Merge branch 'develop' into 'master'

Added gen-game-web-instances/auguste-lambert to gitlab agents

See merge request ldc-web/cluster-k8s!133

.gitlab-ci.yml

@@ -28,7 +28,7 @@ variables:
       git config user.email "autodeploy@mediactivegroup.com"
       git add --all
       git commit -m "Bot Auto Commit"
-      git push --force https://flux-token-api:${GITLAB_ACCESS_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git HEAD:${DEPLOY_BRANCH}
+      git push --force https://project_access_token:${GITLAB_ACCESS_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git HEAD:${DEPLOY_BRANCH}
   tags:
     - flux
     - k8s

.gitlab/agents/dev-k8s-ldc-web/config.yaml

@@ -8,6 +8,7 @@ ci_access:
     - id: ldc-web/projets/galina
     - id: ldc-web/projets/gen-game-web-instances/janze
     - id: ldc-web/projets/gen-game-web-instances/l-orleanais-jeu
+    - id: ldc-web/projets/gen-game-web-instances/le-gaulois-chequier-40-2025
     - id: ldc-web/projets/gen-game-web-instances/le-gaulois-tdf-2024
     - id: ldc-web/projets/gen-game-web-instances/normandie
     - id: ldc-web/projets/gen-game-web-instances/reghalal-jeu

.gitlab/agents/prod-k8s-ldc-web/config.yaml

@@ -1,40 +1,66 @@
 ci_access:
   projects:
     - id: ldc-web/projets/agis
+    - id: ldc-web/projets/auguste-lambert
+    - id: ldc-web/projets/bien-etre-animal
+    - id: ldc-web/projets/boutique-cnc-sable
+    - id: ldc-web/projets/boutique-jeusselin
+    - id: ldc-web/projets/cailles-robin
+    - id: ldc-web/projets/com-app-bo
     - id: ldc-web/projets/crm
     - id: ldc-web/projets/coupe-de-france-de-la-volaille
     - id: ldc-web/projets/domaine-de-lanvaux
     - id: ldc-web/projets/doux
+    - id: ldc-web/projets/espri-restauration
     - id: ldc-web/projets/galina
+    - id: ldc-web/projets/gen-game-web-instances/auguste-lambert
     - id: ldc-web/projets/gen-game-web-instances/janze
     - id: ldc-web/projets/gen-game-web-instances/l-orleanais-jeu
+    - id: ldc-web/projets/gen-game-web-instances/le-gaulois-eveillez-vos-papilles
     - id: ldc-web/projets/gen-game-web-instances/le-gaulois-tdf-2024
+    - id: ldc-web/projets/gen-game-web-instances/le-gaulois-chequier-40-2025
+    - id: ldc-web/projets/gen-game-web-instances/le-gaulois-op-brasserie-2025
+    - id: ldc-web/projets/gen-game-web-instances/le-gaulois-sportif-2025
+    - id: ldc-web/projets/gen-game-web-instances/le-gaulois-sportif-2026
+    - id: ldc-web/projets/gen-game-web-instances/matines-40-ans
+    - id: ldc-web/projets/gen-game-web-instances/nature-and-respect
     - id: ldc-web/projets/gen-game-web-instances/normandie
     - id: ldc-web/projets/gen-game-web-instances/reghalal-jeu
     - id: ldc-web/projets/gen-game-web-instances/tregalette-chandleur-2024
+    - id: ldc-web/projets/gen-game-web-prize-draw
     - id: ldc-web/projets/id-halal
     - id: ldc-web/projets/jeusselin
+    - id: ldc-web/projets/ker-chant
     - id: ldc-web/projets/l-hours
+    - id: ldc-web/projets/la-boutique-du-canard
     - id: ldc-web/projets/la-toque-angevine
+    - id: ldc-web/projets/ldc
     - id: ldc-web/projets/ldc-foods
-    - id: ldc-web/projets/ldc-restauration
-    - id: ldc-web/projets/ldc-web
     - id: ldc-web/projets/le-gaulois
     - id: ldc-web/projets/le-gaulois-pro
+    - id: ldc-web/projets/le-marche-de-beaufeu
     - id: ldc-web/projets/les-fermiers-snv
     - id: ldc-web/projets/lionor
     - id: ldc-web/projets/loue
-    - id: ldc-web/projets/loue-magie-de-noel
+    - id: ldc-web/projets/matomo
+    - id: ldc-web/projets/maitre-coq
+    - id: ldc-web/projets/mairet
+    - id: ldc-web/projets/maison-couthouis
+    - id: ldc-web/projets/marie
+    - id: ldc-web/projets/marie-restauration
     - id: ldc-web/projets/mas-d-auge
     - id: ldc-web/projets/matines
+    - id: ldc-web/projets/medina
+    - id: ldc-web/projets/mesbr
     - id: ldc-web/projets/nature-and-respect
     - id: ldc-web/projets/nature-eleveurs
     - id: ldc-web/projets/op-insta-instances/le-gaulois
     - id: ldc-web/projets/ovoteam
+    - id: ldc-web/projets/parc-auto
     - id: ldc-web/projets/poule-et-toque
     - id: ldc-web/projets/prims
+    - id: ldc-web/projets/qualimaine
     - id: ldc-web/projets/qrcollector/qrcollector-back
-    - id: ldc-web/projets/qrcollector/qrcollector-front
     - id: ldc-web/projets/regalette
     - id: ldc-web/projets/reghalal
     - id: ldc-web/projets/report
@@ -42,13 +68,12 @@ ci_access:
     - id: ldc-web/projets/sbv
     - id: ldc-web/projets/share-secure-content
     - id: ldc-web/projets/showroom/showroom-bo
-    - id: ldc-web/projets/showroom-bo-instances/drosed
-    - id: ldc-web/projets/showroom-bo-instances/maitre-coq
-    - id: ldc-web/projets/showroom-bo-instances/nature-and-respect
-    - id: ldc-web/projets/store-ldc
     - id: ldc-web/projets/support-web
+    - id: ldc-web/projets/traditions-asie
     - id: ldc-web/projets/tregalette
-    - id: ldc-web/projets/vdme
+    - id: ldc-web/projets/uwil-ui
+    - id: ldc-web/projets/volailles-ardeche
+    - id: ldc-web/projets/volailles-challans
     - id: ldc-web/projets/volena
 
 observability:

README.md

@@ -8,7 +8,6 @@
 | FluxCD       | no flux      | 2.3.0      | 2.3.0                | 2.13.0             |
 | Git-agent    | 16.9.3       | 16.9.3     | 17.1.0               | 2.30               |
 | Git-runner   | 16.9.1       | 16.9.1     | 17.0.1               | 0.62.1             |
-| MariaDB      | 10.10        | 1.13.2     | 1.13.2               | 18.2.4             |
 | Prometheus   | 0.60.1       | 0.74.0     | 0.74.0               | 60.2.0             |
 | Traefik      | 2.9.6        | 3.0.2      | 3.0.2                | 28.3.0             |
 | Velero       | 1.10.1       | 1.13.2     | 1.13.2               | 6.7.0              |

flux/kustomizations/cert-manager.yaml

@@ -22,7 +22,7 @@ spec:
       namespace: flux-system
   sourceRef:
     kind: GitRepository
-    name: cluster-k8s
+    name: flux-system
   timeout: 5m
 
 ---
@@ -40,5 +40,5 @@ spec:
       namespace: flux-system  
   sourceRef:
     kind: GitRepository
-    name: cluster-k8s
+    name: flux-system
   timeout: 5m

flux/kustomizations/crowdsec.yaml

@@ -0,0 +1,32 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: crowdsec
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  path: ./infrastructure/crowdsec
+  prune: false
+  healthChecks:
+    - apiVersion: source.toolkit.fluxcd.io/v1
+      kind: HelmRepository
+      name: crowdsec
+      namespace: common-services
+    - apiVersion: helm.toolkit.fluxcd.io/v2
+      kind: HelmRelease
+      name: crowdsec
+      namespace: common-services
+    - apiVersion: v1
+      kind: Pod
+      name: vault-0
+      namespace: common-services
+  dependsOn:
+    - name: namespaces
+      namespace: flux-system
+    - name: external-secrets-resources
+      namespace: flux-system
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  timeout: 5m

flux/kustomizations/flux-resources.yaml

@@ -13,5 +13,5 @@ spec:
       namespace: flux-system
   sourceRef:
     kind: GitRepository
-    name: cluster-k8s
+    name: flux-system
     namespace: flux-system

flux/kustomizations/gitlab-agent.yaml

@@ -13,7 +13,7 @@ spec:
       namespace: flux-system
   sourceRef:
     kind: GitRepository
-    name: cluster-k8s
+    name: flux-system
   healthChecks:
     - apiVersion: source.toolkit.fluxcd.io/v1
       kind: HelmRepository

flux/kustomizations/gitlab-runner.yaml

@@ -13,7 +13,7 @@ spec:
       namespace: flux-system
   sourceRef:
     kind: GitRepository
-    name: cluster-k8s
+    name: flux-system
   healthChecks:
     - apiVersion: source.toolkit.fluxcd.io/v1
       kind: HelmRepository

flux/kustomizations/hashicorp-vault.yaml

@@ -10,7 +10,7 @@ spec:
   prune: false
   sourceRef:
     kind: GitRepository
-    name: cluster-k8s
+    name: flux-system
   dependsOn:
     - name: namespaces
       namespace: flux-system
@@ -40,7 +40,7 @@ spec:
       namespace: flux-system
   sourceRef:
     kind: GitRepository
-    name: cluster-k8s
+    name: flux-system
     namespace: flux-system
   healthChecks:
     - apiVersion: source.toolkit.fluxcd.io/v1
@@ -68,6 +68,6 @@ spec:
       namespace: flux-system
   sourceRef:
     kind: GitRepository
-    name: cluster-k8s
+    name: flux-system
     namespace: flux-system
   timeout: 10m

flux/kustomizations/kustomization.yaml

@@ -1,15 +1,17 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- cert-manager.yaml
+  - cert-manager.yaml
-- flux-resources.yaml
+  - flux-resources.yaml
-- gitlab-agent.yaml
+  - gitlab-agent.yaml
-- gitlab-runner.yaml
+  - gitlab-runner.yaml
-- hashicorp-vault.yaml
+  - hashicorp-vault.yaml
-- ldc-custom.yaml
+  - ldc-custom.yaml
-- mariadb.yaml
+  - meilisearch.yaml
-- meilisearch.yaml
+  - namespaces.yaml
-- namespaces.yaml
+  - prometheus-stack.yaml
-- prometheus-stack.yaml
+  - rabbitmq.yaml
-- traefik.yaml
+  - traefik.yaml
-- quickchart.yaml
+  - quickchart.yaml
+  - netdata.yaml
+  - crowdsec.yaml

flux/kustomizations/ldc-custom.yaml

@@ -10,7 +10,7 @@ spec:
   prune: true
   sourceRef:
     kind: GitRepository
-    name: cluster-k8s
+    name: flux-system
   dependsOn:
     - name: prometheus-stack
       namespace: flux-system

flux/kustomizations/meilisearch.yaml

@@ -22,5 +22,5 @@ spec:
       namespace: flux-system
   sourceRef:
     kind: GitRepository
-    name: cluster-k8s
+    name: flux-system
   timeout: 5m

flux/kustomizations/namespaces.yaml

@@ -13,7 +13,7 @@ spec:
       namespace: flux-system
   sourceRef:
     kind: GitRepository
-    name: cluster-k8s
+    name: flux-system
   healthChecks:
     - apiVersion: v1
       kind: Namespace

flux/kustomizations/netdata.yaml

@@ -2,25 +2,31 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: mariadb
+  name: netdata
   namespace: flux-system
 spec:
-  interval: 30s
+  interval: 1m0s
-  path: ./infrastructure/mariadb
+  path: ./infrastructure/netdata
   prune: false
-  sourceRef:
-    kind: GitRepository
-    name: cluster-k8s
-  dependsOn:
-    - name: external-secrets-resources
-      namespace: flux-system
   healthChecks:
     - apiVersion: source.toolkit.fluxcd.io/v1
       kind: HelmRepository
-      name: bitnami
+      name: netdata
       namespace: common-services
     - apiVersion: helm.toolkit.fluxcd.io/v2
       kind: HelmRelease
-      name: mariadb
+      name: netdata
       namespace: common-services
+    - apiVersion: v1
+      kind: Pod
+      name: vault-0
+      namespace: common-services
+  dependsOn:
+    - name: namespaces
+      namespace: flux-system
+    - name: external-secrets-resources
+      namespace: flux-system
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
   timeout: 5m

flux/kustomizations/prometheus-stack.yaml

@@ -10,7 +10,7 @@ spec:
   prune: false
   sourceRef:
     kind: GitRepository
-    name: cluster-k8s
+    name: flux-system
   dependsOn:
     - name: external-secrets-resources
       namespace: flux-system

flux/kustomizations/quickchart.yaml

@@ -22,5 +22,5 @@ spec:
     namespace: flux-system
   sourceRef:
     kind: GitRepository
-    name: cluster-k8s
+    name: flux-system
   timeout: 5m

flux/kustomizations/rabbitmq.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: rabbitmq
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  path: ./infrastructure/rabbitmq
+  prune: false
+  healthChecks:
+  - apiVersion: source.toolkit.fluxcd.io/v1
+    kind: HelmRepository
+    name: bitnami
+    namespace: common-services
+  - apiVersion: helm.toolkit.fluxcd.io/v2
+    kind: HelmRelease
+    name: rabbitmq
+    namespace: common-services
+  dependsOn:
+  - name: namespaces
+    namespace: flux-system
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  timeout: 5m

flux/kustomizations/traefik.yaml

@@ -22,5 +22,5 @@ spec:
       namespace: flux-system
   sourceRef:
     kind: GitRepository
-    name: cluster-k8s
+    name: flux-system
   timeout: 5m

flux/production/flux-system/gotk-sync.yaml

@@ -3,7 +3,7 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: GitRepository
 metadata:
-  name: cluster-k8s
+  name: flux-system
   namespace: flux-system
 spec:
   interval: 1m0s
@@ -24,4 +24,4 @@ spec:
   prune: true
   sourceRef:
     kind: GitRepository
-    name: cluster-k8s
+    name: flux-system

flux/production/flux.yaml

@@ -9,4 +9,4 @@ spec:
   prune: false
   sourceRef:
     kind: GitRepository
-    name: cluster-k8s
+    name: flux-system

flux/staging/flux-system/gotk-sync.yaml

@@ -3,7 +3,7 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: GitRepository
 metadata:
-  name: cluster-k8s
+  name: flux-system
   namespace: flux-system
 spec:
   interval: 1m0s
@@ -24,4 +24,4 @@ spec:
   prune: true
   sourceRef:
     kind: GitRepository
-    name: cluster-k8s
+    name: flux-system

flux/staging/flux.yaml

@@ -9,4 +9,4 @@ spec:
   prune: false
   sourceRef:
     kind: GitRepository
-    name: cluster-k8s
+    name: flux-system

infrastructure/cert-manager/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: cert-manager
-      version: 1.15.0
+      version: 1.17.2
       sourceRef:
         kind: HelmRepository
         name: cert-manager

infrastructure/cert-manager/resources/certificates.yaml

@@ -8,6 +8,7 @@ spec:
   dnsNames:
     - '*.${REVIEW_DOMAIN_NAME}'
   secretName: wildcard-k8s-ldc
+  revisionHistoryLimit: 1
   issuerRef:
     name: letsencrypt-production-dns01
     kind: ClusterIssuer
@@ -22,6 +23,7 @@ spec:
   dnsNames:
     - '*.${STAGING_DOMAIN_NAME}'
   secretName: wildcard-k8s-ldc
+  revisionHistoryLimit: 1
   issuerRef:
     name: letsencrypt-production-dns01
     kind: ClusterIssuer
@@ -36,6 +38,7 @@ spec:
   dnsNames:
     - '*.${PRODUCTION_DOMAIN_NAME}'
   secretName: wildcard-k8s-ldc
+  revisionHistoryLimit: 1
   issuerRef:
     name: letsencrypt-production-dns01
     kind: ClusterIssuer

infrastructure/crowdsec/helm-release.yaml

@@ -0,0 +1,92 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: crowdsec
+  namespace: common-services
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: crowdsec
+      version: 0.24.0
+      sourceRef:
+        kind: HelmRepository
+        name: crowdsec
+        namespace: common-services
+  values:
+    container_runtime: containerd
+
+    image:
+      tag: v1.7.8
+
+    agent:
+      acquisition:
+        - namespace: common-services
+          podName: traefik-*
+          program: traefik
+      env:
+        - name: COLLECTIONS
+          value: "crowdsecurity/traefik"
+
+    secrets:
+      externalSecret:
+        name: crowdsec-lapi-secret
+        csLapiSecretKey: "CS_LAPI_SECRET"
+        registrationTokenKey: "REGISTRATION_TOKEN"
+
+    lapi:
+      replicas: 2
+      storeCAPICredentialsInSecret: true
+      storeLAPICscliCredentialsInSecret: true
+      persistentVolume:
+        data:
+          enabled: false
+        config:
+          enabled: false
+      envFrom:
+        - secretRef:
+            name: crowdsec-lapi-secret
+
+    config:
+      config.yaml.local: |
+        api:
+          client:
+            # the log processor will remove delete itself from LAPI when stopping.    
+            unregister_on_exit: true
+          server:
+            auto_registration: # Activate if not using TLS for authentication
+              enabled: true
+              token: "${CROWDSEC_REGISTRATION_TOKEN}" # /!\ Do not modify this variable (Cluster K8S gitlab var)
+              allowed_ranges: # /!\ Make sure to adapt to the pod IP ranges used by your cluster
+                - "127.0.0.1/32"
+                - "192.168.0.0/16"
+                - "10.0.0.0/8"
+                - "172.16.0.0/12"
+        db_config:
+          type: mysql
+          user: ${CROWDSEC_DB_USER}
+          password: ${CROWDSEC_DB_PWD}
+          db_name: ${CROWDSEC_DB_NAME}
+          host: ${DB_HOST}
+          port: ${DB_PORT}
+          flush:
+            bouncers_autodelete:
+              api_key: 1h
+            agents_autodelete:
+              login_password: 6h
+              cert: 6h
+
+    appsec:
+      enabled: true
+      acquisitions:
+        - source: appsec
+          listen_addr: "0.0.0.0:7422"
+          path: /
+          appsec_configs:
+            - crowdsecurity/appsec-default
+            - crowdsecurity/crs
+          labels:
+            type: appsec
+      env:
+        - name: COLLECTIONS
+          value: "crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-crs crowdsecurity/appsec-generic-rules"

infrastructure/crowdsec/helm-repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: crowdsec
+  namespace: common-services
+spec:
+  interval: 1h0m0s
+  url: https://crowdsecurity.github.io/helm-charts

infrastructure/gitlab-agent/helm-release.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: gitlab-agent
-      version: 1.24.0
+      version: 2.29.0
       sourceRef:
         kind: HelmRepository
         name: gitlab-agent
@@ -17,7 +17,7 @@ spec:
   values:
 
     image:
-      tag: v16.9.2
+      tag: v19.2.0
 
     config:
       kasAddress: "wss://lab.s-web.fr/-/kubernetes-agent/"

infrastructure/gitlab-runner/helm-release.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: gitlab-runner
-      version: 0.62.1
+      version: 0.91.2
       sourceRef:
         kind: HelmRepository
         name: gitlab-runner
@@ -17,7 +17,7 @@ spec:
   values:
 
     image:
-      tag: alpine-v16.9.1
+      tag: alpine-v19.2.2
 
     gitlabUrl: https://lab.s-web.fr
 

infrastructure/hashicorp-vault/auto-unseal.yaml

@@ -5,27 +5,30 @@ metadata:
   namespace: common-services
 spec:
   schedule: "* * * * *"
+  suspend: false                  # géré explicitement par Git (corrige le drift de suspension manuelle)
   concurrencyPolicy: Forbid
+  startingDeadlineSeconds: 60
   successfulJobsHistoryLimit: 1
-  failedJobsHistoryLimit: 2
+  failedJobsHistoryLimit: 3
   jobTemplate:
     spec:
       backoffLimit: 2
+      activeDeadlineSeconds: 120
       template:
         spec:
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 10001
+            seccompProfile:
+              type: RuntimeDefault
           containers:
             - name: vault-auto-unseal
-              image: registry.s-web.fr/ldc-web/k8s-vault-unseal:1.0.0
+              image: registry.s-web.fr/ldc-web/k8s-vault-unseal:1.1.0
               imagePullPolicy: IfNotPresent
-              command: ["python", "main.py", "-u", "http://vault.common-services:8200", "-t", "${DOLLAR}(VAULT_TOKEN)",
+              command: ["python", "main.py", "-u", "http://vault.common-services:8200"]
-                        "-k", "${DOLLAR}(UNSEAL_KEY_1)", "-k", "${DOLLAR}(UNSEAL_KEY_2)", "-k", "${DOLLAR}(UNSEAL_KEY_3)",
-                        "-k", "${DOLLAR}(UNSEAL_KEY_4)", "-k", "${DOLLAR}(UNSEAL_KEY_5)"]
               env:
-                - name: VAULT_TOKEN
+                - name: PYTHONDONTWRITEBYTECODE
-                  valueFrom:
+                  value: "1"
-                    secretKeyRef:
-                      name: vault-credentials
-                      key: token
                 - name: UNSEAL_KEY_1
                   valueFrom:
                     secretKeyRef:
@@ -51,6 +54,19 @@ spec:
                     secretKeyRef:
                       name: vault-credentials
                       key: unseal_key_5
+              resources:
+                requests:
+                  cpu: 10m
+                  memory: 32Mi
+                limits:
+                  cpu: 100m
+                  memory: 64Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                capabilities:
+                  drop:
+                    - ALL
           imagePullSecrets:
             - name: docker-registry-credentials
           restartPolicy: OnFailure

infrastructure/hashicorp-vault/external-secrets/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: external-secrets
-      version: 0.9.19
+      version: 0.16.1
       sourceRef:
         kind: HelmRepository
         name: external-secrets
@@ -16,4 +16,4 @@ spec:
   values:
 
     image:
-      tag: v0.9.19
+      tag: v0.16.1

infrastructure/hashicorp-vault/external-secrets/resources/crowdsec.yaml

@@ -0,0 +1,38 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: crowdsec-lapi-secret
+  namespace: common-services
+spec:
+  refreshInterval: 15s
+  secretStoreRef:
+    name: vault-secret-store
+    kind: ClusterSecretStore
+  target:
+    name: crowdsec-lapi-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: CS_LAPI_SECRET
+      remoteRef:
+        key: secret/data/crowdsec/lapi
+        property: CS_LAPI_SECRET
+    - secretKey: REGISTRATION_TOKEN
+      remoteRef:
+        key: secret/data/crowdsec/lapi
+        property: REGISTRATION_TOKEN
+    - secretKey: ENROLL_KEY
+      remoteRef:
+        key: secret/data/crowdsec/lapi
+        property: ENROLL_KEY
+    - secretKey: ENROLL_INSTANCE_NAME
+      remoteRef:
+        key: secret/data/crowdsec/lapi
+        property: ENROLL_INSTANCE_NAME
+    - secretKey: ENROLL_TAGS
+      remoteRef:
+        key: secret/data/crowdsec/lapi
+        property: ENROLL_TAGS
+    - secretKey: BOUNCER_KEY_traefik
+      remoteRef:
+        key: secret/data/crowdsec/lapi
+        property: BOUNCER_KEY_traefik

infrastructure/hashicorp-vault/external-secrets/resources/kustomization.yaml

@@ -7,8 +7,10 @@ resources:
   - gitlab-agent.yaml
   - gitlab-runner.yaml
   - hashicorp-vault.yaml
-  - mariadb.yaml
   - prometheus-stack.yaml
   - review.yaml
   - staging.yaml
   - production.yaml
+  - rabbitmq.yaml
+  - netdata.yaml
+  - crowdsec.yaml

infrastructure/hashicorp-vault/external-secrets/resources/mariadb.yaml

@@ -1,28 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: mariadb-credentials
-  namespace: common-services
-spec:
-  refreshInterval: "15s"
-  secretStoreRef:
-    name: vault-secret-store
-    kind: ClusterSecretStore
-  target:
-    name: mariadb-credentials
-    template:
-      engineVersion: v2
-      type: Opaque
-      data:
-        mariadb-password: "{{ .password }}"
-        mariadb-replication-password: "{{ .root_password }}"
-        mariadb-root-password: "{{ .root_password }}"
-  data:
-    - secretKey: root_password
-      remoteRef:
-        key: secret/mariadb
-        property: root_password
-    - secretKey: password
-      remoteRef:
-        key: secret/mariadb
-        property: password

infrastructure/hashicorp-vault/external-secrets/resources/netdata.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: netdata-claim
+  namespace: common-services
+spec:
+  refreshInterval: "15s"
+  secretStoreRef:
+    name: vault-secret-store
+    kind: ClusterSecretStore
+  target:
+    name: netdata-claim
+  data:
+    - secretKey: NETDATA_CLAIM_TOKEN
+      remoteRef:
+        key: secret/netdata/claim
+        property: NETDATA_CLAIM_TOKEN
+    - secretKey: NETDATA_CLAIM_ROOMS
+      remoteRef:
+        key: secret/netdata/claim
+        property: NETDATA_CLAIM_ROOMS
+
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: netdata-stream
+  namespace: common-services
+spec:
+  refreshInterval: "15s"
+  secretStoreRef:
+    name: vault-secret-store
+    kind: ClusterSecretStore
+  target:
+    name: netdata-stream
+  data:
+    - secretKey: APIKEY
+      remoteRef:
+        key: secret/netdata/stream
+        property: APIKEY

infrastructure/hashicorp-vault/external-secrets/resources/rabbitmq.yaml

@@ -0,0 +1,22 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: rabbitmq-credentials
+  namespace: common-services
+spec:
+  refreshInterval: "15s"
+  secretStoreRef:
+    name: vault-secret-store
+    kind: ClusterSecretStore
+  target:
+    name: rabbitmq-credentials
+    template:
+      engineVersion: v2
+      type: Opaque
+      data:
+        rabbitmq-password: "{{ .password }}"
+  data:
+    - secretKey: password
+      remoteRef:
+        key: secret/rabbitmq
+        property: password

infrastructure/hashicorp-vault/helm-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: vault
-      version: 0.28.1
+      version: 0.30.0
       sourceRef:
         kind: HelmRepository
         name: hashicorp
@@ -18,14 +18,11 @@ spec:
     injector:
       metrics:
         enabled: true
-      image:
-        tag: "1.4.2"
-      agentImage:
-        tag: "1.17.2"
     server:
-      image:
-        tag: "1.17.2"
       ingress:
         enabled: false
       livenessProbe:
         enabled: true
+        # Liveness tolérante au seal : un Vault scellé renvoie 200 (sealedcode/uninitcode)
+        # pour ne pas tuer le pod en boucle avant que l'auto-unseal n'agisse.
+        path: "/v1/sys/health?standbyok=true&sealedcode=200&uninitcode=200"

infrastructure/hashicorp-vault/kustomization.yaml

@@ -1,6 +1,6 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
+apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
+kind: Kustomization
-resources:
+resources:
-  - helm-repository.yaml
+  - helm-repository.yaml
-  - helm-release.yaml
+  - helm-release.yaml
-  - auto-unseal.yaml
+  - auto-unseal.yaml

infrastructure/ldc-custom/ldc-web-equipe-rbac.yaml

@@ -49,6 +49,23 @@ metadata:
     kubernetes.io/service-account.name: svc-karl-muller
 type: kubernetes.io/service-account-token
 
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: svc-jeremy-munsch
+  namespace: kube-system
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: jeremy-munsch-secret
+  namespace: kube-system
+  annotations:
+    kubernetes.io/service-account.name: svc-jeremy-munsch
+type: kubernetes.io/service-account-token
+
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -59,15 +76,18 @@ roleRef:
   kind: ClusterRole
   name: view
 subjects:
-- kind: ServiceAccount
+  - kind: ServiceAccount
-  name: svc-vincent-bridier
+    name: svc-vincent-bridier
-  namespace: kube-system
+    namespace: kube-system
-- kind: ServiceAccount
+  - kind: ServiceAccount
-  name: svc-noah-lancien
+    name: svc-noah-lancien
-  namespace: kube-system
+    namespace: kube-system
-- kind: ServiceAccount
+  - kind: ServiceAccount
-  name: svc-karl-muller
+    name: svc-karl-muller
-  namespace: kube-system
+    namespace: kube-system
+  - kind: ServiceAccount
+    name: svc-jeremy-munsch
+    namespace: kube-system
 
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -76,40 +96,40 @@ metadata:
   creationTimestamp: null
   name: cr-ldc-web-metrics
 rules:
-- apiGroups:
+  - apiGroups:
-  - ""
+      - ""
-  resources:
+    resources:
-  - services/portforward
+      - services/portforward
-  - services/proxy
+      - services/proxy
-  verbs:
+    verbs:
-  - create
+      - create
-  - delete
+      - delete
-  - get
+      - get
-  - list
+      - list
-- apiGroups:
+  - apiGroups:
-  - apiextensions.k8s.io
+      - apiextensions.k8s.io
-  resources:
+    resources:
-  - customresourcedefinitions
+      - customresourcedefinitions
-  verbs:
+    verbs:
-  - get
+      - get
-  - list
+      - list
-  - watch
+      - watch
-- apiGroups:
+  - apiGroups:
-  - traefik.io
+      - traefik.io
-  resources:
+    resources:
-  - ingressroutes
+      - ingressroutes
-  - ingressroutetcps
+      - ingressroutetcps
-  - ingressrouteudps
+      - ingressrouteudps
-  - middlewares
+      - middlewares
-  - middlewaretcps
+      - middlewaretcps
-  - tlsoptions
+      - tlsoptions
-  - tlsstores
+      - tlsstores
-  - traefikservices
+      - traefikservices
-  - serverstransports
+      - serverstransports
-  verbs:
+    verbs:
-  - get
+      - get
-  - list
+      - list
-  - watch
+      - watch
 
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -121,15 +141,18 @@ roleRef:
   kind: ClusterRole
   name: cr-ldc-web-metrics
 subjects:
-- kind: ServiceAccount
+  - kind: ServiceAccount
-  name: svc-vincent-bridier
+    name: svc-vincent-bridier
-  namespace: kube-system
+    namespace: kube-system
-- kind: ServiceAccount
+  - kind: ServiceAccount
-  name: svc-noah-lancien
+    name: svc-noah-lancien
-  namespace: kube-system
+    namespace: kube-system
-- kind: ServiceAccount
+  - kind: ServiceAccount
-  name: svc-karl-muller
+    name: svc-karl-muller
-  namespace: kube-system
+    namespace: kube-system
+  - kind: ServiceAccount
+    name: svc-jeremy-munsch
+    namespace: kube-system
 
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -138,12 +161,12 @@ metadata:
   creationTimestamp: null
   name: cr-admin-web-ldc-namespace
 rules:
-- apiGroups:
+  - apiGroups:
-  - "*"
+      - "*"
-  resources:
+    resources:
-  - "*"
+      - "*"
-  verbs:
+    verbs:
-  - "*"
+      - "*"
 
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -152,15 +175,18 @@ metadata:
   name: rb-admin-web-ldc-namespace-review
   namespace: review
 subjects:
-- kind: ServiceAccount
+  - kind: ServiceAccount
-  name: svc-vincent-bridier
+    name: svc-vincent-bridier
-  namespace: kube-system
+    namespace: kube-system
-- kind: ServiceAccount
+  - kind: ServiceAccount
-  name: svc-noah-lancien
+    name: svc-noah-lancien
-  namespace: kube-system
+    namespace: kube-system
-- kind: ServiceAccount
+  - kind: ServiceAccount
-  name: svc-karl-muller
+    name: svc-karl-muller
-  namespace: kube-system
+    namespace: kube-system
+  - kind: ServiceAccount
+    name: svc-jeremy-munsch
+    namespace: kube-system
 roleRef:
   kind: ClusterRole
   name: cr-admin-web-ldc-namespace
@@ -173,15 +199,18 @@ metadata:
   name: rb-admin-web-ldc-namespace-staging
   namespace: staging
 subjects:
-- kind: ServiceAccount
+  - kind: ServiceAccount
-  name: svc-vincent-bridier
+    name: svc-vincent-bridier
-  namespace: kube-system
+    namespace: kube-system
-- kind: ServiceAccount
+  - kind: ServiceAccount
-  name: svc-noah-lancien
+    name: svc-noah-lancien
-  namespace: kube-system
+    namespace: kube-system
-- kind: ServiceAccount
+  - kind: ServiceAccount
-  name: svc-karl-muller
+    name: svc-karl-muller
-  namespace: kube-system
+    namespace: kube-system
+  - kind: ServiceAccount
+    name: svc-jeremy-munsch
+    namespace: kube-system
 roleRef:
   kind: ClusterRole
   name: cr-admin-web-ldc-namespace
@@ -194,15 +223,18 @@ metadata:
   name: rb-admin-web-ldc-namespace-production
   namespace: production
 subjects:
-- kind: ServiceAccount
+  - kind: ServiceAccount
-  name: svc-vincent-bridier
+    name: svc-vincent-bridier
-  namespace: kube-system
+    namespace: kube-system
-- kind: ServiceAccount
+  - kind: ServiceAccount
-  name: svc-noah-lancien
+    name: svc-noah-lancien
-  namespace: kube-system
+    namespace: kube-system
-- kind: ServiceAccount
+  - kind: ServiceAccount
-  name: svc-karl-muller
+    name: svc-karl-muller
-  namespace: kube-system
+    namespace: kube-system
+  - kind: ServiceAccount
+    name: svc-jeremy-munsch
+    namespace: kube-system
 roleRef:
   kind: ClusterRole
   name: cr-admin-web-ldc-namespace
@@ -215,9 +247,18 @@ metadata:
   name: rb-admin-web-ldc-namespace-common-services
   namespace: common-services
 subjects:
-- kind: ServiceAccount
+  - kind: ServiceAccount
-  name: svc-vincent-bridier
+    name: svc-vincent-bridier
-  namespace: kube-system
+    namespace: kube-system
+  - kind: ServiceAccount
+    name: svc-noah-lancien
+    namespace: kube-system
+  - kind: ServiceAccount
+    name: svc-karl-muller
+    namespace: kube-system
+  - kind: ServiceAccount
+    name: svc-jeremy-munsch
+    namespace: kube-system
 roleRef:
   kind: ClusterRole
   name: cr-admin-web-ldc-namespace

infrastructure/mariadb/helm-release.yaml

@@ -1,30 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: mariadb
-  namespace: common-services
-spec:
-  interval: 1m0s
-  chart:
-    spec:
-      chart: mariadb
-      version: 18.2.4
-      sourceRef:
-        kind: HelmRepository
-        name: bitnami
-        namespace: common-services
-  values:
-
-    image:
-      tag: 11.3.2-debian-12-r6
-
-    auth:
-      existingSecret: mariadb-credentials
-
-    primary:
-      persistence:
-        storageClass: "csi-cinder-high-speed"
-        size: 60Gi
-
-      resourcesPreset: "${MARIADB_RESOURCES_REQUEST}"

infrastructure/netdata/helm-release.yaml

@@ -0,0 +1,117 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: netdata
+  namespace: common-services
+spec:
+  interval: 1m0s
+
+  chart:
+    spec:
+      chart: netdata
+      version: 3.7.158
+      sourceRef:
+        kind: HelmRepository
+        name: netdata
+        namespace: common-services
+
+  # Injecte APIKEY depuis un Secret (pas en clair dans Git)
+  valuesFrom:
+    - kind: Secret
+      name: netdata-stream
+      valuesKey: APIKEY
+      targetPath: APIKEY
+
+  values:
+    image:
+      tag: v2.8.5
+
+    # Service interne uniquement
+    service:
+      type: ClusterIP
+      port: 19999
+
+    # Pas d'exposition
+    ingress:
+      enabled: false
+
+    # Pas d'auto-update des pods en prod critique
+    restarter:
+      enabled: false
+
+    # Parent = point de centralisation + health/alerting (par défaut chart)
+    parent:
+      enabled: true
+      port: 19999
+
+      resources:
+        requests:
+          cpu: "${NETDATA_PARENT_REQUESTS_CPU}"
+          memory: "${NETDATA_PARENT_REQUESTS_RAM}"
+        limits:
+          cpu: "${NETDATA_PARENT_LIMITS_CPU}"
+          memory: "${NETDATA_PARENT_LIMITS_RAM}"
+
+      # PV parent recommandés (db + alarms)
+      database:
+        persistence: true
+        volumesize: 40Gi # /var/cache/netdata
+      alarms:
+        persistence: true
+        volumesize: 4Gi # /var/lib/netdata
+
+      # Claiming via Secret envFrom
+      claiming:
+        enabled: true
+        token: ""
+        rooms: ""
+        url: "https://api.netdata.cloud"
+      envFrom:
+        - secretRef:
+            name: netdata-claim
+
+    # Child DaemonSet
+    child:
+      enabled: true
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+
+      resources:
+        requests:
+          cpu: "${NETDATA_CHILD_REQUESTS_CPU}"
+          memory: "${NETDATA_CHILD_REQUESTS_RAM}"
+        limits:
+          cpu: "${NETDATA_CHILD_LIMITS_CPU}"
+          memory: "${NETDATA_CHILD_LIMITS_RAM}"
+
+      persistence:
+        enabled: true
+        hostPath: /var/lib/netdata-k8s-child
+
+      # Hardening UI sur les nodes: bind localhost uniquement
+      configs:
+        netdata:
+          enabled: true
+          path: /etc/netdata/netdata.conf
+          data: |
+            [db]
+              mode = ram
+              retention = "${NETDATA_CHILD_RETENTION}"
+              update every = "${NETDATA_CHILD_COLLECT_INTERVAL}"
+            [web]
+              bind to = localhost:19999
+            [health]
+              enabled = no
+            [ml]
+              enabled = no
+
+      # Claiming via Secret envFrom (token PAS en clair ici)
+      claiming:
+        enabled: true
+        token: ""
+        rooms: ""
+        url: "https://api.netdata.cloud"
+      envFrom:
+        - secretRef:
+            name: netdata-claim

infrastructure/netdata/helm-repository.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: netdata
+  namespace: common-services
+spec:
+  interval: 1h0m0s
+  url: https://netdata.github.io/helmchart/

infrastructure/netdata/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helm-repository.yaml
+  - helm-release.yaml

infrastructure/prometheus-stack/helm-release.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: kube-prometheus-stack
-      version: 62.2.1
+      version: 72.0.1
       sourceRef:
         kind: HelmRepository
         name: prometheus-community
@@ -18,7 +18,7 @@ spec:
 
     prometheusOperator:
       image:
-        tag: v0.76.0
+        tag: v0.82.0
 
     grafana:
       defaultDashboardsTimezone: Europe/Paris
@@ -37,4 +37,4 @@ spec:
               storageClassName: "csi-cinder-classic"
               resources:
                 requests:
-                  storage: 20Gi
+                  storage: 40Gi

infrastructure/rabbitmq/helm-release.yaml

@@ -0,0 +1,24 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: rabbitmq
+  namespace: common-services
+spec:
+  interval: 1m0s
+  chart:
+    spec:
+      chart: rabbitmq
+      version: 16.0.3
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami
+        namespace: common-services
+  values:
+    global:
+      defaultStorageClass: "csi-cinder-high-speed"
+    image:
+      tag: 4.0.1
+    auth:
+      username: rabbitmq
+      existingPasswordSecret: rabbitmq-credentials

infrastructure/rabbitmq/helm-repository.yaml

@@ -1,10 +1,9 @@
----
+apiVersion: source.toolkit.fluxcd.io/v1
-apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
-kind: HelmRepository
+metadata:
-metadata:
+  name: bitnami
-  name: bitnami
+  namespace: common-services
-  namespace: common-services
+spec:
-spec:
+  interval: 1h0m0s
-  interval: 1h0m0s
+  url: oci://registry-1.docker.io/bitnamicharts
-  url: oci://registry-1.docker.io/bitnamicharts
+  type: "oci"
-  type: "oci"

infrastructure/rabbitmq/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- helm-repository.yaml
+- helm-release.yaml

infrastructure/traefik/helm-release.yaml

@@ -1,261 +1,481 @@
----
+---
-apiVersion: helm.toolkit.fluxcd.io/v2
+apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
+kind: HelmRelease
-metadata:
+metadata:
-  name: traefik
+  name: traefik
-  namespace: common-services
+  namespace: common-services
-spec:
+spec:
-  interval: 1m0s
+  interval: 1m0s
-  chart:
+  chart:
-    spec:
+    spec:
-      chart: traefik
+      chart: traefik
-      version: 31.1.1
+      version: 35.2.0
-      sourceRef:
+      sourceRef:
-        kind: HelmRepository
+        kind: HelmRepository
-        name: traefik
+        name: traefik
-        namespace: common-services
+        namespace: common-services
-  values:
+  values:
-
+    image:
-    image:
+      tag: v3.3.6
-      tag: v3.1.4
+
-
+    rbac:
-    rbac:
+      enabled: true
-      enabled: true
+
-
+    globalArguments:
-    globalArguments:
+      - "--global.checknewversion"
-      - "--global.checknewversion"
+      - "--global.sendanonymoususage"
-      - "--global.sendanonymoususage"
+      - "--accesslog=true"
-      - "--accesslog=true"
+      - "--entryPoints.web.http.redirections.entryPoint.to=websecure"
-      - "--entryPoints.web.http.redirections.entryPoint.to=websecure"
+      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
-      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
+      - "--providers.kubernetescrd.allowCrossNamespace=true"
-      - "--providers.kubernetescrd.allowCrossNamespace=true"
+      - "--entryPoints.web.proxyProtocol.trustedIPs=${OVH_LOAD_BALANCER_EGRESS_IP}/32"
-      - "--entryPoints.web.proxyProtocol.trustedIPs=${TRAEFIK_LOAD_BALANCER_IP}/32,10.124.0.0/16"
+      - "--entryPoints.websecure.proxyProtocol.trustedIPs=${OVH_LOAD_BALANCER_EGRESS_IP}/32"
-      - "--entryPoints.websecure.proxyProtocol.trustedIPs=${TRAEFIK_LOAD_BALANCER_IP}/32,10.124.0.0/16"
+      - "--entryPoints.websecure.forwardedHeaders.trustedIPs=${OVH_LOAD_BALANCER_EGRESS_IP}/32"
-      - "--entryPoints.websecure.forwardedHeaders.trustedIPs=${TRAEFIK_LOAD_BALANCER_IP}/32"
+
-      - "--entryPoints.mariadb.proxyProtocol.trustedIPs=${TRAEFIK_LOAD_BALANCER_IP},10.124.0.0/16"
+    additionalArguments:
-
+      #- "--log.level=DEBUG"
-    additionalArguments:
+      - "--entrypoints.web.http.middlewares=common-services-crowdsec-bouncer@kubernetescrd"
-      - "--log.level=DEBUG"
+      - "--entrypoints.websecure.http.middlewares=common-services-crowdsec-bouncer@kubernetescrd"
-
+
-    ports:
+    deployment:
-      traefik:
+      replicas: 2
-        port: 9000
+
-        expose:
+    podDisruptionBudget:
-          default: false
+      enabled: true
-        protocol: TCP
+      minAvailable: 1
-      web:
+
-        redirectTo:
+    affinity:
-          port: websecure
+      podAntiAffinity:
-      websecure:
+        requiredDuringSchedulingIgnoredDuringExecution:
-        port: 8443
+          - labelSelector:
-        expose:
+              matchLabels:
-          default: true
+                app.kubernetes.io/name: traefik
-        exposedPort: 443
+                app.kubernetes.io/instance: traefik-common-services
-        protocol: TCP
+            topologyKey: kubernetes.io/hostname
-        tls:
+
-          enabled: true
+    ports:
-      metrics:
+      traefik:
-        port: 9100
+        port: 9000
-        expose:
+        expose:
-          default: false
+          default: false
-        protocol: TCP
+        protocol: TCP
-      mariadb:
+      web:
-        port: 54322
+        redirections:
-        expose:
+          entryPoint:
-          default: true
+            to: websecure
-        protocol: TCP
+            scheme: https
-
+      websecure:
-    providers:
+        port: 8443
-      kubernetesCRD:
+        expose:
-        enabled: true
+          default: true
-        ingresssClass: traefik
+        exposedPort: 443
-      kubernetesIngress:
+        protocol: TCP
-        enabled: true
+        tls:
-
+          enabled: true
-    service:
+      metrics:
-      enabled: true
+        port: 9100
-      type: LoadBalancer
+        expose:
-      annotations:
+          default: false
-        service.beta.kubernetes.io/ovh-loadbalancer-proxy-protocol: v2
+        protocol: TCP
-      spec:
+
-        loadBalancerIP: "${TRAEFIK_LOAD_BALANCER_IP}"
+    providers:
-        externalTrafficPolicy: Local
+      kubernetesCRD:
-
+        enabled: true
-    ingressRoute:
+        ingresssClass: traefik
-      dashboard:
+      kubernetesIngress:
-        enabled: true
+        enabled: true
-
+
-    extraObjects:
+    experimental:
-      - apiVersion: traefik.io/v1alpha1  # Redirect www URLs to their no-www equivalent
+      plugins:
-        kind: Middleware
+        bouncer:
-        metadata:
+          moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
-          name: redirect-www-to-no-www
+          version: v1.4.5
-          namespace: common-services
+
-        spec:
+    volumes:
-          # Redirect a request from an url to another with regex matching and replacement
+      - name: crowdsec-lapi-secret
-          redirectRegex:
+        mountPath: /etc/traefik/crowdsec
-            # Apply a permanent redirection (HTTP 301)
+        type: secret
-            permanent: true
+        secretName: crowdsec-lapi-secret
-            # The regular expression to match and capture elements from the request URL
+
-            regex: "^https?://www\\.(.+)"
+    service:
-            # How to modify the URL to have the new target URL
+      enabled: true
-            replacement: "https://${1}"
+      type: LoadBalancer
-
+      annotations:
-      - apiVersion: traefik.io/v1alpha1  # Redirect www URLs to their no-www equivalent
+        loadbalancer.ovhcloud.com/class: "octavia"
-        kind: Middleware
+        loadbalancer.openstack.org/proxy-protocol: "v2"
-        metadata:
+        loadbalancer.openstack.org/keep-floatingip: "true"
-          name: redirect-www-to-no-www
+        # Protection Flux : empêche la suppression accidentelle
-          namespace: production
+        kustomize.toolkit.fluxcd.io/prune: disabled
-        spec:
+      spec:
-          # Redirect a request from an url to another with regex matching and replacement
+        externalTrafficPolicy: Local
-          redirectRegex:
+
-            # Apply a permanent redirection (HTTP 301)
+    ingressRoute:
-            permanent: true
+      dashboard:
-            # The regular expression to match and capture elements from the request URL
+        enabled: true
-            regex: "^https?://www\\.(.+)"
+
-            # How to modify the URL to have the new target URL
+    extraObjects:
-            replacement: "https://${1}"
+      - apiVersion: traefik.io/v1alpha1
-
+        kind: Middleware
-      - apiVersion: traefik.io/v1alpha1  # Redirect www URLs to their no-www equivalent
+        metadata:
-        kind: Middleware
+          name: crowdsec-bouncer
-        metadata:
+          namespace: common-services
-          name: redirect-www-to-no-www
+        spec:
-          namespace: staging
+          plugin:
-        spec:
+            bouncer:
-          # Redirect a request from an url to another with regex matching and replacement
+              forwardedHeadersTrustedIps: "${OVH_LOAD_BALANCER_EGRESS_IP}/32"
-          redirectRegex:
+              enabled: true
-            # Apply a permanent redirection (HTTP 301)
+              crowdsecMode: stream
-            permanent: true
+              crowdsecLapiScheme: http
-            # The regular expression to match and capture elements from the request URL
+              crowdsecLapiHost: crowdsec-service.common-services.svc.cluster.local:8080
-            regex: "^https?://www\\.(.+)"
+              crowdsecLapiPath: /
-            # How to modify the URL to have the new target URL
+              crowdsecLapiKeyFile: /etc/traefik/crowdsec/BOUNCER_KEY_traefik
-            replacement: "https://${1}"
+              crowdsecAppsecEnabled: true
-
+              crowdsecAppsecHost: crowdsec-appsec-service.common-services.svc.cluster.local:7422
-      - apiVersion: traefik.io/v1alpha1  # Redirect www URLs to their no-www equivalent
+              crowdsecAppsecPath: /
-        kind: Middleware
+              crowdsecAppsecFailureBlock: true
-        metadata:
+              crowdsecAppsecUnreachableBlock: true
-          name: redirect-www-to-no-www
+              crowdsecAppsecBodyLimit: 10485760
-          namespace: review
+
-        spec:
+      - apiVersion: traefik.io/v1alpha1 # Redirect www URLs to their no-www equivalent
-          # Redirect a request from an url to another with regex matching and replacement
+        kind: Middleware
-          redirectRegex:
+        metadata:
-            # Apply a permanent redirection (HTTP 301)
+          name: redirect-www-to-no-www
-            permanent: true
+          namespace: common-services
-            # The regular expression to match and capture elements from the request URL
+        spec:
-            regex: "^https?://www\\.(.+)"
+          # Redirect a request from an url to another with regex matching and replacement
-            # How to modify the URL to have the new target URL
+          redirectRegex:
-            replacement: "https://${1}"
+            # Apply a permanent redirection (HTTP 301)
-
+            permanent: true
-      # Redirection to www for common-services namespace
+            # The regular expression to match and capture elements from the request URL
-      # TODO: remove this middleware when all sites been updated
+            regex: "^https?://www\\.(.+)"
-      - apiVersion: traefik.io/v1alpha1  # Redirect no-www URLs to their www equivalent
+            # How to modify the URL to have the new target URL
-        kind: Middleware
+            replacement: "https://${1}"
-        metadata:
+
-          name: redirect-no-www-to-www
+      - apiVersion: traefik.io/v1alpha1 # Redirect www URLs to their no-www equivalent
-          namespace: common-services
+        kind: Middleware
-        spec:
+        metadata:
-          # Redirect a request from an url to another with regex matching and replacement
+          name: redirect-www-to-no-www
-          redirectRegex:
+          namespace: production
-            # Apply a permanent redirection (HTTP 301)
+        spec:
-            permanent: true
+          # Redirect a request from an url to another with regex matching and replacement
-            # The regular expression to match and capture elements from the request URL
+          redirectRegex:
-            regex: "^https?://(?:www\\.)?(.+)"
+            # Apply a permanent redirection (HTTP 301)
-            # How to modify the URL to have the new target URL
+            permanent: true
-            replacement: "https://www.${1}"
+            # The regular expression to match and capture elements from the request URL
-
+            regex: "^https?://www\\.(.+)"
-      # Redirection to www for production namespace
+            # How to modify the URL to have the new target URL
-      - apiVersion: traefik.io/v1alpha1  # Redirect no-www URLs to their www equivalent
+            replacement: "https://${1}"
-        kind: Middleware
+
-        metadata:
+      - apiVersion: traefik.io/v1alpha1 # Redirect www URLs to their no-www equivalent
-          name: redirect-no-www-to-www
+        kind: Middleware
-          namespace: production
+        metadata:
-        spec:
+          name: redirect-www-to-no-www
-          # Redirect a request from an url to another with regex matching and replacement
+          namespace: staging
-          redirectRegex:
+        spec:
-            # Apply a permanent redirection (HTTP 301)
+          # Redirect a request from an url to another with regex matching and replacement
-            permanent: true
+          redirectRegex:
-            # The regular expression to match and capture elements from the request URL
+            # Apply a permanent redirection (HTTP 301)
-            regex: "^https?://(?:www\\.)?(.+)"
+            permanent: true
-            # How to modify the URL to have the new target URL
+            # The regular expression to match and capture elements from the request URL
-            replacement: "https://www.${1}"
+            regex: "^https?://www\\.(.+)"
-
+            # How to modify the URL to have the new target URL
-      # Redirection from www to domain for staging
+            replacement: "https://${1}"
-      - apiVersion: traefik.io/v1alpha1  # Redirect no-www URLs to their www equivalent
+
-        kind: Middleware
+      - apiVersion: traefik.io/v1alpha1 # Redirect www URLs to their no-www equivalent
-        metadata:
+        kind: Middleware
-          name: redirect-no-www-to-www
+        metadata:
-          namespace: staging
+          name: redirect-www-to-no-www
-        spec:
+          namespace: review
-          redirectRegex:
+        spec:
-            # Apply a permanent redirection (HTTP 301)
+          # Redirect a request from an url to another with regex matching and replacement
-            permanent: true
+          redirectRegex:
-            # The regular expression to match and capture elements from the request URL
+            # Apply a permanent redirection (HTTP 301)
-            regex: "^https?://www\\.(.+)"
+            permanent: true
-            # How to modify the URL to have the new target URL
+            # The regular expression to match and capture elements from the request URL
-            replacement: "https://${1}"
+            regex: "^https?://www\\.(.+)"
-
+            # How to modify the URL to have the new target URL
-      # Redirection from www to domain for review
+            replacement: "https://${1}"
-      - apiVersion: traefik.io/v1alpha1  # Redirect no-www URLs to their www equivalent
+
-        kind: Middleware
+      # Redirection to www for common-services namespace
-        metadata:
+      # TODO: remove this middleware when all sites been updated
-          name: redirect-no-www-to-www
+      - apiVersion: traefik.io/v1alpha1 # Redirect no-www URLs to their www equivalent
-          namespace: review
+        kind: Middleware
-        spec:
+        metadata:
-          redirectRegex:
+          name: redirect-no-www-to-www
-            # Apply a permanent redirection (HTTP 301)
+          namespace: common-services
-            permanent: true
+        spec:
-            # The regular expression to match and capture elements from the request URL
+          # Redirect a request from an url to another with regex matching and replacement
-            regex: "^https?://www\\.(.+)"
+          redirectRegex:
-            # How to modify the URL to have the new target URL
+            # Apply a permanent redirection (HTTP 301)
-            replacement: "https://${1}"
+            permanent: true
-
+            # The regular expression to match and capture elements from the request URL
-      - apiVersion: traefik.io/v1alpha1
+            regex: "^https?://(?:www\\.)?(.+)"
-        kind: MiddlewareTCP
+            # How to modify the URL to have the new target URL
-        metadata:
+            replacement: "https://www.${1}"
-          name: ipwhitelist-acces-mariadb
+
-          namespace: common-services
+      # Redirection to www for production namespace
-        spec:
+      - apiVersion: traefik.io/v1alpha1 # Redirect no-www URLs to their www equivalent
-          ipAllowList:
+        kind: Middleware
-            sourceRange:
+        metadata:
-              - 46.18.126.208/28 # LDC
+          name: redirect-no-www-to-www
-              - 62.193.56.48/32 # OPENevents - Bureau Neuville
+          namespace: production
-              - 80.15.14.76/32 # LDC web - Box externe
+        spec:
-              - 86.65.205.240/28 # LDC
+          # Redirect a request from an url to another with regex matching and replacement
-              - 135.125.42.176/28 # LDC
+          redirectRegex:
-              - 149.202.23.64/26 # LDC
+            # Apply a permanent redirection (HTTP 301)
-              - 151.80.95.176/28 # LDC
+            permanent: true
-              - 217.15.92.64/28 # LDC
+            # The regular expression to match and capture elements from the request URL
-              - 10.124.0.0/16 # Kubernetes internal resources
+            regex: "^https?://(?:www\\.)?(.+)"
-
+            # How to modify the URL to have the new target URL
-      - apiVersion: traefik.io/v1alpha1
+            replacement: "https://www.${1}"
-        kind: Middleware
+
-        metadata:
+      # Redirection from www to domain for staging
-          name: admin-ldc-whitelist
+      - apiVersion: traefik.io/v1alpha1 # Redirect no-www URLs to their www equivalent
-          namespace: common-services
+        kind: Middleware
-        spec:
+        metadata:
-          ipAllowList:
+          name: redirect-no-www-to-www
-            sourceRange:
+          namespace: staging
-              - 46.18.126.208/28 # LDC
+        spec:
-              - 62.193.56.48/32 # OPENevents - Bureau Neuville
+          redirectRegex:
-              - 80.15.14.76/32 # LDC web - Box externe
+            # Apply a permanent redirection (HTTP 301)
-              - 86.65.205.240/28 # LDC
+            permanent: true
-              - 135.125.42.176/28 # LDC
+            # The regular expression to match and capture elements from the request URL
-              - 149.202.23.64/26 # LDC
+            regex: "^https?://www\\.(.+)"
-              - 151.80.95.176/28 # LDC
+            # How to modify the URL to have the new target URL
-              - 217.15.92.64/28 # LDC
+            replacement: "https://${1}"
-      - apiVersion: traefik.io/v1alpha1
+
-        kind: IngressRouteTCP
+      # Redirection from www to domain for review
-        metadata:
+      - apiVersion: traefik.io/v1alpha1 # Redirect no-www URLs to their www equivalent
-          name: mariadb-ingressroutetcp
+        kind: Middleware
-          namespace: common-services
+        metadata:
-        spec:
+          name: redirect-no-www-to-www
-          entryPoints:
+          namespace: review
-            - mariadb
+        spec:
-          routes:
+          redirectRegex:
-            - match: HostSNI(`*`) # Hostname to match
+            # Apply a permanent redirection (HTTP 301)
-              middlewares:
+            permanent: true
-                - name: ipwhitelist-acces-mariadb
+            # The regular expression to match and capture elements from the request URL
-                  namespace: common-services
+            regex: "^https?://www\\.(.+)"
-              services:
+            # How to modify the URL to have the new target URL
-                - name: mariadb
+            replacement: "https://${1}"
-                  port: 3306
+
+      # customResponseHeaders middleware
+      - apiVersion: traefik.io/v1alpha1
+        kind: Middleware
+        metadata:
+          name: coop-middleware
+          namespace: review
+        spec:
+          headers:
+            customResponseHeaders:
+              Cross-Origin-Opener-Policy: "same-origin"
+
+      - apiVersion: traefik.io/v1alpha1
+        kind: Middleware
+        metadata:
+          name: coop-middleware
+          namespace: staging
+        spec:
+          headers:
+            customResponseHeaders:
+              Cross-Origin-Opener-Policy: "same-origin"
+
+      - apiVersion: traefik.io/v1alpha1
+        kind: Middleware
+        metadata:
+          name: coop-middleware
+          namespace: production
+        spec:
+          headers:
+            customResponseHeaders:
+              Cross-Origin-Opener-Policy: "same-origin"
+
+      - apiVersion: traefik.io/v1alpha1
+        kind: Middleware
+        metadata:
+          name: admin-ldc-whitelist
+          namespace: common-services
+        spec:
+          ipAllowList:
+            sourceRange:
+              - 163.172.132.215 # Proxy Cloud Navigation LDC
+              - 51.159.133.41 # Proxy Cloud Navigation LDC
+              - 51.159.82.143 # Proxy Cloud Navigation LDC
+              - 135.125.42.187 # Proxy Cloud Navigation LDC
+              - 37.64.103.132 # Willow Creation
+              - 88.86.232.178 # Cafel
+              - 57.128.69.87 # K8S Node 1
+              - 57.128.110.168 # K8S Node 2
+              - 57.128.111.33 # K8S Node 3
+              - 54.38.0.22 # K8S Node 4
+              - 57.128.71.23 # K8S Node 5
+              - 51.68.88.158/32 # prod-k8s-ldc-web-nopreempt-node-796d8b
+              - 51.68.92.100/32 # prod-k8s-ldc-web-nopreempt-node-8f841b
+              - 51.68.92.60/32 # prod-k8s-ldc-web-nopreempt-node-399aa9
+              - 51.68.87.150/32 # prod-k8s-ldc-web-nopreempt-node-b5417b
+              - 51.68.90.203/32 #	prod-k8s-ldc-web-nopreempt-node-e3ac48
+              - 137.74.211.112/32 # dev-test-k8s-ldc-web-nopreempt-node-17257c
+              - 146.59.240.51/32 # dev-test-k8s-ldc-web-nopreempt-node-54e828
+              - 146.59.241.151/32 # dev-test-k8s-ldc-web-nopreempt-node-93017a
+              - 46.18.126.208/28 # LDC
+              - 62.193.56.48/32 # OPENevents - Bureau Neuville
+              - 86.65.205.240/28 # LDC
+              - 135.125.42.176/28 # LDC
+              - 149.202.23.64/26 # LDC
+              - 151.80.95.176/28 # LDC
+              - 217.15.92.64/28 # LDC
+              - 3.77.67.4 # UptimeRobot
+              - 3.79.134.69 # UptimeRobot
+              - 18.192.166.72 # UptimeRobot
+              - 18.193.252.127 # UptimeRobot
+              - 52.28.162.93 # UptimeRobot
+              - 52.59.43.236 # UptimeRobot
+              - 63.178.84.147 # UptimeRobot
+              - 24.144.78.39 # UptimeRobot
+              - 24.144.78.185 # UptimeRobot
+              - 64.225.81.248 # UptimeRobot
+              - 64.225.82.147 # UptimeRobot
+              - 143.198.249.237 # UptimeRobot
+              - 143.198.250.89 # UptimeRobot
+              - 143.244.196.21 # UptimeRobot
+              - 143.244.196.211 # UptimeRobot
+              - 152.42.149.135 # UptimeRobot
+              - 159.223.243.219 # UptimeRobot
+              - 161.35.247.201 # UptimeRobot
+              - 167.99.18.52 # UptimeRobot
+              - 188.166.201.79 # UptimeRobot
+              - 206.189.241.133 # UptimeRobot
+              - 209.38.53.7 # UptimeRobot
+              - 49.13.24.81 # UptimeRobot
+              - 49.13.130.29 # UptimeRobot
+              - 49.13.134.145 # UptimeRobot
+              - 78.47.98.55 # UptimeRobot
+              - 88.99.80.227 # UptimeRobot
+              - 142.132.180.39 # UptimeRobot
+              - 157.90.155.240 # UptimeRobot
+              - 157.90.156.63 # UptimeRobot
+              - 168.119.53.160 # UptimeRobot
+              - 168.119.96.239 # UptimeRobot
+              - 49.13.164.148 # UptimeRobot
+              - 49.13.167.123 # UptimeRobot
+              - 78.46.190.63 # UptimeRobot
+              - 78.47.173.76 # UptimeRobot
+              - 128.140.41.193 # UptimeRobot
+              - 128.140.106.114 # UptimeRobot
+              - 159.69.158.189 # UptimeRobot
+              - 167.235.143.113 # UptimeRobot
+              - 168.119.123.75 # UptimeRobot
+              - 78.46.215.1 # UptimeRobot
+              - 91.99.101.207 # UptimeRobot
+              - 46.224.188.186 # BugSmash
+              - 178.156.178.124 # BugSmash
+              - 5.161.29.18 # BugSmash
+
+      # AJOUT : Service Octavia en parallèle
+      - apiVersion: v1
+        kind: Service
+        metadata:
+          name: traefik-octavia
+          namespace: common-services
+          annotations:
+            loadbalancer.ovhcloud.com/class: "octavia"
+            loadbalancer.openstack.org/proxy-protocol: "v2"
+            loadbalancer.openstack.org/keep-floatingip: "true"
+            # Protection Flux : empêche la suppression accidentelle
+            kustomize.toolkit.fluxcd.io/prune: disabled
+        spec:
+          type: LoadBalancer
+          externalTrafficPolicy: Local
+          loadBalancerIP: "${TRAEFIK_LOAD_BALANCER_IP_OCTAVIA}"
+          selector:
+            app.kubernetes.io/name: traefik
+            app.kubernetes.io/instance: traefik-common-services
+          ports:
+            - name: web
+              port: 80
+              targetPort: 8000
+              protocol: TCP
+            - name: websecure
+              port: 443
+              targetPort: 8443
+              protocol: TCP
+
+      - apiVersion: v1
+        kind: Service
+        metadata:
+          name: blackhole
+          namespace: common-services
+        spec:
+          # Placeholder : jamais contacté, le middleware renvoie 403 avant.
+          type: ClusterIP
+          ports:
+            - name: http
+              port: 80
+              targetPort: 80
+
+      - apiVersion: traefik.io/v1alpha1
+        kind: Middleware
+        metadata:
+          name: deny-ip-blocklist
+          namespace: common-services
+        spec:
+          # ipAllowList rejette en 403
+          ipAllowList:
+            sourceRange:
+              - 192.0.2.1/32 # TEST-NET-1 (RFC 5737) : ne matche aucun client réel => deny
+
+      - apiVersion: traefik.io/v1alpha1
+        kind: IngressRoute
+        metadata:
+          name: security-ip-blocklist
+          namespace: common-services
+        spec:
+          entryPoints:
+            - websecure
+          routes:
+            - kind: Rule
+              match: >-
+                ClientIP(`45.88.138.45/32`) ||
+                ClientIP(`8.34.210.32/32`) ||
+                ClientIP(`8.34.210.37/32`) ||
+                ClientIP(`8.34.210.42/32`) ||
+                ClientIP(`8.34.210.43/32`) ||
+                ClientIP(`8.34.210.45/32`) ||
+                ClientIP(`34.68.34.65/32`) ||
+                ClientIP(`34.68.34.66/32`) ||
+                ClientIP(`34.68.34.67/32`) ||
+                ClientIP(`34.68.34.69/32`) ||
+                ClientIP(`34.68.34.71/32`) ||
+                ClientIP(`34.68.34.72/32`) ||
+                ClientIP(`34.68.34.77/32`) ||
+                ClientIP(`34.68.34.79/32`) ||
+                ClientIP(`34.68.34.81/32`) ||
+                ClientIP(`34.68.34.84/32`) ||
+                ClientIP(`94.74.106.96/32`) ||
+                ClientIP(`20.220.225.223/32`) ||
+                ClientIP(`52.182.173.140/32`)
+              priority: 100000
+              middlewares:
+                - name: deny-ip-blocklist
+                  namespace: common-services
+              services:
+                - name: blackhole
+                  port: 80
+
+      - apiVersion: discovery.k8s.io/v1
+        kind: EndpointSlice
+        metadata:
+          name: blackhole
+          namespace: common-services
+          labels:
+            kubernetes.io/service-name: blackhole
+        addressType: IPv4
+        endpoints:
+          - addresses:
+              - 192.0.2.1 # TEST-NET-1 : non-routable, jamais contacté
+            conditions:
+              ready: true
+        ports:
+          - name: http
+            port: 80
+            protocol: TCP