From ed763729f05d61cbb1b9b6e3c7100b743d74ca9a Mon Sep 17 00:00:00 2001 From: "thibault.raquet" Date: Fri, 21 Feb 2025 16:03:21 +0100 Subject: [PATCH 1/7] add service meilisearch --- infrastructure/traefik/helm-release.yaml | 49 ++++++++++++++++++++++++ 1 file changed, 49 insertions(+) diff --git a/infrastructure/traefik/helm-release.yaml b/infrastructure/traefik/helm-release.yaml index b895fa1..7b8c6ba 100644 --- a/infrastructure/traefik/helm-release.yaml +++ b/infrastructure/traefik/helm-release.yaml @@ -28,6 +28,7 @@ spec: - "--accesslog=true" - "--entryPoints.web.http.redirections.entryPoint.to=websecure" - "--entrypoints.web.http.redirections.entrypoint.scheme=https" + - "--entryPoints.web.http.middlewares=ip-blacklist-bots@kubernetescrd" - "--providers.kubernetescrd.allowCrossNamespace=true" - "--entryPoints.web.proxyProtocol.trustedIPs=${TRAEFIK_LOAD_BALANCER_IP}/32,10.124.0.0/16" - "--entryPoints.websecure.proxyProtocol.trustedIPs=${TRAEFIK_LOAD_BALANCER_IP}/32,10.124.0.0/16" @@ -226,6 +227,54 @@ spec: - 151.80.95.176/28 # LDC - 217.15.92.64/28 # LDC - 10.124.0.0/16 # Kubernetes internal resources + + - apiVersion: traefik.io/v1alpha1 + kind: MiddlewareTCP + metadata: + name: ip-blacklist-bots + namespace: common-services + spec: + ipWhiteList: + sourceRange: + - 0.0.0.0/0 + ipStrategy: + excludeIPs: + - 52.230.152.0/24 + - 52.233.106.0/24 + - 20.171.206.0/24 + - 20.171.207.0/24 + - 4.227.36.0/25 + - 20.125.66.80/28 + - 172.182.193.160/28 + - 157.55.39.0/24 + - 207.46.13.0/24 + - 40.77.167.0/24 + - 13.66.139.0/24 + - 13.66.144.0/24 + - 52.167.144.0/24 + - 13.67.10.16/28 + - 13.69.66.240/28 + - 13.71.172.224/28 + - 139.217.52.0/28 + - 191.233.204.224/28 + - 20.36.108.32/28 + - 20.43.120.16/28 + - 40.79.131.208/28 + - 40.79.186.176/28 + - 52.231.148.0/28 + - 20.79.107.240/28 + - 51.105.67.0/28 + - 20.125.163.80/28 + - 40.77.188.0/22 + - 65.55.210.0/24 + - 199.30.24.0/23 + - 40.77.202.0/24 + - 40.77.139.0/25 + - 20.74.197.0/28 + - 20.15.133.160/27 + - 40.77.177.0/24 + - 40.77.178.0/23 + - apiVersion: traefik.io/v1alpha1 kind: Middleware metadata: From b9c0e4c46453a676cf52ab8c44044d8a2bd273dd Mon Sep 17 00:00:00 2001 From: "thibault.raquet" Date: Fri, 21 Feb 2025 16:04:18 +0100 Subject: [PATCH 2/7] add ip blacklist --- infrastructure/traefik/helm-release.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/infrastructure/traefik/helm-release.yaml b/infrastructure/traefik/helm-release.yaml index 7b8c6ba..7efb114 100644 --- a/infrastructure/traefik/helm-release.yaml +++ b/infrastructure/traefik/helm-release.yaml @@ -29,6 +29,7 @@ spec: - "--entryPoints.web.http.redirections.entryPoint.to=websecure" - "--entrypoints.web.http.redirections.entrypoint.scheme=https" - "--entryPoints.web.http.middlewares=ip-blacklist-bots@kubernetescrd" + - "--entryPoints.websecure.http.middlewares=ip-blacklist-bots@kubernetescrd" - "--providers.kubernetescrd.allowCrossNamespace=true" - "--entryPoints.web.proxyProtocol.trustedIPs=${TRAEFIK_LOAD_BALANCER_IP}/32,10.124.0.0/16" - "--entryPoints.websecure.proxyProtocol.trustedIPs=${TRAEFIK_LOAD_BALANCER_IP}/32,10.124.0.0/16" From 4f8e550ed578ebee34b7edb387636e08717826c0 Mon Sep 17 00:00:00 2001 From: "thibault.raquet" Date: Fri, 21 Feb 2025 16:11:39 +0100 Subject: [PATCH 3/7] add ip blacklist --- infrastructure/traefik/helm-release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/traefik/helm-release.yaml b/infrastructure/traefik/helm-release.yaml index 7efb114..0c2a769 100644 --- a/infrastructure/traefik/helm-release.yaml +++ b/infrastructure/traefik/helm-release.yaml @@ -230,7 +230,7 @@ spec: - 10.124.0.0/16 # Kubernetes internal resources - apiVersion: traefik.io/v1alpha1 - kind: MiddlewareTCP + kind: Middleware metadata: name: ip-blacklist-bots namespace: common-services From b82b77e2265382cb881a08a65bc70d15c5a430b9 Mon Sep 17 00:00:00 2001 From: "thibault.raquet" Date: Fri, 21 Feb 2025 16:15:11 +0100 Subject: [PATCH 4/7] add ip blacklist --- infrastructure/traefik/helm-release.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infrastructure/traefik/helm-release.yaml b/infrastructure/traefik/helm-release.yaml index 0c2a769..a974909 100644 --- a/infrastructure/traefik/helm-release.yaml +++ b/infrastructure/traefik/helm-release.yaml @@ -236,9 +236,9 @@ spec: namespace: common-services spec: ipWhiteList: - sourceRange: - - 0.0.0.0/0 ipStrategy: + sourceRange: + - 0.0.0.0/0 excludeIPs: - 52.230.152.0/24 - 52.233.106.0/24 From 8e87190b07f0c6240a9ec6b486c427019630c8f3 Mon Sep 17 00:00:00 2001 From: "thibault.raquet" Date: Fri, 21 Feb 2025 16:16:06 +0100 Subject: [PATCH 5/7] add ip blacklist --- infrastructure/traefik/helm-release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/traefik/helm-release.yaml b/infrastructure/traefik/helm-release.yaml index a974909..5d7575a 100644 --- a/infrastructure/traefik/helm-release.yaml +++ b/infrastructure/traefik/helm-release.yaml @@ -239,7 +239,7 @@ spec: ipStrategy: sourceRange: - 0.0.0.0/0 - excludeIPs: + excludedIPs: - 52.230.152.0/24 - 52.233.106.0/24 - 20.171.206.0/24 From b8bf7a5aa7fcaf4ff782cb09542f590cb9c3a02f Mon Sep 17 00:00:00 2001 From: "thibault.raquet" Date: Fri, 21 Feb 2025 16:19:45 +0100 Subject: [PATCH 6/7] add ip blacklist --- infrastructure/traefik/helm-release.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/infrastructure/traefik/helm-release.yaml b/infrastructure/traefik/helm-release.yaml index 5d7575a..55097ae 100644 --- a/infrastructure/traefik/helm-release.yaml +++ b/infrastructure/traefik/helm-release.yaml @@ -235,10 +235,10 @@ spec: name: ip-blacklist-bots namespace: common-services spec: - ipWhiteList: + ipAllowList: + sourceRange: + - 0.0.0.0/0 ipStrategy: - sourceRange: - - 0.0.0.0/0 excludedIPs: - 52.230.152.0/24 - 52.233.106.0/24 From 443687309cc68aacf0db19008303a751b1b10ce2 Mon Sep 17 00:00:00 2001 From: "thibault.raquet" Date: Fri, 21 Feb 2025 16:20:24 +0100 Subject: [PATCH 7/7] add ip blacklist --- infrastructure/traefik/helm-release.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infrastructure/traefik/helm-release.yaml b/infrastructure/traefik/helm-release.yaml index 55097ae..0bb6add 100644 --- a/infrastructure/traefik/helm-release.yaml +++ b/infrastructure/traefik/helm-release.yaml @@ -217,7 +217,7 @@ spec: name: ipwhitelist-acces-mariadb namespace: common-services spec: - ipWhiteList: + ipAllowList: sourceRange: - 46.18.126.208/28 # LDC - 62.193.56.48/32 # OPENevents - Bureau Neuville @@ -282,7 +282,7 @@ spec: name: admin-ldc-whitelist namespace: common-services spec: - ipWhiteList: + ipAllowList: sourceRange: - 46.18.126.208/28 # LDC - 62.193.56.48/32 # OPENevents - Bureau Neuville