt {
+          default_type text/plain;
+          add_header Cache-Control "no-store" always;
+          return 200 "version: STSv1\nmode: testing\nmx: mail.quorate.dev\nmax_age: 86400\n";
+        }
+
+        location / {
+          return 404;
+        }
+      }
+    }

vendor/workloads/mta-sts/deployment.yaml

@@ -0,0 +1,95 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mta-sts
+  namespace: mta-sts
+  labels:
+    app.kubernetes.io/name: mta-sts
+    app.kubernetes.io/instance: mta-sts
+    app.kubernetes.io/component: static-policy
+spec:
+  replicas: 2
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 0
+      maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: mta-sts
+      app.kubernetes.io/instance: mta-sts
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: mta-sts
+        app.kubernetes.io/instance: mta-sts
+        app.kubernetes.io/component: static-policy
+    spec:
+      runtimeClassName: gvisor
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  app.kubernetes.io/name: mta-sts
+                  app.kubernetes.io/instance: mta-sts
+              topologyKey: kubernetes.io/hostname
+      containers:
+        - name: nginx
+          image: cgr.dev/chainguard/nginx@sha256:0b4de0f60ae2295fdc852564d178b5473109baf9fc826fa5eb38a59f930e218e
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          resources:
+            requests:
+              cpu: 25m
+              memory: 32Mi
+            limits:
+              memory: 64Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 1
+            periodSeconds: 5
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 15
+          volumeMounts:
+            - name: nginx-conf
+              mountPath: /etc/nginx/nginx.conf
+              subPath: nginx.conf
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+            - name: nginx-logs
+              mountPath: /var/lib/nginx/logs
+      volumes:
+        - name: nginx-conf
+          configMap:
+            name: mta-sts
+            items:
+              - key: nginx.conf
+                path: nginx.conf
+        - name: tmp
+          emptyDir: {}
+        - name: nginx-logs
+          emptyDir: {}

vendor/workloads/mta-sts/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - configmap.yaml
+  - deployment.yaml
+  - service.yaml
+  - poddisruptionbudget.yaml
+  - network-policies.yaml

vendor/workloads/mta-sts/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: mta-sts
+  labels:
+    security.quorate.internal/public-runtime: gvisor

vendor/workloads/mta-sts/network-policies.yaml

@@ -0,0 +1,61 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: mta-sts
+  namespace: mta-sts
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: mta-sts
+      app.kubernetes.io/instance: mta-sts
+  ingress:
+    - fromEntities:
+        - host
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: cloudflare-tunnel
+            app.kubernetes.io/name: cloudflared
+            app.kubernetes.io/instance: cloudflare-tunnel
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: host-egress-mta-sts-probes
+spec:
+  nodeSelector: {}
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: mta-sts
+            app.kubernetes.io/name: mta-sts
+            app.kubernetes.io/instance: mta-sts
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: host-ingress-mta-sts-probe-replies
+spec:
+  nodeSelector: {}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: mta-sts
+            app.kubernetes.io/name: mta-sts
+            app.kubernetes.io/instance: mta-sts
+      toPorts:
+        - ports:
+            - port: "32768"
+              endPort: 60999
+              protocol: TCP

vendor/workloads/mta-sts/poddisruptionbudget.yaml

@@ -0,0 +1,11 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: mta-sts
+  namespace: mta-sts
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: mta-sts
+      app.kubernetes.io/instance: mta-sts

vendor/workloads/mta-sts/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: mta-sts
+  namespace: mta-sts
+  labels:
+    app.kubernetes.io/name: mta-sts
+    app.kubernetes.io/instance: mta-sts
+spec:
+  selector:
+    app.kubernetes.io/name: mta-sts
+    app.kubernetes.io/instance: mta-sts
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+      protocol: TCP