Bot Auto Commit

ops: 🧱 Added more wordpress collections to crowdsec

See merge request ldc-web/cluster-k8s!135

infrastructure/cert-manager/resources/certificates.yaml

@@ -6,7 +6,7 @@ metadata:
   namespace: review
 spec:
   dnsNames:
-    - '*.${REVIEW_DOMAIN_NAME}'
+    - '*.dev.re7-s-web.fr'
   secretName: wildcard-k8s-ldc
   revisionHistoryLimit: 1
   issuerRef:
@@ -21,7 +21,7 @@ metadata:
   namespace: staging
 spec:
   dnsNames:
-    - '*.${STAGING_DOMAIN_NAME}'
+    - '*.dev.re7-s-web.fr'
   secretName: wildcard-k8s-ldc
   revisionHistoryLimit: 1
   issuerRef:
@@ -36,7 +36,7 @@ metadata:
   namespace: production
 spec:
   dnsNames:
-    - '*.${PRODUCTION_DOMAIN_NAME}'
+    - '*.dev.re7-s-web.fr'
   secretName: wildcard-k8s-ldc
   revisionHistoryLimit: 1
   issuerRef:

infrastructure/crowdsec/helm-release.yaml

@@ -56,7 +56,7 @@ spec:
           server:
             auto_registration: # Activate if not using TLS for authentication
               enabled: true
-              token: "${CROWDSEC_REGISTRATION_TOKEN}" # /!\ Do not modify this variable (Cluster K8S gitlab var)
+              token: "3CYN2IAiCY6mGYw0JhTxdj98z7T82GV0oasvTQ3Zd2bMvCaQ" # /!\ Do not modify this variable (Cluster K8S gitlab var)
               allowed_ranges: # /!\ Make sure to adapt to the pod IP ranges used by your cluster
                 - "127.0.0.1/32"
                 - "192.168.0.0/16"
@@ -64,11 +64,11 @@ spec:
                 - "172.16.0.0/12"
         db_config:
           type: mysql
-          user: ${CROWDSEC_DB_USER}
-          password: ${CROWDSEC_DB_PWD}
-          db_name: ${CROWDSEC_DB_NAME}
-          host: ${DB_HOST}
-          port: ${DB_PORT}
+          user: cluster-dev-crowdsec
+          password: mWXWTu4VK9e4FlIQqy3d
+          db_name: cluster-dev-crowdsec
+          host: mysql-e884938b-o403ac517.database.cloud.ovh.net
+          port: 20184
           flush:
             bouncers_autodelete:
               api_key: 1h
@@ -89,4 +89,11 @@ spec:
             type: appsec
       env:
         - name: COLLECTIONS
-          value: "crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-crs crowdsecurity/appsec-generic-rules"
+          value: >-
+            crowdsecurity/appsec-virtual-patching
+            crowdsecurity/appsec-crs
+            crowdsecurity/appsec-generic-rules
+            crowdsecurity/wordpress
+            crowdsecurity/appsec-crs-exclusion-plugin-wordpress
+            crowdsecurity/appsec-wordpress
+

infrastructure/flux-resources/alerts.yaml

@@ -19,9 +19,9 @@ metadata:
 spec:
   summary: "LDC-WEB K8S NOTIFICATION"
   eventMetadata:
-    env: ${CI_ENVIRONMENT_NAME}
-    cluster: ${KUBERNETES_SERVER_API}
-    region: ${KUBERNETES_REGION}
+    env: staging
+    cluster: https://rwb1sv.c1.sbg5.k8s.ovh.net
+    region: OVH-SBG5
   providerRef:
     name: msteams
   eventSeverity: info

infrastructure/netdata/helm-release.yaml

@@ -47,11 +47,11 @@ spec:
 
       resources:
         requests:
-          cpu: "${NETDATA_PARENT_REQUESTS_CPU}"
-          memory: "${NETDATA_PARENT_REQUESTS_RAM}"
+          cpu: "100m"
+          memory: "200Mi"
         limits:
-          cpu: "${NETDATA_PARENT_LIMITS_CPU}"
-          memory: "${NETDATA_PARENT_LIMITS_RAM}"
+          cpu: "1"
+          memory: "800Mi"
 
       # PV parent recommandés (db + alarms)
       database:
@@ -79,11 +79,11 @@ spec:
 
       resources:
         requests:
-          cpu: "${NETDATA_CHILD_REQUESTS_CPU}"
-          memory: "${NETDATA_CHILD_REQUESTS_RAM}"
+          cpu: "50m"
+          memory: "128Mi"
         limits:
-          cpu: "${NETDATA_CHILD_LIMITS_CPU}"
-          memory: "${NETDATA_CHILD_LIMITS_RAM}"
+          cpu: "500m"
+          memory: "384Mi"
 
       persistence:
         enabled: true
@@ -97,8 +97,8 @@ spec:
           data: |
             [db]
               mode = ram
-              retention = "${NETDATA_CHILD_RETENTION}"
-              update every = "${NETDATA_CHILD_COLLECT_INTERVAL}"
+              retention = "900"
+              update every = "5"
             [web]
               bind to = localhost:19999
             [health]

infrastructure/traefik/helm-release.yaml

@@ -28,9 +28,9 @@ spec:
       - "--entryPoints.web.http.redirections.entryPoint.to=websecure"
       - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
       - "--providers.kubernetescrd.allowCrossNamespace=true"
-      - "--entryPoints.web.proxyProtocol.trustedIPs=${OVH_LOAD_BALANCER_EGRESS_IP}/32"
-      - "--entryPoints.websecure.proxyProtocol.trustedIPs=${OVH_LOAD_BALANCER_EGRESS_IP}/32"
-      - "--entryPoints.websecure.forwardedHeaders.trustedIPs=${OVH_LOAD_BALANCER_EGRESS_IP}/32"
+      - "--entryPoints.web.proxyProtocol.trustedIPs=162.19.0.88/32"
+      - "--entryPoints.websecure.proxyProtocol.trustedIPs=162.19.0.88/32"
+      - "--entryPoints.websecure.forwardedHeaders.trustedIPs=162.19.0.88/32"
 
     additionalArguments:
       #- "--log.level=DEBUG"
@@ -122,7 +122,7 @@ spec:
         spec:
           plugin:
             bouncer:
-              forwardedHeadersTrustedIps: "${OVH_LOAD_BALANCER_EGRESS_IP}/32"
+              forwardedHeadersTrustedIps: "162.19.0.88/32"
               enabled: true
               crowdsecMode: stream
               crowdsecLapiScheme: http
@@ -386,7 +386,7 @@ spec:
         spec:
           type: LoadBalancer
           externalTrafficPolicy: Local
-          loadBalancerIP: "${TRAEFIK_LOAD_BALANCER_IP_OCTAVIA}"
+          loadBalancerIP: "51.68.92.47"
           selector:
             app.kubernetes.io/name: traefik
             app.kubernetes.io/instance: traefik-common-services