forge-joniko/ldc-cluster-k8s
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Compare commits

base: forge-joniko:master
Branches Tags
forge-joniko:master
forge-joniko:fix-crow-sec-fqdn
forge-joniko:deploy/staging
forge-joniko:develop
forge-joniko:deploy/production
forge-joniko:vbridier-remove-old-iolb
forge-joniko:vbridier-remove-mariadb
forge-joniko:re7-middleware
forge-joniko:migrate-database
..
compare: forge-joniko:vbridier-remove-mariadb
Branches Tags
forge-joniko:fix-crow-sec-fqdn
forge-joniko:deploy/staging
forge-joniko:develop
forge-joniko:master
forge-joniko:deploy/production
forge-joniko:vbridier-remove-old-iolb
forge-joniko:vbridier-remove-mariadb
forge-joniko:re7-middleware
forge-joniko:migrate-database

1 commit
master ... vbridier-r

Author SHA1 Message Date
Vincent BRIDIER
8f7d84bfbf feat: Remove MariaDB from common-services 2026-07-07 14:31:58 +02:00
11 changed files with 9 additions and 251 deletions
Show stats Expand all files Collapse all files

5
.gitlab/agents/prod-k8s-ldc-web/config.yaml
View file

@ -2,7 +2,6 @@ ci_access:
projects:
- id: ldc-web/projets/agis
- id: ldc-web/projets/auguste-lambert
- id: ldc-web/projets/bien-etre-animal
- id: ldc-web/projets/boutique-cnc-sable
- id: ldc-web/projets/boutique-jeusselin
- id: ldc-web/projets/cailles-robin
@ -13,10 +12,8 @@ ci_access:
- id: ldc-web/projets/doux
- id: ldc-web/projets/espri-restauration
- id: ldc-web/projets/galina
- id: ldc-web/projets/gen-game-web-instances/auguste-lambert
- id: ldc-web/projets/gen-game-web-instances/janze
- id: ldc-web/projets/gen-game-web-instances/l-orleanais-jeu
- id: ldc-web/projets/gen-game-web-instances/le-gaulois-eveillez-vos-papilles
- id: ldc-web/projets/gen-game-web-instances/le-gaulois-tdf-2024
- id: ldc-web/projets/gen-game-web-instances/le-gaulois-chequier-40-2025
- id: ldc-web/projets/gen-game-web-instances/le-gaulois-op-brasserie-2025
@ -30,7 +27,6 @@ ci_access:
- id: ldc-web/projets/gen-game-web-prize-draw
- id: ldc-web/projets/id-halal
- id: ldc-web/projets/jeusselin
- id: ldc-web/projets/ker-chant
- id: ldc-web/projets/l-hours
- id: ldc-web/projets/la-boutique-du-canard
- id: ldc-web/projets/la-toque-angevine
@ -59,7 +55,6 @@ ci_access:
- id: ldc-web/projets/parc-auto
- id: ldc-web/projets/poule-et-toque
- id: ldc-web/projets/prims
- id: ldc-web/projets/qualimaine
- id: ldc-web/projets/qrcollector/qrcollector-back
- id: ldc-web/projets/regalette
- id: ldc-web/projets/reghalal

32
flux/kustomizations/crowdsec.yaml
View file

@ -1,32 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: crowdsec
namespace: flux-system
spec:
interval: 1m0s
path: ./infrastructure/crowdsec
prune: false
healthChecks:
- apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
name: crowdsec
namespace: common-services
- apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
name: crowdsec
namespace: common-services
- apiVersion: v1
kind: Pod
name: vault-0
namespace: common-services
dependsOn:
- name: namespaces
namespace: flux-system
- name: external-secrets-resources
namespace: flux-system
sourceRef:
kind: GitRepository
name: flux-system
timeout: 5m

1
flux/kustomizations/kustomization.yaml
View file

@ -14,4 +14,3 @@ resources:
- traefik.yaml
- quickchart.yaml
- netdata.yaml
- crowdsec.yaml

92
infrastructure/crowdsec/helm-release.yaml
View file

@ -1,92 +0,0 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: crowdsec
namespace: common-services
spec:
interval: 5m
chart:
spec:
chart: crowdsec
version: 0.24.0
sourceRef:
kind: HelmRepository
name: crowdsec
namespace: common-services
values:
container_runtime: containerd
image:
tag: v1.7.8
agent:
acquisition:
- namespace: common-services
podName: traefik-*
program: traefik
env:
- name: COLLECTIONS
value: "crowdsecurity/traefik"
secrets:
externalSecret:
name: crowdsec-lapi-secret
csLapiSecretKey: "CS_LAPI_SECRET"
registrationTokenKey: "REGISTRATION_TOKEN"
lapi:
replicas: 2
storeCAPICredentialsInSecret: true
storeLAPICscliCredentialsInSecret: true
persistentVolume:
data:
enabled: false
config:
enabled: false
envFrom:
- secretRef:
name: crowdsec-lapi-secret
config:
config.yaml.local: |
api:
client:
# the log processor will remove delete itself from LAPI when stopping.
unregister_on_exit: true
server:
auto_registration: # Activate if not using TLS for authentication
enabled: true
token: "${CROWDSEC_REGISTRATION_TOKEN}" # /!\ Do not modify this variable (Cluster K8S gitlab var)
allowed_ranges: # /!\ Make sure to adapt to the pod IP ranges used by your cluster
- "127.0.0.1/32"
- "192.168.0.0/16"
- "10.0.0.0/8"
- "172.16.0.0/12"
db_config:
type: mysql
user: ${CROWDSEC_DB_USER}
password: ${CROWDSEC_DB_PWD}
db_name: ${CROWDSEC_DB_NAME}
host: ${DB_HOST}
port: ${DB_PORT}
flush:
bouncers_autodelete:
api_key: 1h
agents_autodelete:
login_password: 6h
cert: 6h
appsec:
enabled: true
acquisitions:
- source: appsec
listen_addr: "0.0.0.0:7422"
path: /
appsec_configs:
- crowdsecurity/appsec-default
- crowdsecurity/crs
labels:
type: appsec
env:
- name: COLLECTIONS
value: "crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-crs crowdsecurity/appsec-generic-rules"

8
infrastructure/crowdsec/helm-repository.yaml
View file

@ -1,8 +0,0 @@
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: crowdsec
namespace: common-services
spec:
interval: 1h0m0s
url: https://crowdsecurity.github.io/helm-charts

5
infrastructure/crowdsec/kustomization.yaml
View file

@ -1,5 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- helm-repository.yaml
- helm-release.yaml

4
infrastructure/gitlab-agent/helm-release.yaml
View file

@ -9,7 +9,7 @@ spec:
chart:
spec:
chart: gitlab-agent
version: 2.29.0
version: 2.20.1
sourceRef:
kind: HelmRepository
name: gitlab-agent
@ -17,7 +17,7 @@ spec:
values:
image:
tag: v19.2.0
tag: v18.5.2
config:
kasAddress: "wss://lab.s-web.fr/-/kubernetes-agent/"

4
infrastructure/gitlab-runner/helm-release.yaml
View file

@ -9,7 +9,7 @@ spec:
chart:
spec:
chart: gitlab-runner
version: 0.91.2
version: 0.82.0
sourceRef:
kind: HelmRepository
name: gitlab-runner
@ -17,7 +17,7 @@ spec:
values:
image:
tag: alpine-v19.2.2
tag: alpine-v18.5.0
gitlabUrl: https://lab.s-web.fr

38
infrastructure/hashicorp-vault/external-secrets/resources/crowdsec.yaml
View file

@ -1,38 +0,0 @@
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: crowdsec-lapi-secret
namespace: common-services
spec:
refreshInterval: 15s
secretStoreRef:
name: vault-secret-store
kind: ClusterSecretStore
target:
name: crowdsec-lapi-secret
creationPolicy: Owner
data:
- secretKey: CS_LAPI_SECRET
remoteRef:
key: secret/data/crowdsec/lapi
property: CS_LAPI_SECRET
- secretKey: REGISTRATION_TOKEN
remoteRef:
key: secret/data/crowdsec/lapi
property: REGISTRATION_TOKEN
- secretKey: ENROLL_KEY
remoteRef:
key: secret/data/crowdsec/lapi
property: ENROLL_KEY
- secretKey: ENROLL_INSTANCE_NAME
remoteRef:
key: secret/data/crowdsec/lapi
property: ENROLL_INSTANCE_NAME
- secretKey: ENROLL_TAGS
remoteRef:
key: secret/data/crowdsec/lapi
property: ENROLL_TAGS
- secretKey: BOUNCER_KEY_traefik
remoteRef:
key: secret/data/crowdsec/lapi
property: BOUNCER_KEY_traefik

3
infrastructure/hashicorp-vault/external-secrets/resources/kustomization.yaml
View file

@ -12,5 +12,4 @@ resources:
- staging.yaml
- production.yaml
- rabbitmq.yaml
- netdata.yaml
- crowdsec.yaml
- netdata.yaml

68
infrastructure/traefik/helm-release.yaml
View file

@ -33,9 +33,7 @@ spec:
- "--entryPoints.websecure.forwardedHeaders.trustedIPs=${OVH_LOAD_BALANCER_EGRESS_IP}/32"
additionalArguments:
#- "--log.level=DEBUG"
- "--entrypoints.web.http.middlewares=common-services-crowdsec-bouncer@kubernetescrd"
- "--entrypoints.websecure.http.middlewares=common-services-crowdsec-bouncer@kubernetescrd"
- "--log.level=DEBUG"
deployment:
replicas: 2
@ -85,28 +83,13 @@ spec:
kubernetesIngress:
enabled: true
experimental:
plugins:
bouncer:
moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
version: v1.4.5
volumes:
- name: crowdsec-lapi-secret
mountPath: /etc/traefik/crowdsec
type: secret
secretName: crowdsec-lapi-secret
service:
enabled: true
type: LoadBalancer
annotations:
loadbalancer.ovhcloud.com/class: "octavia"
loadbalancer.openstack.org/proxy-protocol: "v2"
loadbalancer.openstack.org/keep-floatingip: "true"
# Protection Flux : empêche la suppression accidentelle
kustomize.toolkit.fluxcd.io/prune: disabled
service.beta.kubernetes.io/ovh-loadbalancer-proxy-protocol: v2
spec:
loadBalancerIP: "${TRAEFIK_LOAD_BALANCER_IP}"
externalTrafficPolicy: Local
ingressRoute:
@ -114,28 +97,6 @@ spec:
enabled: true
extraObjects:
- apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: crowdsec-bouncer
namespace: common-services
spec:
plugin:
bouncer:
forwardedHeadersTrustedIps: "${OVH_LOAD_BALANCER_EGRESS_IP}/32"
enabled: true
crowdsecMode: stream
crowdsecLapiScheme: http
crowdsecLapiHost: crowdsec-service.common-services.svc.cluster.local:8080
crowdsecLapiPath: /
crowdsecLapiKeyFile: /etc/traefik/crowdsec/BOUNCER_KEY_traefik
crowdsecAppsecEnabled: true
crowdsecAppsecHost: crowdsec-appsec-service.common-services.svc.cluster.local:7422
crowdsecAppsecPath: /
crowdsecAppsecFailureBlock: true
crowdsecAppsecUnreachableBlock: true
crowdsecAppsecBodyLimit: 10485760
- apiVersion: traefik.io/v1alpha1 # Redirect www URLs to their no-www equivalent
kind: Middleware
metadata:
@ -367,9 +328,6 @@ spec:
- 168.119.123.75 # UptimeRobot
- 78.46.215.1 # UptimeRobot
- 91.99.101.207 # UptimeRobot
- 46.224.188.186 # BugSmash
- 178.156.178.124 # BugSmash
- 5.161.29.18 # BugSmash
# AJOUT : Service Octavia en parallèle
- apiVersion: v1
@ -435,25 +393,7 @@ spec:
routes:
- kind: Rule
match: >-
ClientIP(`45.88.138.45/32`) ||
ClientIP(`8.34.210.32/32`) ||
ClientIP(`8.34.210.37/32`) ||
ClientIP(`8.34.210.42/32`) ||
ClientIP(`8.34.210.43/32`) ||
ClientIP(`8.34.210.45/32`) ||
ClientIP(`34.68.34.65/32`) ||
ClientIP(`34.68.34.66/32`) ||
ClientIP(`34.68.34.67/32`) ||
ClientIP(`34.68.34.69/32`) ||
ClientIP(`34.68.34.71/32`) ||
ClientIP(`34.68.34.72/32`) ||
ClientIP(`34.68.34.77/32`) ||
ClientIP(`34.68.34.79/32`) ||
ClientIP(`34.68.34.81/32`) ||
ClientIP(`34.68.34.84/32`) ||
ClientIP(`94.74.106.96/32`) ||
ClientIP(`20.220.225.223/32`) ||
ClientIP(`52.182.173.140/32`)
ClientIP(`45.88.138.45/32`)
priority: 100000
middlewares:
- name: deny-ip-blocklist