Compare commits
1 commit
master
...
re7-middle
| Author | SHA1 | Date | |
|---|---|---|---|
|
8d64f9249e |
31 changed files with 283 additions and 879 deletions
|
|
@ -28,7 +28,7 @@ variables:
|
|||
git config user.email "autodeploy@mediactivegroup.com"
|
||||
git add --all
|
||||
git commit -m "Bot Auto Commit"
|
||||
git push --force https://project_access_token:${GITLAB_ACCESS_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git HEAD:${DEPLOY_BRANCH}
|
||||
git push --force https://flux-token-api:${GITLAB_ACCESS_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git HEAD:${DEPLOY_BRANCH}
|
||||
tags:
|
||||
- flux
|
||||
- k8s
|
||||
|
|
|
|||
|
|
@ -8,7 +8,6 @@ ci_access:
|
|||
- id: ldc-web/projets/galina
|
||||
- id: ldc-web/projets/gen-game-web-instances/janze
|
||||
- id: ldc-web/projets/gen-game-web-instances/l-orleanais-jeu
|
||||
- id: ldc-web/projets/gen-game-web-instances/le-gaulois-chequier-40-2025
|
||||
- id: ldc-web/projets/gen-game-web-instances/le-gaulois-tdf-2024
|
||||
- id: ldc-web/projets/gen-game-web-instances/normandie
|
||||
- id: ldc-web/projets/gen-game-web-instances/reghalal-jeu
|
||||
|
|
|
|||
|
|
@ -2,52 +2,42 @@ ci_access:
|
|||
projects:
|
||||
- id: ldc-web/projets/agis
|
||||
- id: ldc-web/projets/auguste-lambert
|
||||
- id: ldc-web/projets/bien-etre-animal
|
||||
- id: ldc-web/projets/boutique-cnc-sable
|
||||
- id: ldc-web/projets/boutique-jeusselin
|
||||
- id: ldc-web/projets/cailles-robin
|
||||
- id: ldc-web/projets/com-app-bo
|
||||
- id: ldc-web/projets/crm
|
||||
- id: ldc-web/projets/coupe-de-france-de-la-volaille
|
||||
- id: ldc-web/projets/data-pfc
|
||||
- id: ldc-web/projets/domaine-de-lanvaux
|
||||
- id: ldc-web/projets/doux
|
||||
- id: ldc-web/projets/espri-restauration
|
||||
- id: ldc-web/projets/galina
|
||||
- id: ldc-web/projets/gen-game-web-instances/auguste-lambert
|
||||
- id: ldc-web/projets/gen-game-web-instances/janze
|
||||
- id: ldc-web/projets/gen-game-web-instances/l-orleanais-jeu
|
||||
- id: ldc-web/projets/gen-game-web-instances/le-gaulois-eveillez-vos-papilles
|
||||
- id: ldc-web/projets/gen-game-web-instances/le-gaulois-tdf-2024
|
||||
- id: ldc-web/projets/gen-game-web-instances/le-gaulois-chequier-40-2025
|
||||
- id: ldc-web/projets/gen-game-web-instances/le-gaulois-op-brasserie-2025
|
||||
- id: ldc-web/projets/gen-game-web-instances/le-gaulois-sportif-2025
|
||||
- id: ldc-web/projets/gen-game-web-instances/le-gaulois-sportif-2026
|
||||
- id: ldc-web/projets/gen-game-web-instances/matines-40-ans
|
||||
- id: ldc-web/projets/gen-game-web-instances/nature-and-respect
|
||||
- id: ldc-web/projets/gen-game-web-instances/normandie
|
||||
- id: ldc-web/projets/gen-game-web-instances/reghalal-jeu
|
||||
- id: ldc-web/projets/gen-game-web-instances/tregalette-chandleur-2024
|
||||
- id: ldc-web/projets/gen-game-web-prize-draw
|
||||
- id: ldc-web/projets/id-halal
|
||||
- id: ldc-web/projets/jeusselin
|
||||
- id: ldc-web/projets/ker-chant
|
||||
- id: ldc-web/projets/l-hours
|
||||
- id: ldc-web/projets/la-boutique-du-canard
|
||||
- id: ldc-web/projets/la-toque-angevine
|
||||
- id: ldc-web/projets/ldc
|
||||
- id: ldc-web/projets/ldc-foods
|
||||
- id: ldc-web/projets/ldc-restauration
|
||||
- id: ldc-web/projets/ldc-web
|
||||
- id: ldc-web/projets/le-gaulois
|
||||
- id: ldc-web/projets/le-gaulois-pro
|
||||
- id: ldc-web/projets/le-marche-de-beaufeu
|
||||
- id: ldc-web/projets/les-fermiers-snv
|
||||
- id: ldc-web/projets/lionor
|
||||
- id: ldc-web/projets/loue
|
||||
- id: ldc-web/projets/matomo
|
||||
- id: ldc-web/projets/loue-action-reboisement
|
||||
- id: ldc-web/projets/loue-magie-de-noel
|
||||
- id: ldc-web/projets/maitre-coq
|
||||
- id: ldc-web/projets/mairet
|
||||
- id: ldc-web/projets/maison-couthouis
|
||||
- id: ldc-web/projets/marie
|
||||
- id: ldc-web/projets/marie-restauration
|
||||
- id: ldc-web/projets/mas-d-auge
|
||||
- id: ldc-web/projets/matines
|
||||
- id: ldc-web/projets/medina
|
||||
|
|
@ -59,7 +49,6 @@ ci_access:
|
|||
- id: ldc-web/projets/parc-auto
|
||||
- id: ldc-web/projets/poule-et-toque
|
||||
- id: ldc-web/projets/prims
|
||||
- id: ldc-web/projets/qualimaine
|
||||
- id: ldc-web/projets/qrcollector/qrcollector-back
|
||||
- id: ldc-web/projets/regalette
|
||||
- id: ldc-web/projets/reghalal
|
||||
|
|
@ -68,12 +57,14 @@ ci_access:
|
|||
- id: ldc-web/projets/sbv
|
||||
- id: ldc-web/projets/share-secure-content
|
||||
- id: ldc-web/projets/showroom/showroom-bo
|
||||
- id: ldc-web/projets/showroom-bo-instances/drosed
|
||||
- id: ldc-web/projets/showroom-bo-instances/maitre-coq
|
||||
- id: ldc-web/projets/showroom-bo-instances/nature-and-respect
|
||||
- id: ldc-web/projets/store-ldc
|
||||
- id: ldc-web/projets/support-web
|
||||
- id: ldc-web/projets/traditions-asie
|
||||
- id: ldc-web/projets/tregalette
|
||||
- id: ldc-web/projets/uwil-ui
|
||||
- id: ldc-web/projets/volailles-ardeche
|
||||
- id: ldc-web/projets/volailles-challans
|
||||
- id: ldc-web/projets/vdme
|
||||
- id: ldc-web/projets/volena
|
||||
|
||||
observability:
|
||||
|
|
|
|||
|
|
@ -8,6 +8,7 @@
|
|||
| FluxCD | no flux | 2.3.0 | 2.3.0 | 2.13.0 |
|
||||
| Git-agent | 16.9.3 | 16.9.3 | 17.1.0 | 2.30 |
|
||||
| Git-runner | 16.9.1 | 16.9.1 | 17.0.1 | 0.62.1 |
|
||||
| MariaDB | 10.10 | 1.13.2 | 1.13.2 | 18.2.4 |
|
||||
| Prometheus | 0.60.1 | 0.74.0 | 0.74.0 | 60.2.0 |
|
||||
| Traefik | 2.9.6 | 3.0.2 | 3.0.2 | 28.3.0 |
|
||||
| Velero | 1.10.1 | 1.13.2 | 1.13.2 | 6.7.0 |
|
||||
|
|
|
|||
|
|
@ -1,32 +0,0 @@
|
|||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: crowdsec
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 1m0s
|
||||
path: ./infrastructure/crowdsec
|
||||
prune: false
|
||||
healthChecks:
|
||||
- apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
name: crowdsec
|
||||
namespace: common-services
|
||||
- apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
name: crowdsec
|
||||
namespace: common-services
|
||||
- apiVersion: v1
|
||||
kind: Pod
|
||||
name: vault-0
|
||||
namespace: common-services
|
||||
dependsOn:
|
||||
- name: namespaces
|
||||
namespace: flux-system
|
||||
- name: external-secrets-resources
|
||||
namespace: flux-system
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: flux-system
|
||||
timeout: 5m
|
||||
|
|
@ -1,17 +1,15 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- cert-manager.yaml
|
||||
- flux-resources.yaml
|
||||
- gitlab-agent.yaml
|
||||
- gitlab-runner.yaml
|
||||
- hashicorp-vault.yaml
|
||||
- ldc-custom.yaml
|
||||
- meilisearch.yaml
|
||||
- namespaces.yaml
|
||||
- prometheus-stack.yaml
|
||||
- rabbitmq.yaml
|
||||
- traefik.yaml
|
||||
- quickchart.yaml
|
||||
- netdata.yaml
|
||||
- crowdsec.yaml
|
||||
- cert-manager.yaml
|
||||
- flux-resources.yaml
|
||||
- gitlab-agent.yaml
|
||||
- gitlab-runner.yaml
|
||||
- hashicorp-vault.yaml
|
||||
- ldc-custom.yaml
|
||||
- mariadb.yaml
|
||||
- meilisearch.yaml
|
||||
- namespaces.yaml
|
||||
- prometheus-stack.yaml
|
||||
- traefik.yaml
|
||||
- quickchart.yaml
|
||||
|
|
|
|||
|
|
@ -2,31 +2,25 @@
|
|||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: netdata
|
||||
name: mariadb
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 1m0s
|
||||
path: ./infrastructure/netdata
|
||||
interval: 30s
|
||||
path: ./infrastructure/mariadb
|
||||
prune: false
|
||||
healthChecks:
|
||||
- apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
name: netdata
|
||||
namespace: common-services
|
||||
- apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
name: netdata
|
||||
namespace: common-services
|
||||
- apiVersion: v1
|
||||
kind: Pod
|
||||
name: vault-0
|
||||
namespace: common-services
|
||||
dependsOn:
|
||||
- name: namespaces
|
||||
namespace: flux-system
|
||||
- name: external-secrets-resources
|
||||
namespace: flux-system
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: flux-system
|
||||
dependsOn:
|
||||
- name: external-secrets-resources
|
||||
namespace: flux-system
|
||||
healthChecks:
|
||||
- apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
name: bitnami
|
||||
namespace: common-services
|
||||
- apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
name: mariadb
|
||||
namespace: common-services
|
||||
timeout: 5m
|
||||
|
|
@ -1,26 +0,0 @@
|
|||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: rabbitmq
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 1m0s
|
||||
path: ./infrastructure/rabbitmq
|
||||
prune: false
|
||||
healthChecks:
|
||||
- apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
name: bitnami
|
||||
namespace: common-services
|
||||
- apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
name: rabbitmq
|
||||
namespace: common-services
|
||||
dependsOn:
|
||||
- name: namespaces
|
||||
namespace: flux-system
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: flux-system
|
||||
timeout: 5m
|
||||
|
|
@ -1,92 +0,0 @@
|
|||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: crowdsec
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 5m
|
||||
chart:
|
||||
spec:
|
||||
chart: crowdsec
|
||||
version: 0.24.0
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: crowdsec
|
||||
namespace: common-services
|
||||
values:
|
||||
container_runtime: containerd
|
||||
|
||||
image:
|
||||
tag: v1.7.8
|
||||
|
||||
agent:
|
||||
acquisition:
|
||||
- namespace: common-services
|
||||
podName: traefik-*
|
||||
program: traefik
|
||||
env:
|
||||
- name: COLLECTIONS
|
||||
value: "crowdsecurity/traefik"
|
||||
|
||||
secrets:
|
||||
externalSecret:
|
||||
name: crowdsec-lapi-secret
|
||||
csLapiSecretKey: "CS_LAPI_SECRET"
|
||||
registrationTokenKey: "REGISTRATION_TOKEN"
|
||||
|
||||
lapi:
|
||||
replicas: 2
|
||||
storeCAPICredentialsInSecret: true
|
||||
storeLAPICscliCredentialsInSecret: true
|
||||
persistentVolume:
|
||||
data:
|
||||
enabled: false
|
||||
config:
|
||||
enabled: false
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: crowdsec-lapi-secret
|
||||
|
||||
config:
|
||||
config.yaml.local: |
|
||||
api:
|
||||
client:
|
||||
# the log processor will remove delete itself from LAPI when stopping.
|
||||
unregister_on_exit: true
|
||||
server:
|
||||
auto_registration: # Activate if not using TLS for authentication
|
||||
enabled: true
|
||||
token: "${CROWDSEC_REGISTRATION_TOKEN}" # /!\ Do not modify this variable (Cluster K8S gitlab var)
|
||||
allowed_ranges: # /!\ Make sure to adapt to the pod IP ranges used by your cluster
|
||||
- "127.0.0.1/32"
|
||||
- "192.168.0.0/16"
|
||||
- "10.0.0.0/8"
|
||||
- "172.16.0.0/12"
|
||||
db_config:
|
||||
type: mysql
|
||||
user: ${CROWDSEC_DB_USER}
|
||||
password: ${CROWDSEC_DB_PWD}
|
||||
db_name: ${CROWDSEC_DB_NAME}
|
||||
host: ${DB_HOST}
|
||||
port: ${DB_PORT}
|
||||
flush:
|
||||
bouncers_autodelete:
|
||||
api_key: 1h
|
||||
agents_autodelete:
|
||||
login_password: 6h
|
||||
cert: 6h
|
||||
|
||||
appsec:
|
||||
enabled: true
|
||||
acquisitions:
|
||||
- source: appsec
|
||||
listen_addr: "0.0.0.0:7422"
|
||||
path: /
|
||||
appsec_configs:
|
||||
- crowdsecurity/appsec-default
|
||||
- crowdsecurity/crs
|
||||
labels:
|
||||
type: appsec
|
||||
env:
|
||||
- name: COLLECTIONS
|
||||
value: "crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-crs crowdsecurity/appsec-generic-rules"
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: crowdsec
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1h0m0s
|
||||
url: https://crowdsecurity.github.io/helm-charts
|
||||
|
|
@ -9,7 +9,7 @@ spec:
|
|||
chart:
|
||||
spec:
|
||||
chart: gitlab-agent
|
||||
version: 2.29.0
|
||||
version: 2.8.3
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: gitlab-agent
|
||||
|
|
@ -17,7 +17,7 @@ spec:
|
|||
values:
|
||||
|
||||
image:
|
||||
tag: v19.2.0
|
||||
tag: v17.5.2
|
||||
|
||||
config:
|
||||
kasAddress: "wss://lab.s-web.fr/-/kubernetes-agent/"
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ spec:
|
|||
chart:
|
||||
spec:
|
||||
chart: gitlab-runner
|
||||
version: 0.91.2
|
||||
version: 0.70.2
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: gitlab-runner
|
||||
|
|
@ -17,7 +17,7 @@ spec:
|
|||
values:
|
||||
|
||||
image:
|
||||
tag: alpine-v19.2.2
|
||||
tag: alpine-v17.5.2
|
||||
|
||||
gitlabUrl: https://lab.s-web.fr
|
||||
|
||||
|
|
|
|||
|
|
@ -5,30 +5,27 @@ metadata:
|
|||
namespace: common-services
|
||||
spec:
|
||||
schedule: "* * * * *"
|
||||
suspend: false # géré explicitement par Git (corrige le drift de suspension manuelle)
|
||||
concurrencyPolicy: Forbid
|
||||
startingDeadlineSeconds: 60
|
||||
successfulJobsHistoryLimit: 1
|
||||
failedJobsHistoryLimit: 3
|
||||
failedJobsHistoryLimit: 2
|
||||
jobTemplate:
|
||||
spec:
|
||||
backoffLimit: 2
|
||||
activeDeadlineSeconds: 120
|
||||
template:
|
||||
spec:
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 10001
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: vault-auto-unseal
|
||||
image: registry.s-web.fr/ldc-web/k8s-vault-unseal:1.1.0
|
||||
image: registry.s-web.fr/ldc-web/k8s-vault-unseal:1.0.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: ["python", "main.py", "-u", "http://vault.common-services:8200"]
|
||||
command: ["python", "main.py", "-u", "http://vault.common-services:8200", "-t", "${DOLLAR}(VAULT_TOKEN)",
|
||||
"-k", "${DOLLAR}(UNSEAL_KEY_1)", "-k", "${DOLLAR}(UNSEAL_KEY_2)", "-k", "${DOLLAR}(UNSEAL_KEY_3)",
|
||||
"-k", "${DOLLAR}(UNSEAL_KEY_4)", "-k", "${DOLLAR}(UNSEAL_KEY_5)"]
|
||||
env:
|
||||
- name: PYTHONDONTWRITEBYTECODE
|
||||
value: "1"
|
||||
- name: VAULT_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: vault-credentials
|
||||
key: token
|
||||
- name: UNSEAL_KEY_1
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
|
|
@ -54,19 +51,6 @@ spec:
|
|||
secretKeyRef:
|
||||
name: vault-credentials
|
||||
key: unseal_key_5
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 64Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
imagePullSecrets:
|
||||
- name: docker-registry-credentials
|
||||
restartPolicy: OnFailure
|
||||
|
|
|
|||
|
|
@ -1,38 +0,0 @@
|
|||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: crowdsec-lapi-secret
|
||||
namespace: common-services
|
||||
spec:
|
||||
refreshInterval: 15s
|
||||
secretStoreRef:
|
||||
name: vault-secret-store
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: crowdsec-lapi-secret
|
||||
creationPolicy: Owner
|
||||
data:
|
||||
- secretKey: CS_LAPI_SECRET
|
||||
remoteRef:
|
||||
key: secret/data/crowdsec/lapi
|
||||
property: CS_LAPI_SECRET
|
||||
- secretKey: REGISTRATION_TOKEN
|
||||
remoteRef:
|
||||
key: secret/data/crowdsec/lapi
|
||||
property: REGISTRATION_TOKEN
|
||||
- secretKey: ENROLL_KEY
|
||||
remoteRef:
|
||||
key: secret/data/crowdsec/lapi
|
||||
property: ENROLL_KEY
|
||||
- secretKey: ENROLL_INSTANCE_NAME
|
||||
remoteRef:
|
||||
key: secret/data/crowdsec/lapi
|
||||
property: ENROLL_INSTANCE_NAME
|
||||
- secretKey: ENROLL_TAGS
|
||||
remoteRef:
|
||||
key: secret/data/crowdsec/lapi
|
||||
property: ENROLL_TAGS
|
||||
- secretKey: BOUNCER_KEY_traefik
|
||||
remoteRef:
|
||||
key: secret/data/crowdsec/lapi
|
||||
property: BOUNCER_KEY_traefik
|
||||
|
|
@ -7,10 +7,8 @@ resources:
|
|||
- gitlab-agent.yaml
|
||||
- gitlab-runner.yaml
|
||||
- hashicorp-vault.yaml
|
||||
- mariadb.yaml
|
||||
- prometheus-stack.yaml
|
||||
- review.yaml
|
||||
- staging.yaml
|
||||
- production.yaml
|
||||
- rabbitmq.yaml
|
||||
- netdata.yaml
|
||||
- crowdsec.yaml
|
||||
|
|
|
|||
|
|
@ -0,0 +1,28 @@
|
|||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: mariadb-credentials
|
||||
namespace: common-services
|
||||
spec:
|
||||
refreshInterval: "15s"
|
||||
secretStoreRef:
|
||||
name: vault-secret-store
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: mariadb-credentials
|
||||
template:
|
||||
engineVersion: v2
|
||||
type: Opaque
|
||||
data:
|
||||
mariadb-password: "{{ .password }}"
|
||||
mariadb-replication-password: "{{ .root_password }}"
|
||||
mariadb-root-password: "{{ .root_password }}"
|
||||
data:
|
||||
- secretKey: root_password
|
||||
remoteRef:
|
||||
key: secret/mariadb
|
||||
property: root_password
|
||||
- secretKey: password
|
||||
remoteRef:
|
||||
key: secret/mariadb
|
||||
property: password
|
||||
|
|
@ -1,41 +0,0 @@
|
|||
---
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: netdata-claim
|
||||
namespace: common-services
|
||||
spec:
|
||||
refreshInterval: "15s"
|
||||
secretStoreRef:
|
||||
name: vault-secret-store
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: netdata-claim
|
||||
data:
|
||||
- secretKey: NETDATA_CLAIM_TOKEN
|
||||
remoteRef:
|
||||
key: secret/netdata/claim
|
||||
property: NETDATA_CLAIM_TOKEN
|
||||
- secretKey: NETDATA_CLAIM_ROOMS
|
||||
remoteRef:
|
||||
key: secret/netdata/claim
|
||||
property: NETDATA_CLAIM_ROOMS
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: netdata-stream
|
||||
namespace: common-services
|
||||
spec:
|
||||
refreshInterval: "15s"
|
||||
secretStoreRef:
|
||||
name: vault-secret-store
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: netdata-stream
|
||||
data:
|
||||
- secretKey: APIKEY
|
||||
remoteRef:
|
||||
key: secret/netdata/stream
|
||||
property: APIKEY
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: rabbitmq-credentials
|
||||
namespace: common-services
|
||||
spec:
|
||||
refreshInterval: "15s"
|
||||
secretStoreRef:
|
||||
name: vault-secret-store
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: rabbitmq-credentials
|
||||
template:
|
||||
engineVersion: v2
|
||||
type: Opaque
|
||||
data:
|
||||
rabbitmq-password: "{{ .password }}"
|
||||
data:
|
||||
- secretKey: password
|
||||
remoteRef:
|
||||
key: secret/rabbitmq
|
||||
property: password
|
||||
|
|
@ -23,6 +23,3 @@ spec:
|
|||
enabled: false
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
# Liveness tolérante au seal : un Vault scellé renvoie 200 (sealedcode/uninitcode)
|
||||
# pour ne pas tuer le pod en boucle avant que l'auto-unseal n'agisse.
|
||||
path: "/v1/sys/health?standbyok=true&sealedcode=200&uninitcode=200"
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- helm-repository.yaml
|
||||
- helm-release.yaml
|
||||
- auto-unseal.yaml
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- helm-repository.yaml
|
||||
- helm-release.yaml
|
||||
- auto-unseal.yaml
|
||||
|
|
|
|||
|
|
@ -49,23 +49,6 @@ metadata:
|
|||
kubernetes.io/service-account.name: svc-karl-muller
|
||||
type: kubernetes.io/service-account-token
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: svc-jeremy-munsch
|
||||
namespace: kube-system
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: jeremy-munsch-secret
|
||||
namespace: kube-system
|
||||
annotations:
|
||||
kubernetes.io/service-account.name: svc-jeremy-munsch
|
||||
type: kubernetes.io/service-account-token
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
|
|
@ -76,18 +59,15 @@ roleRef:
|
|||
kind: ClusterRole
|
||||
name: view
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: svc-vincent-bridier
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-noah-lancien
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-karl-muller
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-jeremy-munsch
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-vincent-bridier
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-noah-lancien
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-karl-muller
|
||||
namespace: kube-system
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
|
|
@ -96,40 +76,40 @@ metadata:
|
|||
creationTimestamp: null
|
||||
name: cr-ldc-web-metrics
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services/portforward
|
||||
- services/proxy
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- traefik.io
|
||||
resources:
|
||||
- ingressroutes
|
||||
- ingressroutetcps
|
||||
- ingressrouteudps
|
||||
- middlewares
|
||||
- middlewaretcps
|
||||
- tlsoptions
|
||||
- tlsstores
|
||||
- traefikservices
|
||||
- serverstransports
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services/portforward
|
||||
- services/proxy
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- traefik.io
|
||||
resources:
|
||||
- ingressroutes
|
||||
- ingressroutetcps
|
||||
- ingressrouteudps
|
||||
- middlewares
|
||||
- middlewaretcps
|
||||
- tlsoptions
|
||||
- tlsstores
|
||||
- traefikservices
|
||||
- serverstransports
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
|
|
@ -141,18 +121,15 @@ roleRef:
|
|||
kind: ClusterRole
|
||||
name: cr-ldc-web-metrics
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: svc-vincent-bridier
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-noah-lancien
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-karl-muller
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-jeremy-munsch
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-vincent-bridier
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-noah-lancien
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-karl-muller
|
||||
namespace: kube-system
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
|
|
@ -161,12 +138,12 @@ metadata:
|
|||
creationTimestamp: null
|
||||
name: cr-admin-web-ldc-namespace
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "*"
|
||||
resources:
|
||||
- "*"
|
||||
verbs:
|
||||
- "*"
|
||||
- apiGroups:
|
||||
- "*"
|
||||
resources:
|
||||
- "*"
|
||||
verbs:
|
||||
- "*"
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
|
|
@ -175,18 +152,15 @@ metadata:
|
|||
name: rb-admin-web-ldc-namespace-review
|
||||
namespace: review
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: svc-vincent-bridier
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-noah-lancien
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-karl-muller
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-jeremy-munsch
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-vincent-bridier
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-noah-lancien
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-karl-muller
|
||||
namespace: kube-system
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: cr-admin-web-ldc-namespace
|
||||
|
|
@ -199,18 +173,15 @@ metadata:
|
|||
name: rb-admin-web-ldc-namespace-staging
|
||||
namespace: staging
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: svc-vincent-bridier
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-noah-lancien
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-karl-muller
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-jeremy-munsch
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-vincent-bridier
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-noah-lancien
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-karl-muller
|
||||
namespace: kube-system
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: cr-admin-web-ldc-namespace
|
||||
|
|
@ -223,18 +194,15 @@ metadata:
|
|||
name: rb-admin-web-ldc-namespace-production
|
||||
namespace: production
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: svc-vincent-bridier
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-noah-lancien
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-karl-muller
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-jeremy-munsch
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-vincent-bridier
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-noah-lancien
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-karl-muller
|
||||
namespace: kube-system
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: cr-admin-web-ldc-namespace
|
||||
|
|
@ -247,18 +215,9 @@ metadata:
|
|||
name: rb-admin-web-ldc-namespace-common-services
|
||||
namespace: common-services
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: svc-vincent-bridier
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-noah-lancien
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-karl-muller
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-jeremy-munsch
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-vincent-bridier
|
||||
namespace: kube-system
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: cr-admin-web-ldc-namespace
|
||||
|
|
|
|||
30
infrastructure/mariadb/helm-release.yaml
Normal file
30
infrastructure/mariadb/helm-release.yaml
Normal file
|
|
@ -0,0 +1,30 @@
|
|||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: mariadb
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1m0s
|
||||
chart:
|
||||
spec:
|
||||
chart: mariadb
|
||||
version: 18.2.4
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: bitnami
|
||||
namespace: common-services
|
||||
values:
|
||||
|
||||
image:
|
||||
tag: 11.3.2-debian-12-r6
|
||||
|
||||
auth:
|
||||
existingSecret: mariadb-credentials
|
||||
|
||||
primary:
|
||||
persistence:
|
||||
storageClass: "csi-cinder-high-speed"
|
||||
size: 60Gi
|
||||
|
||||
resourcesPreset: "${MARIADB_RESOURCES_REQUEST}"
|
||||
|
|
@ -1,9 +1,10 @@
|
|||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: bitnami
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1h0m0s
|
||||
url: oci://registry-1.docker.io/bitnamicharts
|
||||
type: "oci"
|
||||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: bitnami
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1h0m0s
|
||||
url: oci://registry-1.docker.io/bitnamicharts
|
||||
type: "oci"
|
||||
|
|
@ -1,117 +0,0 @@
|
|||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: netdata
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1m0s
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: netdata
|
||||
version: 3.7.158
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: netdata
|
||||
namespace: common-services
|
||||
|
||||
# Injecte APIKEY depuis un Secret (pas en clair dans Git)
|
||||
valuesFrom:
|
||||
- kind: Secret
|
||||
name: netdata-stream
|
||||
valuesKey: APIKEY
|
||||
targetPath: APIKEY
|
||||
|
||||
values:
|
||||
image:
|
||||
tag: v2.8.5
|
||||
|
||||
# Service interne uniquement
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 19999
|
||||
|
||||
# Pas d'exposition
|
||||
ingress:
|
||||
enabled: false
|
||||
|
||||
# Pas d'auto-update des pods en prod critique
|
||||
restarter:
|
||||
enabled: false
|
||||
|
||||
# Parent = point de centralisation + health/alerting (par défaut chart)
|
||||
parent:
|
||||
enabled: true
|
||||
port: 19999
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: "${NETDATA_PARENT_REQUESTS_CPU}"
|
||||
memory: "${NETDATA_PARENT_REQUESTS_RAM}"
|
||||
limits:
|
||||
cpu: "${NETDATA_PARENT_LIMITS_CPU}"
|
||||
memory: "${NETDATA_PARENT_LIMITS_RAM}"
|
||||
|
||||
# PV parent recommandés (db + alarms)
|
||||
database:
|
||||
persistence: true
|
||||
volumesize: 40Gi # /var/cache/netdata
|
||||
alarms:
|
||||
persistence: true
|
||||
volumesize: 4Gi # /var/lib/netdata
|
||||
|
||||
# Claiming via Secret envFrom
|
||||
claiming:
|
||||
enabled: true
|
||||
token: ""
|
||||
rooms: ""
|
||||
url: "https://api.netdata.cloud"
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: netdata-claim
|
||||
|
||||
# Child DaemonSet
|
||||
child:
|
||||
enabled: true
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: "${NETDATA_CHILD_REQUESTS_CPU}"
|
||||
memory: "${NETDATA_CHILD_REQUESTS_RAM}"
|
||||
limits:
|
||||
cpu: "${NETDATA_CHILD_LIMITS_CPU}"
|
||||
memory: "${NETDATA_CHILD_LIMITS_RAM}"
|
||||
|
||||
persistence:
|
||||
enabled: true
|
||||
hostPath: /var/lib/netdata-k8s-child
|
||||
|
||||
# Hardening UI sur les nodes: bind localhost uniquement
|
||||
configs:
|
||||
netdata:
|
||||
enabled: true
|
||||
path: /etc/netdata/netdata.conf
|
||||
data: |
|
||||
[db]
|
||||
mode = ram
|
||||
retention = "${NETDATA_CHILD_RETENTION}"
|
||||
update every = "${NETDATA_CHILD_COLLECT_INTERVAL}"
|
||||
[web]
|
||||
bind to = localhost:19999
|
||||
[health]
|
||||
enabled = no
|
||||
[ml]
|
||||
enabled = no
|
||||
|
||||
# Claiming via Secret envFrom (token PAS en clair ici)
|
||||
claiming:
|
||||
enabled: true
|
||||
token: ""
|
||||
rooms: ""
|
||||
url: "https://api.netdata.cloud"
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: netdata-claim
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: netdata
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1h0m0s
|
||||
url: https://netdata.github.io/helmchart/
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- helm-repository.yaml
|
||||
- helm-release.yaml
|
||||
|
|
@ -37,4 +37,4 @@ spec:
|
|||
storageClassName: "csi-cinder-classic"
|
||||
resources:
|
||||
requests:
|
||||
storage: 40Gi
|
||||
storage: 20Gi
|
||||
|
|
|
|||
|
|
@ -1,24 +0,0 @@
|
|||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: rabbitmq
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1m0s
|
||||
chart:
|
||||
spec:
|
||||
chart: rabbitmq
|
||||
version: 16.0.3
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: bitnami
|
||||
namespace: common-services
|
||||
values:
|
||||
global:
|
||||
defaultStorageClass: "csi-cinder-high-speed"
|
||||
image:
|
||||
tag: 4.0.1
|
||||
auth:
|
||||
username: rabbitmq
|
||||
existingPasswordSecret: rabbitmq-credentials
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- helm-repository.yaml
|
||||
- helm-release.yaml
|
||||
|
|
@ -15,6 +15,7 @@ spec:
|
|||
name: traefik
|
||||
namespace: common-services
|
||||
values:
|
||||
|
||||
image:
|
||||
tag: v3.3.6
|
||||
|
||||
|
|
@ -28,30 +29,13 @@ spec:
|
|||
- "--entryPoints.web.http.redirections.entryPoint.to=websecure"
|
||||
- "--entrypoints.web.http.redirections.entrypoint.scheme=https"
|
||||
- "--providers.kubernetescrd.allowCrossNamespace=true"
|
||||
- "--entryPoints.web.proxyProtocol.trustedIPs=${OVH_LOAD_BALANCER_EGRESS_IP}/32"
|
||||
- "--entryPoints.websecure.proxyProtocol.trustedIPs=${OVH_LOAD_BALANCER_EGRESS_IP}/32"
|
||||
- "--entryPoints.websecure.forwardedHeaders.trustedIPs=${OVH_LOAD_BALANCER_EGRESS_IP}/32"
|
||||
- "--entryPoints.web.proxyProtocol.trustedIPs=${TRAEFIK_LOAD_BALANCER_IP}/32,10.124.0.0/16"
|
||||
- "--entryPoints.websecure.proxyProtocol.trustedIPs=${TRAEFIK_LOAD_BALANCER_IP}/32,10.124.0.0/16"
|
||||
- "--entryPoints.websecure.forwardedHeaders.trustedIPs=${TRAEFIK_LOAD_BALANCER_IP}/32"
|
||||
- "--entryPoints.mariadb.proxyProtocol.trustedIPs=${TRAEFIK_LOAD_BALANCER_IP},10.124.0.0/16"
|
||||
|
||||
additionalArguments:
|
||||
#- "--log.level=DEBUG"
|
||||
- "--entrypoints.web.http.middlewares=common-services-crowdsec-bouncer@kubernetescrd"
|
||||
- "--entrypoints.websecure.http.middlewares=common-services-crowdsec-bouncer@kubernetescrd"
|
||||
|
||||
deployment:
|
||||
replicas: 2
|
||||
|
||||
podDisruptionBudget:
|
||||
enabled: true
|
||||
minAvailable: 1
|
||||
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: traefik
|
||||
app.kubernetes.io/instance: traefik-common-services
|
||||
topologyKey: kubernetes.io/hostname
|
||||
- "--log.level=DEBUG"
|
||||
|
||||
ports:
|
||||
traefik:
|
||||
|
|
@ -77,6 +61,11 @@ spec:
|
|||
expose:
|
||||
default: false
|
||||
protocol: TCP
|
||||
mariadb:
|
||||
port: 54322
|
||||
expose:
|
||||
default: true
|
||||
protocol: TCP
|
||||
|
||||
providers:
|
||||
kubernetesCRD:
|
||||
|
|
@ -85,28 +74,13 @@ spec:
|
|||
kubernetesIngress:
|
||||
enabled: true
|
||||
|
||||
experimental:
|
||||
plugins:
|
||||
bouncer:
|
||||
moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
|
||||
version: v1.4.5
|
||||
|
||||
volumes:
|
||||
- name: crowdsec-lapi-secret
|
||||
mountPath: /etc/traefik/crowdsec
|
||||
type: secret
|
||||
secretName: crowdsec-lapi-secret
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
type: LoadBalancer
|
||||
annotations:
|
||||
loadbalancer.ovhcloud.com/class: "octavia"
|
||||
loadbalancer.openstack.org/proxy-protocol: "v2"
|
||||
loadbalancer.openstack.org/keep-floatingip: "true"
|
||||
# Protection Flux : empêche la suppression accidentelle
|
||||
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||
service.beta.kubernetes.io/ovh-loadbalancer-proxy-protocol: v2
|
||||
spec:
|
||||
loadBalancerIP: "${TRAEFIK_LOAD_BALANCER_IP}"
|
||||
externalTrafficPolicy: Local
|
||||
|
||||
ingressRoute:
|
||||
|
|
@ -114,29 +88,7 @@ spec:
|
|||
enabled: true
|
||||
|
||||
extraObjects:
|
||||
- apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: crowdsec-bouncer
|
||||
namespace: common-services
|
||||
spec:
|
||||
plugin:
|
||||
bouncer:
|
||||
forwardedHeadersTrustedIps: "${OVH_LOAD_BALANCER_EGRESS_IP}/32"
|
||||
enabled: true
|
||||
crowdsecMode: stream
|
||||
crowdsecLapiScheme: http
|
||||
crowdsecLapiHost: crowdsec-service.common-services.svc.cluster.local:8080
|
||||
crowdsecLapiPath: /
|
||||
crowdsecLapiKeyFile: /etc/traefik/crowdsec/BOUNCER_KEY_traefik
|
||||
crowdsecAppsecEnabled: true
|
||||
crowdsecAppsecHost: crowdsec-appsec-service.common-services.svc.cluster.local:7422
|
||||
crowdsecAppsecPath: /
|
||||
crowdsecAppsecFailureBlock: true
|
||||
crowdsecAppsecUnreachableBlock: true
|
||||
crowdsecAppsecBodyLimit: 10485760
|
||||
|
||||
- apiVersion: traefik.io/v1alpha1 # Redirect www URLs to their no-www equivalent
|
||||
- apiVersion: traefik.io/v1alpha1 # Redirect www URLs to their no-www equivalent
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: redirect-www-to-no-www
|
||||
|
|
@ -151,7 +103,7 @@ spec:
|
|||
# How to modify the URL to have the new target URL
|
||||
replacement: "https://${1}"
|
||||
|
||||
- apiVersion: traefik.io/v1alpha1 # Redirect www URLs to their no-www equivalent
|
||||
- apiVersion: traefik.io/v1alpha1 # Redirect www URLs to their no-www equivalent
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: redirect-www-to-no-www
|
||||
|
|
@ -166,7 +118,7 @@ spec:
|
|||
# How to modify the URL to have the new target URL
|
||||
replacement: "https://${1}"
|
||||
|
||||
- apiVersion: traefik.io/v1alpha1 # Redirect www URLs to their no-www equivalent
|
||||
- apiVersion: traefik.io/v1alpha1 # Redirect www URLs to their no-www equivalent
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: redirect-www-to-no-www
|
||||
|
|
@ -181,7 +133,7 @@ spec:
|
|||
# How to modify the URL to have the new target URL
|
||||
replacement: "https://${1}"
|
||||
|
||||
- apiVersion: traefik.io/v1alpha1 # Redirect www URLs to their no-www equivalent
|
||||
- apiVersion: traefik.io/v1alpha1 # Redirect www URLs to their no-www equivalent
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: redirect-www-to-no-www
|
||||
|
|
@ -198,7 +150,7 @@ spec:
|
|||
|
||||
# Redirection to www for common-services namespace
|
||||
# TODO: remove this middleware when all sites been updated
|
||||
- apiVersion: traefik.io/v1alpha1 # Redirect no-www URLs to their www equivalent
|
||||
- apiVersion: traefik.io/v1alpha1 # Redirect no-www URLs to their www equivalent
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: redirect-no-www-to-www
|
||||
|
|
@ -214,7 +166,7 @@ spec:
|
|||
replacement: "https://www.${1}"
|
||||
|
||||
# Redirection to www for production namespace
|
||||
- apiVersion: traefik.io/v1alpha1 # Redirect no-www URLs to their www equivalent
|
||||
- apiVersion: traefik.io/v1alpha1 # Redirect no-www URLs to their www equivalent
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: redirect-no-www-to-www
|
||||
|
|
@ -230,7 +182,7 @@ spec:
|
|||
replacement: "https://www.${1}"
|
||||
|
||||
# Redirection from www to domain for staging
|
||||
- apiVersion: traefik.io/v1alpha1 # Redirect no-www URLs to their www equivalent
|
||||
- apiVersion: traefik.io/v1alpha1 # Redirect no-www URLs to their www equivalent
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: redirect-no-www-to-www
|
||||
|
|
@ -245,7 +197,7 @@ spec:
|
|||
replacement: "https://${1}"
|
||||
|
||||
# Redirection from www to domain for review
|
||||
- apiVersion: traefik.io/v1alpha1 # Redirect no-www URLs to their www equivalent
|
||||
- apiVersion: traefik.io/v1alpha1 # Redirect no-www URLs to their www equivalent
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: redirect-no-www-to-www
|
||||
|
|
@ -290,6 +242,24 @@ spec:
|
|||
customResponseHeaders:
|
||||
Cross-Origin-Opener-Policy: "same-origin"
|
||||
|
||||
- apiVersion: traefik.io/v1alpha1
|
||||
kind: MiddlewareTCP
|
||||
metadata:
|
||||
name: ipwhitelist-acces-mariadb
|
||||
namespace: common-services
|
||||
spec:
|
||||
ipAllowList:
|
||||
sourceRange:
|
||||
- 46.18.126.208/28 # LDC
|
||||
- 62.193.56.48/32 # OPENevents - Bureau Neuville
|
||||
- 80.15.14.76/32 # LDC web - Box externe
|
||||
- 86.65.205.240/28 # LDC
|
||||
- 135.125.42.176/28 # LDC
|
||||
- 149.202.23.64/26 # LDC
|
||||
- 151.80.95.176/28 # LDC
|
||||
- 217.15.92.64/28 # LDC
|
||||
- 10.124.0.0/16 # Kubernetes internal resources
|
||||
|
||||
- apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
|
|
@ -298,184 +268,57 @@ spec:
|
|||
spec:
|
||||
ipAllowList:
|
||||
sourceRange:
|
||||
- 163.172.132.215 # Proxy Cloud Navigation LDC
|
||||
- 51.159.133.41 # Proxy Cloud Navigation LDC
|
||||
- 51.159.82.143 # Proxy Cloud Navigation LDC
|
||||
- 135.125.42.187 # Proxy Cloud Navigation LDC
|
||||
- 37.64.103.132 # Willow Creation
|
||||
- 88.86.232.178 # Cafel
|
||||
- 57.128.69.87 # K8S Node 1
|
||||
- 57.128.110.168 # K8S Node 2
|
||||
- 57.128.111.33 # K8S Node 3
|
||||
- 54.38.0.22 # K8S Node 4
|
||||
- 57.128.71.23 # K8S Node 5
|
||||
- 51.68.88.158/32 # prod-k8s-ldc-web-nopreempt-node-796d8b
|
||||
- 51.68.92.100/32 # prod-k8s-ldc-web-nopreempt-node-8f841b
|
||||
- 51.68.92.60/32 # prod-k8s-ldc-web-nopreempt-node-399aa9
|
||||
- 51.68.87.150/32 # prod-k8s-ldc-web-nopreempt-node-b5417b
|
||||
- 51.68.90.203/32 # prod-k8s-ldc-web-nopreempt-node-e3ac48
|
||||
- 137.74.211.112/32 # dev-test-k8s-ldc-web-nopreempt-node-17257c
|
||||
- 146.59.240.51/32 # dev-test-k8s-ldc-web-nopreempt-node-54e828
|
||||
- 146.59.241.151/32 # dev-test-k8s-ldc-web-nopreempt-node-93017a
|
||||
- 46.18.126.208/28 # LDC
|
||||
- 62.193.56.48/32 # OPENevents - Bureau Neuville
|
||||
- 80.15.14.76/32 # LDC web - Box externe
|
||||
- 86.65.205.240/28 # LDC
|
||||
- 135.125.42.176/28 # LDC
|
||||
- 149.202.23.64/26 # LDC
|
||||
- 151.80.95.176/28 # LDC
|
||||
- 217.15.92.64/28 # LDC
|
||||
- 3.77.67.4 # UptimeRobot
|
||||
- 3.79.134.69 # UptimeRobot
|
||||
- 18.192.166.72 # UptimeRobot
|
||||
- 18.193.252.127 # UptimeRobot
|
||||
- 52.28.162.93 # UptimeRobot
|
||||
- 52.59.43.236 # UptimeRobot
|
||||
- 63.178.84.147 # UptimeRobot
|
||||
- 24.144.78.39 # UptimeRobot
|
||||
- 24.144.78.185 # UptimeRobot
|
||||
- 64.225.81.248 # UptimeRobot
|
||||
- 64.225.82.147 # UptimeRobot
|
||||
- 143.198.249.237 # UptimeRobot
|
||||
- 143.198.250.89 # UptimeRobot
|
||||
- 143.244.196.21 # UptimeRobot
|
||||
- 143.244.196.211 # UptimeRobot
|
||||
- 152.42.149.135 # UptimeRobot
|
||||
- 159.223.243.219 # UptimeRobot
|
||||
- 161.35.247.201 # UptimeRobot
|
||||
- 167.99.18.52 # UptimeRobot
|
||||
- 188.166.201.79 # UptimeRobot
|
||||
- 206.189.241.133 # UptimeRobot
|
||||
- 209.38.53.7 # UptimeRobot
|
||||
- 49.13.24.81 # UptimeRobot
|
||||
- 49.13.130.29 # UptimeRobot
|
||||
- 49.13.134.145 # UptimeRobot
|
||||
- 78.47.98.55 # UptimeRobot
|
||||
- 88.99.80.227 # UptimeRobot
|
||||
- 142.132.180.39 # UptimeRobot
|
||||
- 157.90.155.240 # UptimeRobot
|
||||
- 157.90.156.63 # UptimeRobot
|
||||
- 168.119.53.160 # UptimeRobot
|
||||
- 168.119.96.239 # UptimeRobot
|
||||
- 49.13.164.148 # UptimeRobot
|
||||
- 49.13.167.123 # UptimeRobot
|
||||
- 78.46.190.63 # UptimeRobot
|
||||
- 78.47.173.76 # UptimeRobot
|
||||
- 128.140.41.193 # UptimeRobot
|
||||
- 128.140.106.114 # UptimeRobot
|
||||
- 159.69.158.189 # UptimeRobot
|
||||
- 167.235.143.113 # UptimeRobot
|
||||
- 168.119.123.75 # UptimeRobot
|
||||
- 78.46.215.1 # UptimeRobot
|
||||
- 91.99.101.207 # UptimeRobot
|
||||
- 46.224.188.186 # BugSmash
|
||||
- 178.156.178.124 # BugSmash
|
||||
- 5.161.29.18 # BugSmash
|
||||
|
||||
# AJOUT : Service Octavia en parallèle
|
||||
- apiVersion: v1
|
||||
kind: Service
|
||||
- apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRouteTCP
|
||||
metadata:
|
||||
name: traefik-octavia
|
||||
namespace: common-services
|
||||
annotations:
|
||||
loadbalancer.ovhcloud.com/class: "octavia"
|
||||
loadbalancer.openstack.org/proxy-protocol: "v2"
|
||||
loadbalancer.openstack.org/keep-floatingip: "true"
|
||||
# Protection Flux : empêche la suppression accidentelle
|
||||
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
externalTrafficPolicy: Local
|
||||
loadBalancerIP: "${TRAEFIK_LOAD_BALANCER_IP_OCTAVIA}"
|
||||
selector:
|
||||
app.kubernetes.io/name: traefik
|
||||
app.kubernetes.io/instance: traefik-common-services
|
||||
ports:
|
||||
- name: web
|
||||
port: 80
|
||||
targetPort: 8000
|
||||
protocol: TCP
|
||||
- name: websecure
|
||||
port: 443
|
||||
targetPort: 8443
|
||||
protocol: TCP
|
||||
|
||||
- apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: blackhole
|
||||
name: mariadb-ingressroutetcp
|
||||
namespace: common-services
|
||||
spec:
|
||||
# Placeholder : jamais contacté, le middleware renvoie 403 avant.
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: 80
|
||||
|
||||
entryPoints:
|
||||
- mariadb
|
||||
routes:
|
||||
- match: HostSNI(`*`) # Hostname to match
|
||||
middlewares:
|
||||
- name: ipwhitelist-acces-mariadb
|
||||
namespace: common-services
|
||||
services:
|
||||
- name: mariadb
|
||||
port: 3306
|
||||
- apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: deny-ip-blocklist
|
||||
name: re7sweb-ipallowlist
|
||||
namespace: common-services
|
||||
spec:
|
||||
# ipAllowList rejette en 403
|
||||
ipAllowList:
|
||||
sourceRange:
|
||||
- 192.0.2.1/32 # TEST-NET-1 (RFC 5737) : ne matche aucun client réel => deny
|
||||
|
||||
- 46.18.126.208/28 # LDC
|
||||
- 62.193.56.48/32 # OPENevents - Bureau Neuville
|
||||
- 80.15.14.76/32 # LDC web - Box externe
|
||||
- 86.65.205.240/28 # LDC
|
||||
- 135.125.42.176/28 # LDC
|
||||
- 149.202.23.64/26 # LDC
|
||||
- 151.80.95.176/28 # LDC
|
||||
- 217.15.92.64/28 # LDC
|
||||
- apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: security-ip-blocklist
|
||||
name: re7sweb-wildcard
|
||||
namespace: common-services
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- kind: Rule
|
||||
match: >-
|
||||
ClientIP(`45.88.138.45/32`) ||
|
||||
ClientIP(`8.34.210.32/32`) ||
|
||||
ClientIP(`8.34.210.37/32`) ||
|
||||
ClientIP(`8.34.210.42/32`) ||
|
||||
ClientIP(`8.34.210.43/32`) ||
|
||||
ClientIP(`8.34.210.45/32`) ||
|
||||
ClientIP(`34.68.34.65/32`) ||
|
||||
ClientIP(`34.68.34.66/32`) ||
|
||||
ClientIP(`34.68.34.67/32`) ||
|
||||
ClientIP(`34.68.34.69/32`) ||
|
||||
ClientIP(`34.68.34.71/32`) ||
|
||||
ClientIP(`34.68.34.72/32`) ||
|
||||
ClientIP(`34.68.34.77/32`) ||
|
||||
ClientIP(`34.68.34.79/32`) ||
|
||||
ClientIP(`34.68.34.81/32`) ||
|
||||
ClientIP(`34.68.34.84/32`) ||
|
||||
ClientIP(`94.74.106.96/32`) ||
|
||||
ClientIP(`20.220.225.223/32`) ||
|
||||
ClientIP(`52.182.173.140/32`)
|
||||
priority: 100000
|
||||
- match: HostRegexp(`{subdomain:[a-z0-9-]+}.re7-s-web.fr`)
|
||||
kind: Rule
|
||||
middlewares:
|
||||
- name: deny-ip-blocklist
|
||||
namespace: common-services
|
||||
services:
|
||||
- name: blackhole
|
||||
port: 80
|
||||
- name: re7sweb-ipallowlist
|
||||
|
||||
- apiVersion: discovery.k8s.io/v1
|
||||
kind: EndpointSlice
|
||||
metadata:
|
||||
name: blackhole
|
||||
namespace: common-services
|
||||
labels:
|
||||
kubernetes.io/service-name: blackhole
|
||||
addressType: IPv4
|
||||
endpoints:
|
||||
- addresses:
|
||||
- 192.0.2.1 # TEST-NET-1 : non-routable, jamais contacté
|
||||
conditions:
|
||||
ready: true
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
protocol: TCP
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue