migration

.gitlab-ci.yml

@@ -28,7 +28,7 @@ variables:
       git config user.email "autodeploy@mediactivegroup.com"
       git add --all
       git commit -m "Bot Auto Commit"
-      git push --force https://project_access_token:${GITLAB_ACCESS_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git HEAD:${DEPLOY_BRANCH}
+      git push --force https://flux-token-api:${GITLAB_ACCESS_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git HEAD:${DEPLOY_BRANCH}
   tags:
     - flux
     - k8s

.gitlab/agents/dev-k8s-ldc-web/config.yaml

@@ -8,7 +8,6 @@ ci_access:
     - id: ldc-web/projets/galina
     - id: ldc-web/projets/gen-game-web-instances/janze
     - id: ldc-web/projets/gen-game-web-instances/l-orleanais-jeu
-    - id: ldc-web/projets/gen-game-web-instances/le-gaulois-chequier-40-2025
     - id: ldc-web/projets/gen-game-web-instances/le-gaulois-tdf-2024
     - id: ldc-web/projets/gen-game-web-instances/normandie
     - id: ldc-web/projets/gen-game-web-instances/reghalal-jeu

.gitlab/agents/prod-k8s-ldc-web/config.yaml

@@ -1,66 +1,40 @@
 ci_access:
   projects:
     - id: ldc-web/projets/agis
-    - id: ldc-web/projets/auguste-lambert
-    - id: ldc-web/projets/bien-etre-animal
-    - id: ldc-web/projets/boutique-cnc-sable
-    - id: ldc-web/projets/boutique-jeusselin
-    - id: ldc-web/projets/cailles-robin
-    - id: ldc-web/projets/com-app-bo
     - id: ldc-web/projets/crm
     - id: ldc-web/projets/coupe-de-france-de-la-volaille
     - id: ldc-web/projets/domaine-de-lanvaux
     - id: ldc-web/projets/doux
-    - id: ldc-web/projets/espri-restauration
     - id: ldc-web/projets/galina
-    - id: ldc-web/projets/gen-game-web-instances/auguste-lambert
     - id: ldc-web/projets/gen-game-web-instances/janze
     - id: ldc-web/projets/gen-game-web-instances/l-orleanais-jeu
-    - id: ldc-web/projets/gen-game-web-instances/le-gaulois-eveillez-vos-papilles
     - id: ldc-web/projets/gen-game-web-instances/le-gaulois-tdf-2024
-    - id: ldc-web/projets/gen-game-web-instances/le-gaulois-chequier-40-2025
-    - id: ldc-web/projets/gen-game-web-instances/le-gaulois-op-brasserie-2025
-    - id: ldc-web/projets/gen-game-web-instances/le-gaulois-sportif-2025
-    - id: ldc-web/projets/gen-game-web-instances/le-gaulois-sportif-2026
-    - id: ldc-web/projets/gen-game-web-instances/matines-40-ans
-    - id: ldc-web/projets/gen-game-web-instances/nature-and-respect
     - id: ldc-web/projets/gen-game-web-instances/normandie
     - id: ldc-web/projets/gen-game-web-instances/reghalal-jeu
     - id: ldc-web/projets/gen-game-web-instances/tregalette-chandleur-2024
-    - id: ldc-web/projets/gen-game-web-prize-draw
     - id: ldc-web/projets/id-halal
     - id: ldc-web/projets/jeusselin
-    - id: ldc-web/projets/ker-chant
     - id: ldc-web/projets/l-hours
-    - id: ldc-web/projets/la-boutique-du-canard
     - id: ldc-web/projets/la-toque-angevine
-    - id: ldc-web/projets/ldc
     - id: ldc-web/projets/ldc-foods
+    - id: ldc-web/projets/ldc-restauration
+    - id: ldc-web/projets/ldc-web
     - id: ldc-web/projets/le-gaulois
     - id: ldc-web/projets/le-gaulois-pro
-    - id: ldc-web/projets/le-marche-de-beaufeu
     - id: ldc-web/projets/les-fermiers-snv
     - id: ldc-web/projets/lionor
     - id: ldc-web/projets/loue
-    - id: ldc-web/projets/matomo
+    - id: ldc-web/projets/loue-magie-de-noel
-    - id: ldc-web/projets/maitre-coq
-    - id: ldc-web/projets/mairet
-    - id: ldc-web/projets/maison-couthouis
-    - id: ldc-web/projets/marie
-    - id: ldc-web/projets/marie-restauration
     - id: ldc-web/projets/mas-d-auge
     - id: ldc-web/projets/matines
-    - id: ldc-web/projets/medina
-    - id: ldc-web/projets/mesbr
     - id: ldc-web/projets/nature-and-respect
     - id: ldc-web/projets/nature-eleveurs
     - id: ldc-web/projets/op-insta-instances/le-gaulois
     - id: ldc-web/projets/ovoteam
-    - id: ldc-web/projets/parc-auto
     - id: ldc-web/projets/poule-et-toque
     - id: ldc-web/projets/prims
-    - id: ldc-web/projets/qualimaine
     - id: ldc-web/projets/qrcollector/qrcollector-back
+    - id: ldc-web/projets/qrcollector/qrcollector-front
     - id: ldc-web/projets/regalette
     - id: ldc-web/projets/reghalal
     - id: ldc-web/projets/report
@@ -68,12 +42,13 @@ ci_access:
     - id: ldc-web/projets/sbv
     - id: ldc-web/projets/share-secure-content
     - id: ldc-web/projets/showroom/showroom-bo
+    - id: ldc-web/projets/showroom-bo-instances/drosed
+    - id: ldc-web/projets/showroom-bo-instances/maitre-coq
+    - id: ldc-web/projets/showroom-bo-instances/nature-and-respect
+    - id: ldc-web/projets/store-ldc
     - id: ldc-web/projets/support-web
-    - id: ldc-web/projets/traditions-asie
     - id: ldc-web/projets/tregalette
-    - id: ldc-web/projets/uwil-ui
+    - id: ldc-web/projets/vdme
-    - id: ldc-web/projets/volailles-ardeche
-    - id: ldc-web/projets/volailles-challans
     - id: ldc-web/projets/volena
 
 observability:

README.md

@@ -8,6 +8,7 @@
 | FluxCD       | no flux      | 2.3.0      | 2.3.0                | 2.13.0             |
 | Git-agent    | 16.9.3       | 16.9.3     | 17.1.0               | 2.30               |
 | Git-runner   | 16.9.1       | 16.9.1     | 17.0.1               | 0.62.1             |
+| MariaDB      | 10.10        | 1.13.2     | 1.13.2               | 18.2.4             |
 | Prometheus   | 0.60.1       | 0.74.0     | 0.74.0               | 60.2.0             |
 | Traefik      | 2.9.6        | 3.0.2      | 3.0.2                | 28.3.0             |
 | Velero       | 1.10.1       | 1.13.2     | 1.13.2               | 6.7.0              |

database_migration/README.md

@@ -0,0 +1,39 @@
+# Migration de la base de données mariadb pour un projet LDC-WEB
+
+### Prérequis
+
+1) Avoir l'accès maintainer pour le projet
+2) Avoir accès à l'ancienne, comme à la nouvelle base de données (ip publique autorisée)
+
+### Maintenance du site
+
+Avant de migrer la base de données, il est nécessaire de mettre le site en maintenance pour éviter
+d'insérer des données dans l'ancienne base pendant la migration de la nouvelle.
+
+1) Depuis Lens :
+   - Exécuter un shell dans le pod du projet
+   - `php artisan down`
+2) En CLI :
+   - `export POD_NAME=<nom_du_pod>`
+   - `export NAMESPACE=<namespace>`
+   - `kubectl --kubeconfig="~/.kube/ldc-web-prod" exec "${POD_NAME}" -n ${NAMESPACE} -- php artisan down`
+
+### Migration de la base
+
+Utiliser le script de migration `migrate.sh`
+```
+export DB_NAME=
+export PASSWORD=
+sh migrate.sh
+```
+
+Si le user est différent du nom de la base : `export USER_NAME=`
+
+### Modification du projet
+
+Dans la ressource `configMap` du fichier `manifest.yaml` :
+1) Modifier la variable `DB_HOST`, mettre `mysql-e884938b-o403ac517.database.cloud.ovh.net`
+2) Ajouter la variable `DB_PORT`, mettre `20184`
+3) Commit/Merge dans la branche souhaitée
+4) Déployer et réactiver le site (`php artisan up`)
+5) Vérifier le fonctionnement du site et la présence des données migrées

database_migration/migrate.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+
+## MOTS DE PASSE ##
+new_password='' # A SURCHARGER
+old_password='' # A SURCHARGER
+
+## BASES DE DONNEES
+new_host='mysql-e884938b-o403ac517.database.cloud.ovh.net'
+new_port=20184
+
+old_host='51.91.81.188'
+old_port=54322
+
+# Si le user est le même que le nom de base
+if [[ -n "$USER" ]]; then
+    USER=$DB_NAME
+fi
+
+# Créer la nouvelle base - user - privilèges
+query="CREATE DATABASE IF NOT EXISTS \`${DB_NAME}\`;CREATE USER IF NOT EXISTS \`${USER}\`@'%' IDENTIFIED BY '${PASSWORD}';GRANT ALL PRIVILEGES ON \`${DB_NAME}\`.* TO \`${USER}\`@'%';"
+
+mariadb -h ${new_host} -P ${new_port} -u avnadmin --password=${new_password} -e "${query}"
+
+# Dump ancienne base
+mysqldump -h ${old_host} -P ${old_port} -u root --password=${old_password} ${DB_NAME} > /tmp/${DB_NAME}.sql
+
+# Load nouvelle base
+mariadb -h ${new_host} -P ${new_port} -u avnadmin --password=${new_password} ${DB_NAME} < /tmp/${DB_NAME}.sql
+
+# Supprimer le dump
+rm /tmp/${DB_NAME}.sql

flux/kustomizations/cert-manager.yaml

@@ -22,7 +22,7 @@ spec:
       namespace: flux-system
   sourceRef:
     kind: GitRepository
-    name: flux-system
+    name: cluster-k8s
   timeout: 5m
 
 ---
@@ -40,5 +40,5 @@ spec:
       namespace: flux-system  
   sourceRef:
     kind: GitRepository
-    name: flux-system
+    name: cluster-k8s
   timeout: 5m

flux/kustomizations/crowdsec.yaml

@@ -1,32 +0,0 @@
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: crowdsec
-  namespace: flux-system
-spec:
-  interval: 1m0s
-  path: ./infrastructure/crowdsec
-  prune: false
-  healthChecks:
-    - apiVersion: source.toolkit.fluxcd.io/v1
-      kind: HelmRepository
-      name: crowdsec
-      namespace: common-services
-    - apiVersion: helm.toolkit.fluxcd.io/v2
-      kind: HelmRelease
-      name: crowdsec
-      namespace: common-services
-    - apiVersion: v1
-      kind: Pod
-      name: vault-0
-      namespace: common-services
-  dependsOn:
-    - name: namespaces
-      namespace: flux-system
-    - name: external-secrets-resources
-      namespace: flux-system
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-  timeout: 5m

flux/kustomizations/flux-resources.yaml

@@ -13,5 +13,5 @@ spec:
       namespace: flux-system
   sourceRef:
     kind: GitRepository
-    name: flux-system
+    name: cluster-k8s
     namespace: flux-system

flux/kustomizations/gitlab-agent.yaml

@@ -13,7 +13,7 @@ spec:
       namespace: flux-system
   sourceRef:
     kind: GitRepository
-    name: flux-system
+    name: cluster-k8s
   healthChecks:
     - apiVersion: source.toolkit.fluxcd.io/v1
       kind: HelmRepository

flux/kustomizations/gitlab-runner.yaml

@@ -13,7 +13,7 @@ spec:
       namespace: flux-system
   sourceRef:
     kind: GitRepository
-    name: flux-system
+    name: cluster-k8s
   healthChecks:
     - apiVersion: source.toolkit.fluxcd.io/v1
       kind: HelmRepository

flux/kustomizations/hashicorp-vault.yaml

@@ -10,7 +10,7 @@ spec:
   prune: false
   sourceRef:
     kind: GitRepository
-    name: flux-system
+    name: cluster-k8s
   dependsOn:
     - name: namespaces
       namespace: flux-system
@@ -40,7 +40,7 @@ spec:
       namespace: flux-system
   sourceRef:
     kind: GitRepository
-    name: flux-system
+    name: cluster-k8s
     namespace: flux-system
   healthChecks:
     - apiVersion: source.toolkit.fluxcd.io/v1
@@ -68,6 +68,6 @@ spec:
       namespace: flux-system
   sourceRef:
     kind: GitRepository
-    name: flux-system
+    name: cluster-k8s
     namespace: flux-system
   timeout: 10m

flux/kustomizations/kustomization.yaml

@@ -1,17 +1,15 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - cert-manager.yaml
+- cert-manager.yaml
-  - flux-resources.yaml
+- flux-resources.yaml
-  - gitlab-agent.yaml
+- gitlab-agent.yaml
-  - gitlab-runner.yaml
+- gitlab-runner.yaml
-  - hashicorp-vault.yaml
+- hashicorp-vault.yaml
-  - ldc-custom.yaml
+- ldc-custom.yaml
-  - meilisearch.yaml
+- mariadb.yaml
-  - namespaces.yaml
+- meilisearch.yaml
-  - prometheus-stack.yaml
+- namespaces.yaml
-  - rabbitmq.yaml
+- prometheus-stack.yaml
-  - traefik.yaml
+- traefik.yaml
-  - quickchart.yaml
+- quickchart.yaml
-  - netdata.yaml
-  - crowdsec.yaml

flux/kustomizations/ldc-custom.yaml

@@ -10,7 +10,7 @@ spec:
   prune: true
   sourceRef:
     kind: GitRepository
-    name: flux-system
+    name: cluster-k8s
   dependsOn:
     - name: prometheus-stack
       namespace: flux-system

flux/kustomizations/mariadb.yaml

@@ -2,31 +2,25 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: netdata
+  name: mariadb
   namespace: flux-system
 spec:
-  interval: 1m0s
+  interval: 30s
-  path: ./infrastructure/netdata
+  path: ./infrastructure/mariadb
   prune: false
+  sourceRef:
+    kind: GitRepository
+    name: cluster-k8s
+  dependsOn:
+    - name: external-secrets-resources
+      namespace: flux-system
   healthChecks:
     - apiVersion: source.toolkit.fluxcd.io/v1
       kind: HelmRepository
-      name: netdata
+      name: bitnami
       namespace: common-services
     - apiVersion: helm.toolkit.fluxcd.io/v2
       kind: HelmRelease
-      name: netdata
+      name: mariadb
       namespace: common-services
-    - apiVersion: v1
-      kind: Pod
-      name: vault-0
-      namespace: common-services
-  dependsOn:
-    - name: namespaces
-      namespace: flux-system
-    - name: external-secrets-resources
-      namespace: flux-system
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
   timeout: 5m

flux/kustomizations/meilisearch.yaml

@@ -22,5 +22,5 @@ spec:
       namespace: flux-system
   sourceRef:
     kind: GitRepository
-    name: flux-system
+    name: cluster-k8s
   timeout: 5m

flux/kustomizations/namespaces.yaml

@@ -13,7 +13,7 @@ spec:
       namespace: flux-system
   sourceRef:
     kind: GitRepository
-    name: flux-system
+    name: cluster-k8s
   healthChecks:
     - apiVersion: v1
       kind: Namespace

flux/kustomizations/prometheus-stack.yaml

@@ -10,7 +10,7 @@ spec:
   prune: false
   sourceRef:
     kind: GitRepository
-    name: flux-system
+    name: cluster-k8s
   dependsOn:
     - name: external-secrets-resources
       namespace: flux-system

flux/kustomizations/quickchart.yaml

@@ -22,5 +22,5 @@ spec:
     namespace: flux-system
   sourceRef:
     kind: GitRepository
-    name: flux-system
+    name: cluster-k8s
   timeout: 5m

flux/kustomizations/rabbitmq.yaml

@@ -1,26 +0,0 @@
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: rabbitmq
-  namespace: flux-system
-spec:
-  interval: 1m0s
-  path: ./infrastructure/rabbitmq
-  prune: false
-  healthChecks:
-  - apiVersion: source.toolkit.fluxcd.io/v1
-    kind: HelmRepository
-    name: bitnami
-    namespace: common-services
-  - apiVersion: helm.toolkit.fluxcd.io/v2
-    kind: HelmRelease
-    name: rabbitmq
-    namespace: common-services
-  dependsOn:
-  - name: namespaces
-    namespace: flux-system
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-  timeout: 5m

flux/kustomizations/traefik.yaml

@@ -22,5 +22,5 @@ spec:
       namespace: flux-system
   sourceRef:
     kind: GitRepository
-    name: flux-system
+    name: cluster-k8s
   timeout: 5m

flux/production/flux-system/gotk-sync.yaml

@@ -3,7 +3,7 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: GitRepository
 metadata:
-  name: flux-system
+  name: cluster-k8s
   namespace: flux-system
 spec:
   interval: 1m0s
@@ -24,4 +24,4 @@ spec:
   prune: true
   sourceRef:
     kind: GitRepository
-    name: flux-system
+    name: cluster-k8s

flux/production/flux.yaml

@@ -9,4 +9,4 @@ spec:
   prune: false
   sourceRef:
     kind: GitRepository
-    name: flux-system
+    name: cluster-k8s

flux/staging/flux-system/gotk-sync.yaml

@@ -3,7 +3,7 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: GitRepository
 metadata:
-  name: flux-system
+  name: cluster-k8s
   namespace: flux-system
 spec:
   interval: 1m0s
@@ -24,4 +24,4 @@ spec:
   prune: true
   sourceRef:
     kind: GitRepository
-    name: flux-system
+    name: cluster-k8s

flux/staging/flux.yaml

@@ -9,4 +9,4 @@ spec:
   prune: false
   sourceRef:
     kind: GitRepository
-    name: flux-system
+    name: cluster-k8s

infrastructure/cert-manager/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: cert-manager
-      version: 1.17.2
+      version: 1.15.0
       sourceRef:
         kind: HelmRepository
         name: cert-manager

infrastructure/cert-manager/resources/certificates.yaml

@@ -8,7 +8,6 @@ spec:
   dnsNames:
     - '*.${REVIEW_DOMAIN_NAME}'
   secretName: wildcard-k8s-ldc
-  revisionHistoryLimit: 1
   issuerRef:
     name: letsencrypt-production-dns01
     kind: ClusterIssuer
@@ -23,7 +22,6 @@ spec:
   dnsNames:
     - '*.${STAGING_DOMAIN_NAME}'
   secretName: wildcard-k8s-ldc
-  revisionHistoryLimit: 1
   issuerRef:
     name: letsencrypt-production-dns01
     kind: ClusterIssuer
@@ -38,7 +36,6 @@ spec:
   dnsNames:
     - '*.${PRODUCTION_DOMAIN_NAME}'
   secretName: wildcard-k8s-ldc
-  revisionHistoryLimit: 1
   issuerRef:
     name: letsencrypt-production-dns01
     kind: ClusterIssuer

infrastructure/crowdsec/helm-release.yaml

@@ -1,92 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: crowdsec
-  namespace: common-services
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: crowdsec
-      version: 0.24.0
-      sourceRef:
-        kind: HelmRepository
-        name: crowdsec
-        namespace: common-services
-  values:
-    container_runtime: containerd
-
-    image:
-      tag: v1.7.8
-
-    agent:
-      acquisition:
-        - namespace: common-services
-          podName: traefik-*
-          program: traefik
-      env:
-        - name: COLLECTIONS
-          value: "crowdsecurity/traefik"
-
-    secrets:
-      externalSecret:
-        name: crowdsec-lapi-secret
-        csLapiSecretKey: "CS_LAPI_SECRET"
-        registrationTokenKey: "REGISTRATION_TOKEN"
-
-    lapi:
-      replicas: 2
-      storeCAPICredentialsInSecret: true
-      storeLAPICscliCredentialsInSecret: true
-      persistentVolume:
-        data:
-          enabled: false
-        config:
-          enabled: false
-      envFrom:
-        - secretRef:
-            name: crowdsec-lapi-secret
-
-    config:
-      config.yaml.local: |
-        api:
-          client:
-            # the log processor will remove delete itself from LAPI when stopping.    
-            unregister_on_exit: true
-          server:
-            auto_registration: # Activate if not using TLS for authentication
-              enabled: true
-              token: "${CROWDSEC_REGISTRATION_TOKEN}" # /!\ Do not modify this variable (Cluster K8S gitlab var)
-              allowed_ranges: # /!\ Make sure to adapt to the pod IP ranges used by your cluster
-                - "127.0.0.1/32"
-                - "192.168.0.0/16"
-                - "10.0.0.0/8"
-                - "172.16.0.0/12"
-        db_config:
-          type: mysql
-          user: ${CROWDSEC_DB_USER}
-          password: ${CROWDSEC_DB_PWD}
-          db_name: ${CROWDSEC_DB_NAME}
-          host: ${DB_HOST}
-          port: ${DB_PORT}
-          flush:
-            bouncers_autodelete:
-              api_key: 1h
-            agents_autodelete:
-              login_password: 6h
-              cert: 6h
-
-    appsec:
-      enabled: true
-      acquisitions:
-        - source: appsec
-          listen_addr: "0.0.0.0:7422"
-          path: /
-          appsec_configs:
-            - crowdsecurity/appsec-default
-            - crowdsecurity/crs
-          labels:
-            type: appsec
-      env:
-        - name: COLLECTIONS
-          value: "crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-crs crowdsecurity/appsec-generic-rules"

infrastructure/crowdsec/helm-repository.yaml

@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: crowdsec
-  namespace: common-services
-spec:
-  interval: 1h0m0s
-  url: https://crowdsecurity.github.io/helm-charts

infrastructure/gitlab-agent/helm-release.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: gitlab-agent
-      version: 2.29.0
+      version: 1.24.0
       sourceRef:
         kind: HelmRepository
         name: gitlab-agent
@@ -17,7 +17,7 @@ spec:
   values:
 
     image:
-      tag: v19.2.0
+      tag: v16.9.2
 
     config:
       kasAddress: "wss://lab.s-web.fr/-/kubernetes-agent/"

infrastructure/gitlab-runner/helm-release.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: gitlab-runner
-      version: 0.91.2
+      version: 0.62.1
       sourceRef:
         kind: HelmRepository
         name: gitlab-runner
@@ -17,7 +17,7 @@ spec:
   values:
 
     image:
-      tag: alpine-v19.2.2
+      tag: alpine-v16.9.1
 
     gitlabUrl: https://lab.s-web.fr
 

infrastructure/hashicorp-vault/auto-unseal.yaml

@@ -5,30 +5,27 @@ metadata:
   namespace: common-services
 spec:
   schedule: "* * * * *"
-  suspend: false                  # géré explicitement par Git (corrige le drift de suspension manuelle)
   concurrencyPolicy: Forbid
-  startingDeadlineSeconds: 60
   successfulJobsHistoryLimit: 1
-  failedJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 2
   jobTemplate:
     spec:
       backoffLimit: 2
-      activeDeadlineSeconds: 120
       template:
         spec:
-          securityContext:
-            runAsNonRoot: true
-            runAsUser: 10001
-            seccompProfile:
-              type: RuntimeDefault
           containers:
             - name: vault-auto-unseal
-              image: registry.s-web.fr/ldc-web/k8s-vault-unseal:1.1.0
+              image: registry.s-web.fr/ldc-web/k8s-vault-unseal:1.0.0
               imagePullPolicy: IfNotPresent
-              command: ["python", "main.py", "-u", "http://vault.common-services:8200"]
+              command: ["python", "main.py", "-u", "http://vault.common-services:8200", "-t", "${DOLLAR}(VAULT_TOKEN)",
+                        "-k", "${DOLLAR}(UNSEAL_KEY_1)", "-k", "${DOLLAR}(UNSEAL_KEY_2)", "-k", "${DOLLAR}(UNSEAL_KEY_3)",
+                        "-k", "${DOLLAR}(UNSEAL_KEY_4)", "-k", "${DOLLAR}(UNSEAL_KEY_5)"]
               env:
-                - name: PYTHONDONTWRITEBYTECODE
+                - name: VAULT_TOKEN
-                  value: "1"
+                  valueFrom:
+                    secretKeyRef:
+                      name: vault-credentials
+                      key: token
                 - name: UNSEAL_KEY_1
                   valueFrom:
                     secretKeyRef:
@@ -54,19 +51,6 @@ spec:
                     secretKeyRef:
                       name: vault-credentials
                       key: unseal_key_5
-              resources:
-                requests:
-                  cpu: 10m
-                  memory: 32Mi
-                limits:
-                  cpu: 100m
-                  memory: 64Mi
-              securityContext:
-                allowPrivilegeEscalation: false
-                readOnlyRootFilesystem: true
-                capabilities:
-                  drop:
-                    - ALL
           imagePullSecrets:
             - name: docker-registry-credentials
           restartPolicy: OnFailure

infrastructure/hashicorp-vault/external-secrets/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: external-secrets
-      version: 0.16.1
+      version: 0.9.19
       sourceRef:
         kind: HelmRepository
         name: external-secrets
@@ -16,4 +16,4 @@ spec:
   values:
 
     image:
-      tag: v0.16.1
+      tag: v0.9.19

infrastructure/hashicorp-vault/external-secrets/resources/crowdsec.yaml

@@ -1,38 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: crowdsec-lapi-secret
-  namespace: common-services
-spec:
-  refreshInterval: 15s
-  secretStoreRef:
-    name: vault-secret-store
-    kind: ClusterSecretStore
-  target:
-    name: crowdsec-lapi-secret
-    creationPolicy: Owner
-  data:
-    - secretKey: CS_LAPI_SECRET
-      remoteRef:
-        key: secret/data/crowdsec/lapi
-        property: CS_LAPI_SECRET
-    - secretKey: REGISTRATION_TOKEN
-      remoteRef:
-        key: secret/data/crowdsec/lapi
-        property: REGISTRATION_TOKEN
-    - secretKey: ENROLL_KEY
-      remoteRef:
-        key: secret/data/crowdsec/lapi
-        property: ENROLL_KEY
-    - secretKey: ENROLL_INSTANCE_NAME
-      remoteRef:
-        key: secret/data/crowdsec/lapi
-        property: ENROLL_INSTANCE_NAME
-    - secretKey: ENROLL_TAGS
-      remoteRef:
-        key: secret/data/crowdsec/lapi
-        property: ENROLL_TAGS
-    - secretKey: BOUNCER_KEY_traefik
-      remoteRef:
-        key: secret/data/crowdsec/lapi
-        property: BOUNCER_KEY_traefik

infrastructure/hashicorp-vault/external-secrets/resources/kustomization.yaml

@@ -7,10 +7,8 @@ resources:
   - gitlab-agent.yaml
   - gitlab-runner.yaml
   - hashicorp-vault.yaml
+  - mariadb.yaml
   - prometheus-stack.yaml
   - review.yaml
   - staging.yaml
   - production.yaml
-  - rabbitmq.yaml
-  - netdata.yaml
-  - crowdsec.yaml

infrastructure/hashicorp-vault/external-secrets/resources/mariadb.yaml

@@ -0,0 +1,28 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: mariadb-credentials
+  namespace: common-services
+spec:
+  refreshInterval: "15s"
+  secretStoreRef:
+    name: vault-secret-store
+    kind: ClusterSecretStore
+  target:
+    name: mariadb-credentials
+    template:
+      engineVersion: v2
+      type: Opaque
+      data:
+        mariadb-password: "{{ .password }}"
+        mariadb-replication-password: "{{ .root_password }}"
+        mariadb-root-password: "{{ .root_password }}"
+  data:
+    - secretKey: root_password
+      remoteRef:
+        key: secret/mariadb
+        property: root_password
+    - secretKey: password
+      remoteRef:
+        key: secret/mariadb
+        property: password

infrastructure/hashicorp-vault/external-secrets/resources/netdata.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: netdata-claim
-  namespace: common-services
-spec:
-  refreshInterval: "15s"
-  secretStoreRef:
-    name: vault-secret-store
-    kind: ClusterSecretStore
-  target:
-    name: netdata-claim
-  data:
-    - secretKey: NETDATA_CLAIM_TOKEN
-      remoteRef:
-        key: secret/netdata/claim
-        property: NETDATA_CLAIM_TOKEN
-    - secretKey: NETDATA_CLAIM_ROOMS
-      remoteRef:
-        key: secret/netdata/claim
-        property: NETDATA_CLAIM_ROOMS
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: netdata-stream
-  namespace: common-services
-spec:
-  refreshInterval: "15s"
-  secretStoreRef:
-    name: vault-secret-store
-    kind: ClusterSecretStore
-  target:
-    name: netdata-stream
-  data:
-    - secretKey: APIKEY
-      remoteRef:
-        key: secret/netdata/stream
-        property: APIKEY

infrastructure/hashicorp-vault/external-secrets/resources/rabbitmq.yaml

@@ -1,22 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: rabbitmq-credentials
-  namespace: common-services
-spec:
-  refreshInterval: "15s"
-  secretStoreRef:
-    name: vault-secret-store
-    kind: ClusterSecretStore
-  target:
-    name: rabbitmq-credentials
-    template:
-      engineVersion: v2
-      type: Opaque
-      data:
-        rabbitmq-password: "{{ .password }}"
-  data:
-    - secretKey: password
-      remoteRef:
-        key: secret/rabbitmq
-        property: password

infrastructure/hashicorp-vault/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: vault
-      version: 0.30.0
+      version: 0.28.1
       sourceRef:
         kind: HelmRepository
         name: hashicorp
@@ -18,11 +18,14 @@ spec:
     injector:
       metrics:
         enabled: true
+      image:
+        tag: "1.4.2"
+      agentImage:
+        tag: "1.17.2"
     server:
+      image:
+        tag: "1.17.2"
       ingress:
         enabled: false
       livenessProbe:
         enabled: true
-        # Liveness tolérante au seal : un Vault scellé renvoie 200 (sealedcode/uninitcode)
-        # pour ne pas tuer le pod en boucle avant que l'auto-unseal n'agisse.
-        path: "/v1/sys/health?standbyok=true&sealedcode=200&uninitcode=200"

infrastructure/ldc-custom/ldc-web-equipe-rbac.yaml

@@ -49,23 +49,6 @@ metadata:
     kubernetes.io/service-account.name: svc-karl-muller
 type: kubernetes.io/service-account-token
 
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: svc-jeremy-munsch
-  namespace: kube-system
-
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: jeremy-munsch-secret
-  namespace: kube-system
-  annotations:
-    kubernetes.io/service-account.name: svc-jeremy-munsch
-type: kubernetes.io/service-account-token
-
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -76,18 +59,15 @@ roleRef:
   kind: ClusterRole
   name: view
 subjects:
-  - kind: ServiceAccount
+- kind: ServiceAccount
-    name: svc-vincent-bridier
+  name: svc-vincent-bridier
-    namespace: kube-system
+  namespace: kube-system
-  - kind: ServiceAccount
+- kind: ServiceAccount
-    name: svc-noah-lancien
+  name: svc-noah-lancien
-    namespace: kube-system
+  namespace: kube-system
-  - kind: ServiceAccount
+- kind: ServiceAccount
-    name: svc-karl-muller
+  name: svc-karl-muller
-    namespace: kube-system
+  namespace: kube-system
-  - kind: ServiceAccount
-    name: svc-jeremy-munsch
-    namespace: kube-system
 
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -96,40 +76,40 @@ metadata:
   creationTimestamp: null
   name: cr-ldc-web-metrics
 rules:
-  - apiGroups:
+- apiGroups:
-      - ""
+  - ""
-    resources:
+  resources:
-      - services/portforward
+  - services/portforward
-      - services/proxy
+  - services/proxy
-    verbs:
+  verbs:
-      - create
+  - create
-      - delete
+  - delete
-      - get
+  - get
-      - list
+  - list
-  - apiGroups:
+- apiGroups:
-      - apiextensions.k8s.io
+  - apiextensions.k8s.io
-    resources:
+  resources:
-      - customresourcedefinitions
+  - customresourcedefinitions
-    verbs:
+  verbs:
-      - get
+  - get
-      - list
+  - list
-      - watch
+  - watch
-  - apiGroups:
+- apiGroups:
-      - traefik.io
+  - traefik.io
-    resources:
+  resources:
-      - ingressroutes
+  - ingressroutes
-      - ingressroutetcps
+  - ingressroutetcps
-      - ingressrouteudps
+  - ingressrouteudps
-      - middlewares
+  - middlewares
-      - middlewaretcps
+  - middlewaretcps
-      - tlsoptions
+  - tlsoptions
-      - tlsstores
+  - tlsstores
-      - traefikservices
+  - traefikservices
-      - serverstransports
+  - serverstransports
-    verbs:
+  verbs:
-      - get
+  - get
-      - list
+  - list
-      - watch
+  - watch
 
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -141,18 +121,15 @@ roleRef:
   kind: ClusterRole
   name: cr-ldc-web-metrics
 subjects:
-  - kind: ServiceAccount
+- kind: ServiceAccount
-    name: svc-vincent-bridier
+  name: svc-vincent-bridier
-    namespace: kube-system
+  namespace: kube-system
-  - kind: ServiceAccount
+- kind: ServiceAccount
-    name: svc-noah-lancien
+  name: svc-noah-lancien
-    namespace: kube-system
+  namespace: kube-system
-  - kind: ServiceAccount
+- kind: ServiceAccount
-    name: svc-karl-muller
+  name: svc-karl-muller
-    namespace: kube-system
+  namespace: kube-system
-  - kind: ServiceAccount
-    name: svc-jeremy-munsch
-    namespace: kube-system
 
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -161,12 +138,12 @@ metadata:
   creationTimestamp: null
   name: cr-admin-web-ldc-namespace
 rules:
-  - apiGroups:
+- apiGroups:
-      - "*"
+  - "*"
-    resources:
+  resources:
-      - "*"
+  - "*"
-    verbs:
+  verbs:
-      - "*"
+  - "*"
 
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -175,18 +152,15 @@ metadata:
   name: rb-admin-web-ldc-namespace-review
   namespace: review
 subjects:
-  - kind: ServiceAccount
+- kind: ServiceAccount
-    name: svc-vincent-bridier
+  name: svc-vincent-bridier
-    namespace: kube-system
+  namespace: kube-system
-  - kind: ServiceAccount
+- kind: ServiceAccount
-    name: svc-noah-lancien
+  name: svc-noah-lancien
-    namespace: kube-system
+  namespace: kube-system
-  - kind: ServiceAccount
+- kind: ServiceAccount
-    name: svc-karl-muller
+  name: svc-karl-muller
-    namespace: kube-system
+  namespace: kube-system
-  - kind: ServiceAccount
-    name: svc-jeremy-munsch
-    namespace: kube-system
 roleRef:
   kind: ClusterRole
   name: cr-admin-web-ldc-namespace
@@ -199,18 +173,15 @@ metadata:
   name: rb-admin-web-ldc-namespace-staging
   namespace: staging
 subjects:
-  - kind: ServiceAccount
+- kind: ServiceAccount
-    name: svc-vincent-bridier
+  name: svc-vincent-bridier
-    namespace: kube-system
+  namespace: kube-system
-  - kind: ServiceAccount
+- kind: ServiceAccount
-    name: svc-noah-lancien
+  name: svc-noah-lancien
-    namespace: kube-system
+  namespace: kube-system
-  - kind: ServiceAccount
+- kind: ServiceAccount
-    name: svc-karl-muller
+  name: svc-karl-muller
-    namespace: kube-system
+  namespace: kube-system
-  - kind: ServiceAccount
-    name: svc-jeremy-munsch
-    namespace: kube-system
 roleRef:
   kind: ClusterRole
   name: cr-admin-web-ldc-namespace
@@ -223,18 +194,15 @@ metadata:
   name: rb-admin-web-ldc-namespace-production
   namespace: production
 subjects:
-  - kind: ServiceAccount
+- kind: ServiceAccount
-    name: svc-vincent-bridier
+  name: svc-vincent-bridier
-    namespace: kube-system
+  namespace: kube-system
-  - kind: ServiceAccount
+- kind: ServiceAccount
-    name: svc-noah-lancien
+  name: svc-noah-lancien
-    namespace: kube-system
+  namespace: kube-system
-  - kind: ServiceAccount
+- kind: ServiceAccount
-    name: svc-karl-muller
+  name: svc-karl-muller
-    namespace: kube-system
+  namespace: kube-system
-  - kind: ServiceAccount
-    name: svc-jeremy-munsch
-    namespace: kube-system
 roleRef:
   kind: ClusterRole
   name: cr-admin-web-ldc-namespace
@@ -247,18 +215,9 @@ metadata:
   name: rb-admin-web-ldc-namespace-common-services
   namespace: common-services
 subjects:
-  - kind: ServiceAccount
+- kind: ServiceAccount
-    name: svc-vincent-bridier
+  name: svc-vincent-bridier
-    namespace: kube-system
+  namespace: kube-system
-  - kind: ServiceAccount
-    name: svc-noah-lancien
-    namespace: kube-system
-  - kind: ServiceAccount
-    name: svc-karl-muller
-    namespace: kube-system
-  - kind: ServiceAccount
-    name: svc-jeremy-munsch
-    namespace: kube-system
 roleRef:
   kind: ClusterRole
   name: cr-admin-web-ldc-namespace

infrastructure/mariadb/helm-release.yaml

@@ -0,0 +1,30 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: mariadb
+  namespace: common-services
+spec:
+  interval: 1m0s
+  chart:
+    spec:
+      chart: mariadb
+      version: 18.2.4
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami
+        namespace: common-services
+  values:
+
+    image:
+      tag: 11.3.2-debian-12-r6
+
+    auth:
+      existingSecret: mariadb-credentials
+
+    primary:
+      persistence:
+        storageClass: "csi-cinder-high-speed"
+        size: 60Gi
+
+      resourcesPreset: "${MARIADB_RESOURCES_REQUEST}"

infrastructure/mariadb/helm-repository.yaml

@@ -1,3 +1,4 @@
+---
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:

infrastructure/netdata/helm-release.yaml

@@ -1,117 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: netdata
-  namespace: common-services
-spec:
-  interval: 1m0s
-
-  chart:
-    spec:
-      chart: netdata
-      version: 3.7.158
-      sourceRef:
-        kind: HelmRepository
-        name: netdata
-        namespace: common-services
-
-  # Injecte APIKEY depuis un Secret (pas en clair dans Git)
-  valuesFrom:
-    - kind: Secret
-      name: netdata-stream
-      valuesKey: APIKEY
-      targetPath: APIKEY
-
-  values:
-    image:
-      tag: v2.8.5
-
-    # Service interne uniquement
-    service:
-      type: ClusterIP
-      port: 19999
-
-    # Pas d'exposition
-    ingress:
-      enabled: false
-
-    # Pas d'auto-update des pods en prod critique
-    restarter:
-      enabled: false
-
-    # Parent = point de centralisation + health/alerting (par défaut chart)
-    parent:
-      enabled: true
-      port: 19999
-
-      resources:
-        requests:
-          cpu: "${NETDATA_PARENT_REQUESTS_CPU}"
-          memory: "${NETDATA_PARENT_REQUESTS_RAM}"
-        limits:
-          cpu: "${NETDATA_PARENT_LIMITS_CPU}"
-          memory: "${NETDATA_PARENT_LIMITS_RAM}"
-
-      # PV parent recommandés (db + alarms)
-      database:
-        persistence: true
-        volumesize: 40Gi # /var/cache/netdata
-      alarms:
-        persistence: true
-        volumesize: 4Gi # /var/lib/netdata
-
-      # Claiming via Secret envFrom
-      claiming:
-        enabled: true
-        token: ""
-        rooms: ""
-        url: "https://api.netdata.cloud"
-      envFrom:
-        - secretRef:
-            name: netdata-claim
-
-    # Child DaemonSet
-    child:
-      enabled: true
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
-
-      resources:
-        requests:
-          cpu: "${NETDATA_CHILD_REQUESTS_CPU}"
-          memory: "${NETDATA_CHILD_REQUESTS_RAM}"
-        limits:
-          cpu: "${NETDATA_CHILD_LIMITS_CPU}"
-          memory: "${NETDATA_CHILD_LIMITS_RAM}"
-
-      persistence:
-        enabled: true
-        hostPath: /var/lib/netdata-k8s-child
-
-      # Hardening UI sur les nodes: bind localhost uniquement
-      configs:
-        netdata:
-          enabled: true
-          path: /etc/netdata/netdata.conf
-          data: |
-            [db]
-              mode = ram
-              retention = "${NETDATA_CHILD_RETENTION}"
-              update every = "${NETDATA_CHILD_COLLECT_INTERVAL}"
-            [web]
-              bind to = localhost:19999
-            [health]
-              enabled = no
-            [ml]
-              enabled = no
-
-      # Claiming via Secret envFrom (token PAS en clair ici)
-      claiming:
-        enabled: true
-        token: ""
-        rooms: ""
-        url: "https://api.netdata.cloud"
-      envFrom:
-        - secretRef:
-            name: netdata-claim

infrastructure/netdata/helm-repository.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: netdata
-  namespace: common-services
-spec:
-  interval: 1h0m0s
-  url: https://netdata.github.io/helmchart/

infrastructure/netdata/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - helm-repository.yaml
-  - helm-release.yaml

infrastructure/prometheus-stack/helm-release.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: kube-prometheus-stack
-      version: 72.0.1
+      version: 62.2.1
       sourceRef:
         kind: HelmRepository
         name: prometheus-community
@@ -18,7 +18,7 @@ spec:
 
     prometheusOperator:
       image:
-        tag: v0.82.0
+        tag: v0.76.0
 
     grafana:
       defaultDashboardsTimezone: Europe/Paris
@@ -37,4 +37,4 @@ spec:
               storageClassName: "csi-cinder-classic"
               resources:
                 requests:
-                  storage: 40Gi
+                  storage: 20Gi

infrastructure/rabbitmq/helm-release.yaml

@@ -1,24 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: rabbitmq
-  namespace: common-services
-spec:
-  interval: 1m0s
-  chart:
-    spec:
-      chart: rabbitmq
-      version: 16.0.3
-      sourceRef:
-        kind: HelmRepository
-        name: bitnami
-        namespace: common-services
-  values:
-    global:
-      defaultStorageClass: "csi-cinder-high-speed"
-    image:
-      tag: 4.0.1
-    auth:
-      username: rabbitmq
-      existingPasswordSecret: rabbitmq-credentials

infrastructure/rabbitmq/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- helm-repository.yaml
-- helm-release.yaml

infrastructure/traefik/helm-release.yaml

@@ -9,14 +9,15 @@ spec:
   chart:
     spec:
       chart: traefik
-      version: 35.2.0
+      version: 31.1.1
       sourceRef:
         kind: HelmRepository
         name: traefik
         namespace: common-services
   values:
+
     image:
-      tag: v3.3.6
+      tag: v3.1.4
 
     rbac:
       enabled: true
@@ -28,30 +29,13 @@ spec:
       - "--entryPoints.web.http.redirections.entryPoint.to=websecure"
       - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
       - "--providers.kubernetescrd.allowCrossNamespace=true"
-      - "--entryPoints.web.proxyProtocol.trustedIPs=${OVH_LOAD_BALANCER_EGRESS_IP}/32"
+      - "--entryPoints.web.proxyProtocol.trustedIPs=${TRAEFIK_LOAD_BALANCER_IP}/32,10.124.0.0/16"
-      - "--entryPoints.websecure.proxyProtocol.trustedIPs=${OVH_LOAD_BALANCER_EGRESS_IP}/32"
+      - "--entryPoints.websecure.proxyProtocol.trustedIPs=${TRAEFIK_LOAD_BALANCER_IP}/32,10.124.0.0/16"
-      - "--entryPoints.websecure.forwardedHeaders.trustedIPs=${OVH_LOAD_BALANCER_EGRESS_IP}/32"
+      - "--entryPoints.websecure.forwardedHeaders.trustedIPs=${TRAEFIK_LOAD_BALANCER_IP}/32"
+      - "--entryPoints.mariadb.proxyProtocol.trustedIPs=${TRAEFIK_LOAD_BALANCER_IP},10.124.0.0/16"
 
     additionalArguments:
-      #- "--log.level=DEBUG"
+      - "--log.level=DEBUG"
-      - "--entrypoints.web.http.middlewares=common-services-crowdsec-bouncer@kubernetescrd"
-      - "--entrypoints.websecure.http.middlewares=common-services-crowdsec-bouncer@kubernetescrd"
-
-    deployment:
-      replicas: 2
-
-    podDisruptionBudget:
-      enabled: true
-      minAvailable: 1
-
-    affinity:
-      podAntiAffinity:
-        requiredDuringSchedulingIgnoredDuringExecution:
-          - labelSelector:
-              matchLabels:
-                app.kubernetes.io/name: traefik
-                app.kubernetes.io/instance: traefik-common-services
-            topologyKey: kubernetes.io/hostname
 
     ports:
       traefik:
@@ -60,10 +44,8 @@ spec:
           default: false
         protocol: TCP
       web:
-        redirections:
+        redirectTo:
-          entryPoint:
+          port: websecure
-            to: websecure
-            scheme: https
       websecure:
         port: 8443
         expose:
@@ -77,6 +59,11 @@ spec:
         expose:
           default: false
         protocol: TCP
+      mariadb:
+        port: 54322
+        expose:
+          default: true
+        protocol: TCP
 
     providers:
       kubernetesCRD:
@@ -85,28 +72,13 @@ spec:
       kubernetesIngress:
         enabled: true
 
-    experimental:
-      plugins:
-        bouncer:
-          moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
-          version: v1.4.5
-
-    volumes:
-      - name: crowdsec-lapi-secret
-        mountPath: /etc/traefik/crowdsec
-        type: secret
-        secretName: crowdsec-lapi-secret
-
     service:
       enabled: true
       type: LoadBalancer
       annotations:
-        loadbalancer.ovhcloud.com/class: "octavia"
+        service.beta.kubernetes.io/ovh-loadbalancer-proxy-protocol: v2
-        loadbalancer.openstack.org/proxy-protocol: "v2"
-        loadbalancer.openstack.org/keep-floatingip: "true"
-        # Protection Flux : empêche la suppression accidentelle
-        kustomize.toolkit.fluxcd.io/prune: disabled
       spec:
+        loadBalancerIP: "${TRAEFIK_LOAD_BALANCER_IP}"
         externalTrafficPolicy: Local
 
     ingressRoute:
@@ -114,29 +86,7 @@ spec:
         enabled: true
 
     extraObjects:
-      - apiVersion: traefik.io/v1alpha1
+      - apiVersion: traefik.io/v1alpha1  # Redirect www URLs to their no-www equivalent
-        kind: Middleware
-        metadata:
-          name: crowdsec-bouncer
-          namespace: common-services
-        spec:
-          plugin:
-            bouncer:
-              forwardedHeadersTrustedIps: "${OVH_LOAD_BALANCER_EGRESS_IP}/32"
-              enabled: true
-              crowdsecMode: stream
-              crowdsecLapiScheme: http
-              crowdsecLapiHost: crowdsec-service.common-services.svc.cluster.local:8080
-              crowdsecLapiPath: /
-              crowdsecLapiKeyFile: /etc/traefik/crowdsec/BOUNCER_KEY_traefik
-              crowdsecAppsecEnabled: true
-              crowdsecAppsecHost: crowdsec-appsec-service.common-services.svc.cluster.local:7422
-              crowdsecAppsecPath: /
-              crowdsecAppsecFailureBlock: true
-              crowdsecAppsecUnreachableBlock: true
-              crowdsecAppsecBodyLimit: 10485760
-
-      - apiVersion: traefik.io/v1alpha1 # Redirect www URLs to their no-www equivalent
         kind: Middleware
         metadata:
           name: redirect-www-to-no-www
@@ -151,7 +101,7 @@ spec:
             # How to modify the URL to have the new target URL
             replacement: "https://${1}"
 
-      - apiVersion: traefik.io/v1alpha1 # Redirect www URLs to their no-www equivalent
+      - apiVersion: traefik.io/v1alpha1  # Redirect www URLs to their no-www equivalent
         kind: Middleware
         metadata:
           name: redirect-www-to-no-www
@@ -166,7 +116,7 @@ spec:
             # How to modify the URL to have the new target URL
             replacement: "https://${1}"
 
-      - apiVersion: traefik.io/v1alpha1 # Redirect www URLs to their no-www equivalent
+      - apiVersion: traefik.io/v1alpha1  # Redirect www URLs to their no-www equivalent
         kind: Middleware
         metadata:
           name: redirect-www-to-no-www
@@ -181,7 +131,7 @@ spec:
             # How to modify the URL to have the new target URL
             replacement: "https://${1}"
 
-      - apiVersion: traefik.io/v1alpha1 # Redirect www URLs to their no-www equivalent
+      - apiVersion: traefik.io/v1alpha1  # Redirect www URLs to their no-www equivalent
         kind: Middleware
         metadata:
           name: redirect-www-to-no-www
@@ -198,7 +148,7 @@ spec:
 
       # Redirection to www for common-services namespace
       # TODO: remove this middleware when all sites been updated
-      - apiVersion: traefik.io/v1alpha1 # Redirect no-www URLs to their www equivalent
+      - apiVersion: traefik.io/v1alpha1  # Redirect no-www URLs to their www equivalent
         kind: Middleware
         metadata:
           name: redirect-no-www-to-www
@@ -214,7 +164,7 @@ spec:
             replacement: "https://www.${1}"
 
       # Redirection to www for production namespace
-      - apiVersion: traefik.io/v1alpha1 # Redirect no-www URLs to their www equivalent
+      - apiVersion: traefik.io/v1alpha1  # Redirect no-www URLs to their www equivalent
         kind: Middleware
         metadata:
           name: redirect-no-www-to-www
@@ -230,7 +180,7 @@ spec:
             replacement: "https://www.${1}"
 
       # Redirection from www to domain for staging
-      - apiVersion: traefik.io/v1alpha1 # Redirect no-www URLs to their www equivalent
+      - apiVersion: traefik.io/v1alpha1  # Redirect no-www URLs to their www equivalent
         kind: Middleware
         metadata:
           name: redirect-no-www-to-www
@@ -245,7 +195,7 @@ spec:
             replacement: "https://${1}"
 
       # Redirection from www to domain for review
-      - apiVersion: traefik.io/v1alpha1 # Redirect no-www URLs to their www equivalent
+      - apiVersion: traefik.io/v1alpha1  # Redirect no-www URLs to their www equivalent
         kind: Middleware
         metadata:
           name: redirect-no-www-to-www
@@ -259,36 +209,23 @@ spec:
             # How to modify the URL to have the new target URL
             replacement: "https://${1}"
 
-      # customResponseHeaders middleware
       - apiVersion: traefik.io/v1alpha1
-        kind: Middleware
+        kind: MiddlewareTCP
         metadata:
-          name: coop-middleware
+          name: ipwhitelist-acces-mariadb
-          namespace: review
+          namespace: common-services
         spec:
-          headers:
+          ipAllowList:
-            customResponseHeaders:
+            sourceRange:
-              Cross-Origin-Opener-Policy: "same-origin"
+              - 46.18.126.208/28 # LDC
-
+              - 62.193.56.48/32 # OPENevents - Bureau Neuville
-      - apiVersion: traefik.io/v1alpha1
+              - 80.15.14.76/32 # LDC web - Box externe
-        kind: Middleware
+              - 86.65.205.240/28 # LDC
-        metadata:
+              - 135.125.42.176/28 # LDC
-          name: coop-middleware
+              - 149.202.23.64/26 # LDC
-          namespace: staging
+              - 151.80.95.176/28 # LDC
-        spec:
+              - 217.15.92.64/28 # LDC
-          headers:
+              - 10.124.0.0/16 # Kubernetes internal resources
-            customResponseHeaders:
-              Cross-Origin-Opener-Policy: "same-origin"
-
-      - apiVersion: traefik.io/v1alpha1
-        kind: Middleware
-        metadata:
-          name: coop-middleware
-          namespace: production
-        spec:
-          headers:
-            customResponseHeaders:
-              Cross-Origin-Opener-Policy: "same-origin"
 
       - apiVersion: traefik.io/v1alpha1
         kind: Middleware
@@ -298,184 +235,27 @@ spec:
         spec:
           ipAllowList:
             sourceRange:
-              - 163.172.132.215 # Proxy Cloud Navigation LDC
-              - 51.159.133.41 # Proxy Cloud Navigation LDC
-              - 51.159.82.143 # Proxy Cloud Navigation LDC
-              - 135.125.42.187 # Proxy Cloud Navigation LDC
-              - 37.64.103.132 # Willow Creation
-              - 88.86.232.178 # Cafel
-              - 57.128.69.87 # K8S Node 1
-              - 57.128.110.168 # K8S Node 2
-              - 57.128.111.33 # K8S Node 3
-              - 54.38.0.22 # K8S Node 4
-              - 57.128.71.23 # K8S Node 5
-              - 51.68.88.158/32 # prod-k8s-ldc-web-nopreempt-node-796d8b
-              - 51.68.92.100/32 # prod-k8s-ldc-web-nopreempt-node-8f841b
-              - 51.68.92.60/32 # prod-k8s-ldc-web-nopreempt-node-399aa9
-              - 51.68.87.150/32 # prod-k8s-ldc-web-nopreempt-node-b5417b
-              - 51.68.90.203/32 #	prod-k8s-ldc-web-nopreempt-node-e3ac48
-              - 137.74.211.112/32 # dev-test-k8s-ldc-web-nopreempt-node-17257c
-              - 146.59.240.51/32 # dev-test-k8s-ldc-web-nopreempt-node-54e828
-              - 146.59.241.151/32 # dev-test-k8s-ldc-web-nopreempt-node-93017a
               - 46.18.126.208/28 # LDC
               - 62.193.56.48/32 # OPENevents - Bureau Neuville
+              - 80.15.14.76/32 # LDC web - Box externe
               - 86.65.205.240/28 # LDC
               - 135.125.42.176/28 # LDC
               - 149.202.23.64/26 # LDC
               - 151.80.95.176/28 # LDC
               - 217.15.92.64/28 # LDC
-              - 3.77.67.4 # UptimeRobot
-              - 3.79.134.69 # UptimeRobot
-              - 18.192.166.72 # UptimeRobot
-              - 18.193.252.127 # UptimeRobot
-              - 52.28.162.93 # UptimeRobot
-              - 52.59.43.236 # UptimeRobot
-              - 63.178.84.147 # UptimeRobot
-              - 24.144.78.39 # UptimeRobot
-              - 24.144.78.185 # UptimeRobot
-              - 64.225.81.248 # UptimeRobot
-              - 64.225.82.147 # UptimeRobot
-              - 143.198.249.237 # UptimeRobot
-              - 143.198.250.89 # UptimeRobot
-              - 143.244.196.21 # UptimeRobot
-              - 143.244.196.211 # UptimeRobot
-              - 152.42.149.135 # UptimeRobot
-              - 159.223.243.219 # UptimeRobot
-              - 161.35.247.201 # UptimeRobot
-              - 167.99.18.52 # UptimeRobot
-              - 188.166.201.79 # UptimeRobot
-              - 206.189.241.133 # UptimeRobot
-              - 209.38.53.7 # UptimeRobot
-              - 49.13.24.81 # UptimeRobot
-              - 49.13.130.29 # UptimeRobot
-              - 49.13.134.145 # UptimeRobot
-              - 78.47.98.55 # UptimeRobot
-              - 88.99.80.227 # UptimeRobot
-              - 142.132.180.39 # UptimeRobot
-              - 157.90.155.240 # UptimeRobot
-              - 157.90.156.63 # UptimeRobot
-              - 168.119.53.160 # UptimeRobot
-              - 168.119.96.239 # UptimeRobot
-              - 49.13.164.148 # UptimeRobot
-              - 49.13.167.123 # UptimeRobot
-              - 78.46.190.63 # UptimeRobot
-              - 78.47.173.76 # UptimeRobot
-              - 128.140.41.193 # UptimeRobot
-              - 128.140.106.114 # UptimeRobot
-              - 159.69.158.189 # UptimeRobot
-              - 167.235.143.113 # UptimeRobot
-              - 168.119.123.75 # UptimeRobot
-              - 78.46.215.1 # UptimeRobot
-              - 91.99.101.207 # UptimeRobot
-              - 46.224.188.186 # BugSmash
-              - 178.156.178.124 # BugSmash
-              - 5.161.29.18 # BugSmash
-
-      # AJOUT : Service Octavia en parallèle
-      - apiVersion: v1
-        kind: Service
-        metadata:
-          name: traefik-octavia
-          namespace: common-services
-          annotations:
-            loadbalancer.ovhcloud.com/class: "octavia"
-            loadbalancer.openstack.org/proxy-protocol: "v2"
-            loadbalancer.openstack.org/keep-floatingip: "true"
-            # Protection Flux : empêche la suppression accidentelle
-            kustomize.toolkit.fluxcd.io/prune: disabled
-        spec:
-          type: LoadBalancer
-          externalTrafficPolicy: Local
-          loadBalancerIP: "${TRAEFIK_LOAD_BALANCER_IP_OCTAVIA}"
-          selector:
-            app.kubernetes.io/name: traefik
-            app.kubernetes.io/instance: traefik-common-services
-          ports:
-            - name: web
-              port: 80
-              targetPort: 8000
-              protocol: TCP
-            - name: websecure
-              port: 443
-              targetPort: 8443
-              protocol: TCP
-
-      - apiVersion: v1
-        kind: Service
-        metadata:
-          name: blackhole
-          namespace: common-services
-        spec:
-          # Placeholder : jamais contacté, le middleware renvoie 403 avant.
-          type: ClusterIP
-          ports:
-            - name: http
-              port: 80
-              targetPort: 80
-
       - apiVersion: traefik.io/v1alpha1
-        kind: Middleware
+        kind: IngressRouteTCP
         metadata:
-          name: deny-ip-blocklist
+          name: mariadb-ingressroutetcp
-          namespace: common-services
-        spec:
-          # ipAllowList rejette en 403
-          ipAllowList:
-            sourceRange:
-              - 192.0.2.1/32 # TEST-NET-1 (RFC 5737) : ne matche aucun client réel => deny
-
-      - apiVersion: traefik.io/v1alpha1
-        kind: IngressRoute
-        metadata:
-          name: security-ip-blocklist
           namespace: common-services
         spec:
           entryPoints:
-            - websecure
+            - mariadb
           routes:
-            - kind: Rule
+            - match: HostSNI(`*`) # Hostname to match
-              match: >-
-                ClientIP(`45.88.138.45/32`) ||
-                ClientIP(`8.34.210.32/32`) ||
-                ClientIP(`8.34.210.37/32`) ||
-                ClientIP(`8.34.210.42/32`) ||
-                ClientIP(`8.34.210.43/32`) ||
-                ClientIP(`8.34.210.45/32`) ||
-                ClientIP(`34.68.34.65/32`) ||
-                ClientIP(`34.68.34.66/32`) ||
-                ClientIP(`34.68.34.67/32`) ||
-                ClientIP(`34.68.34.69/32`) ||
-                ClientIP(`34.68.34.71/32`) ||
-                ClientIP(`34.68.34.72/32`) ||
-                ClientIP(`34.68.34.77/32`) ||
-                ClientIP(`34.68.34.79/32`) ||
-                ClientIP(`34.68.34.81/32`) ||
-                ClientIP(`34.68.34.84/32`) ||
-                ClientIP(`94.74.106.96/32`) ||
-                ClientIP(`20.220.225.223/32`) ||
-                ClientIP(`52.182.173.140/32`)
-              priority: 100000
               middlewares:
-                - name: deny-ip-blocklist
+                - name: ipwhitelist-acces-mariadb
                   namespace: common-services
               services:
-                - name: blackhole
+                - name: mariadb
-                  port: 80
+                  port: 3306
-
-      - apiVersion: discovery.k8s.io/v1
-        kind: EndpointSlice
-        metadata:
-          name: blackhole
-          namespace: common-services
-          labels:
-            kubernetes.io/service-name: blackhole
-        addressType: IPv4
-        endpoints:
-          - addresses:
-              - 192.0.2.1 # TEST-NET-1 : non-routable, jamais contacté
-            conditions:
-              ready: true
-        ports:
-          - name: http
-            port: 80
-            protocol: TCP