Merge branch 'develop' into 'master'

Added gen-game-web-instances/auguste-lambert to gitlab agents

See merge request ldc-web/cluster-k8s!133

.gitlab/agents/prod-k8s-ldc-web/config.yaml

@@ -2,6 +2,7 @@ ci_access:
   projects:
     - id: ldc-web/projets/agis
     - id: ldc-web/projets/auguste-lambert
+    - id: ldc-web/projets/bien-etre-animal
     - id: ldc-web/projets/boutique-cnc-sable
     - id: ldc-web/projets/boutique-jeusselin
     - id: ldc-web/projets/cailles-robin
@@ -12,8 +13,10 @@ ci_access:
     - id: ldc-web/projets/doux
     - id: ldc-web/projets/espri-restauration
     - id: ldc-web/projets/galina
+    - id: ldc-web/projets/gen-game-web-instances/auguste-lambert
     - id: ldc-web/projets/gen-game-web-instances/janze
     - id: ldc-web/projets/gen-game-web-instances/l-orleanais-jeu
+    - id: ldc-web/projets/gen-game-web-instances/le-gaulois-eveillez-vos-papilles
     - id: ldc-web/projets/gen-game-web-instances/le-gaulois-tdf-2024
     - id: ldc-web/projets/gen-game-web-instances/le-gaulois-chequier-40-2025
     - id: ldc-web/projets/gen-game-web-instances/le-gaulois-op-brasserie-2025
@@ -27,6 +30,7 @@ ci_access:
     - id: ldc-web/projets/gen-game-web-prize-draw
     - id: ldc-web/projets/id-halal
     - id: ldc-web/projets/jeusselin
+    - id: ldc-web/projets/ker-chant
     - id: ldc-web/projets/l-hours
     - id: ldc-web/projets/la-boutique-du-canard
     - id: ldc-web/projets/la-toque-angevine
@@ -55,6 +59,7 @@ ci_access:
     - id: ldc-web/projets/parc-auto
     - id: ldc-web/projets/poule-et-toque
     - id: ldc-web/projets/prims
+    - id: ldc-web/projets/qualimaine
     - id: ldc-web/projets/qrcollector/qrcollector-back
     - id: ldc-web/projets/regalette
     - id: ldc-web/projets/reghalal

README.md

@@ -8,7 +8,6 @@
 | FluxCD       | no flux      | 2.3.0      | 2.3.0                | 2.13.0             |
 | Git-agent    | 16.9.3       | 16.9.3     | 17.1.0               | 2.30               |
 | Git-runner   | 16.9.1       | 16.9.1     | 17.0.1               | 0.62.1             |
-| MariaDB      | 10.10        | 1.13.2     | 1.13.2               | 18.2.4             |
 | Prometheus   | 0.60.1       | 0.74.0     | 0.74.0               | 60.2.0             |
 | Traefik      | 2.9.6        | 3.0.2      | 3.0.2                | 28.3.0             |
 | Velero       | 1.10.1       | 1.13.2     | 1.13.2               | 6.7.0              |

flux/kustomizations/crowdsec.yaml

@@ -2,25 +2,31 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: mariadb
+  name: crowdsec
   namespace: flux-system
 spec:
-  interval: 30s
-  path: ./infrastructure/mariadb
+  interval: 1m0s
+  path: ./infrastructure/crowdsec
   prune: false
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-  dependsOn:
-    - name: external-secrets-resources
-      namespace: flux-system
   healthChecks:
     - apiVersion: source.toolkit.fluxcd.io/v1
       kind: HelmRepository
-      name: bitnami
+      name: crowdsec
       namespace: common-services
     - apiVersion: helm.toolkit.fluxcd.io/v2
       kind: HelmRelease
-      name: mariadb
+      name: crowdsec
       namespace: common-services
+    - apiVersion: v1
+      kind: Pod
+      name: vault-0
+      namespace: common-services
+  dependsOn:
+    - name: namespaces
+      namespace: flux-system
+    - name: external-secrets-resources
+      namespace: flux-system
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
   timeout: 5m

flux/kustomizations/kustomization.yaml

@@ -7,7 +7,6 @@ resources:
   - gitlab-runner.yaml
   - hashicorp-vault.yaml
   - ldc-custom.yaml
-  - mariadb.yaml
   - meilisearch.yaml
   - namespaces.yaml
   - prometheus-stack.yaml
@@ -15,3 +14,4 @@ resources:
   - traefik.yaml
   - quickchart.yaml
   - netdata.yaml
+  - crowdsec.yaml

infrastructure/crowdsec/helm-release.yaml

@@ -0,0 +1,92 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: crowdsec
+  namespace: common-services
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: crowdsec
+      version: 0.24.0
+      sourceRef:
+        kind: HelmRepository
+        name: crowdsec
+        namespace: common-services
+  values:
+    container_runtime: containerd
+
+    image:
+      tag: v1.7.8
+
+    agent:
+      acquisition:
+        - namespace: common-services
+          podName: traefik-*
+          program: traefik
+      env:
+        - name: COLLECTIONS
+          value: "crowdsecurity/traefik"
+
+    secrets:
+      externalSecret:
+        name: crowdsec-lapi-secret
+        csLapiSecretKey: "CS_LAPI_SECRET"
+        registrationTokenKey: "REGISTRATION_TOKEN"
+
+    lapi:
+      replicas: 2
+      storeCAPICredentialsInSecret: true
+      storeLAPICscliCredentialsInSecret: true
+      persistentVolume:
+        data:
+          enabled: false
+        config:
+          enabled: false
+      envFrom:
+        - secretRef:
+            name: crowdsec-lapi-secret
+
+    config:
+      config.yaml.local: |
+        api:
+          client:
+            # the log processor will remove delete itself from LAPI when stopping.    
+            unregister_on_exit: true
+          server:
+            auto_registration: # Activate if not using TLS for authentication
+              enabled: true
+              token: "${CROWDSEC_REGISTRATION_TOKEN}" # /!\ Do not modify this variable (Cluster K8S gitlab var)
+              allowed_ranges: # /!\ Make sure to adapt to the pod IP ranges used by your cluster
+                - "127.0.0.1/32"
+                - "192.168.0.0/16"
+                - "10.0.0.0/8"
+                - "172.16.0.0/12"
+        db_config:
+          type: mysql
+          user: ${CROWDSEC_DB_USER}
+          password: ${CROWDSEC_DB_PWD}
+          db_name: ${CROWDSEC_DB_NAME}
+          host: ${DB_HOST}
+          port: ${DB_PORT}
+          flush:
+            bouncers_autodelete:
+              api_key: 1h
+            agents_autodelete:
+              login_password: 6h
+              cert: 6h
+
+    appsec:
+      enabled: true
+      acquisitions:
+        - source: appsec
+          listen_addr: "0.0.0.0:7422"
+          path: /
+          appsec_configs:
+            - crowdsecurity/appsec-default
+            - crowdsecurity/crs
+          labels:
+            type: appsec
+      env:
+        - name: COLLECTIONS
+          value: "crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-crs crowdsecurity/appsec-generic-rules"

infrastructure/crowdsec/helm-repository.yaml

@@ -1,10 +1,8 @@
----
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
-  name: bitnami
+  name: crowdsec
   namespace: common-services
 spec:
   interval: 1h0m0s
-  url: oci://registry-1.docker.io/bitnamicharts
-  type: "oci"
+  url: https://crowdsecurity.github.io/helm-charts

infrastructure/gitlab-agent/helm-release.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: gitlab-agent
-      version: 2.20.1
+      version: 2.29.0
       sourceRef:
         kind: HelmRepository
         name: gitlab-agent
@@ -17,7 +17,7 @@ spec:
   values:
 
     image:
-      tag: v18.5.2
+      tag: v19.2.0
 
     config:
       kasAddress: "wss://lab.s-web.fr/-/kubernetes-agent/"

infrastructure/gitlab-runner/helm-release.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: gitlab-runner
-      version: 0.82.0
+      version: 0.91.2
       sourceRef:
         kind: HelmRepository
         name: gitlab-runner
@@ -17,7 +17,7 @@ spec:
   values:
 
     image:
-      tag: alpine-v18.5.0
+      tag: alpine-v19.2.2
 
     gitlabUrl: https://lab.s-web.fr
 

infrastructure/hashicorp-vault/external-secrets/resources/crowdsec.yaml

@@ -0,0 +1,38 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: crowdsec-lapi-secret
+  namespace: common-services
+spec:
+  refreshInterval: 15s
+  secretStoreRef:
+    name: vault-secret-store
+    kind: ClusterSecretStore
+  target:
+    name: crowdsec-lapi-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: CS_LAPI_SECRET
+      remoteRef:
+        key: secret/data/crowdsec/lapi
+        property: CS_LAPI_SECRET
+    - secretKey: REGISTRATION_TOKEN
+      remoteRef:
+        key: secret/data/crowdsec/lapi
+        property: REGISTRATION_TOKEN
+    - secretKey: ENROLL_KEY
+      remoteRef:
+        key: secret/data/crowdsec/lapi
+        property: ENROLL_KEY
+    - secretKey: ENROLL_INSTANCE_NAME
+      remoteRef:
+        key: secret/data/crowdsec/lapi
+        property: ENROLL_INSTANCE_NAME
+    - secretKey: ENROLL_TAGS
+      remoteRef:
+        key: secret/data/crowdsec/lapi
+        property: ENROLL_TAGS
+    - secretKey: BOUNCER_KEY_traefik
+      remoteRef:
+        key: secret/data/crowdsec/lapi
+        property: BOUNCER_KEY_traefik

infrastructure/hashicorp-vault/external-secrets/resources/kustomization.yaml

@@ -7,10 +7,10 @@ resources:
   - gitlab-agent.yaml
   - gitlab-runner.yaml
   - hashicorp-vault.yaml
-  - mariadb.yaml
   - prometheus-stack.yaml
   - review.yaml
   - staging.yaml
   - production.yaml
   - rabbitmq.yaml
-  - netdata.yaml
+  - netdata.yaml
+  - crowdsec.yaml

infrastructure/hashicorp-vault/external-secrets/resources/mariadb.yaml

@@ -1,28 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: mariadb-credentials
-  namespace: common-services
-spec:
-  refreshInterval: "15s"
-  secretStoreRef:
-    name: vault-secret-store
-    kind: ClusterSecretStore
-  target:
-    name: mariadb-credentials
-    template:
-      engineVersion: v2
-      type: Opaque
-      data:
-        mariadb-password: "{{ .password }}"
-        mariadb-replication-password: "{{ .root_password }}"
-        mariadb-root-password: "{{ .root_password }}"
-  data:
-    - secretKey: root_password
-      remoteRef:
-        key: secret/mariadb
-        property: root_password
-    - secretKey: password
-      remoteRef:
-        key: secret/mariadb
-        property: password

infrastructure/mariadb/helm-release.yaml

@@ -1,31 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: mariadb
-  namespace: common-services
-spec:
-  interval: 1m0s
-  chart:
-    spec:
-      chart: mariadb
-      version: 18.2.4
-      sourceRef:
-        kind: HelmRepository
-        name: bitnami
-        namespace: common-services
-  values:
-
-    image:
-      repository: bitnamilegacy/mariadb
-      tag: 11.3.2-debian-12-r6
-
-    auth:
-      existingSecret: mariadb-credentials
-
-    primary:
-      persistence:
-        storageClass: "csi-cinder-high-speed"
-        size: 60Gi
-
-      resourcesPreset: "${MARIADB_RESOURCES_REQUEST}"

infrastructure/traefik/helm-release.yaml

@@ -31,10 +31,11 @@ spec:
       - "--entryPoints.web.proxyProtocol.trustedIPs=${OVH_LOAD_BALANCER_EGRESS_IP}/32"
       - "--entryPoints.websecure.proxyProtocol.trustedIPs=${OVH_LOAD_BALANCER_EGRESS_IP}/32"
       - "--entryPoints.websecure.forwardedHeaders.trustedIPs=${OVH_LOAD_BALANCER_EGRESS_IP}/32"
-      - "--entryPoints.mariadb.proxyProtocol.trustedIPs=${OVH_LOAD_BALANCER_EGRESS_IP}/32"
 
     additionalArguments:
-      - "--log.level=DEBUG"
+      #- "--log.level=DEBUG"
+      - "--entrypoints.web.http.middlewares=common-services-crowdsec-bouncer@kubernetescrd"
+      - "--entrypoints.websecure.http.middlewares=common-services-crowdsec-bouncer@kubernetescrd"
 
     deployment:
       replicas: 2
@@ -76,11 +77,6 @@ spec:
         expose:
           default: false
         protocol: TCP
-      mariadb:
-        port: 54322
-        expose:
-          default: true
-        protocol: TCP
 
     providers:
       kubernetesCRD:
@@ -89,13 +85,28 @@ spec:
       kubernetesIngress:
         enabled: true
 
+    experimental:
+      plugins:
+        bouncer:
+          moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
+          version: v1.4.5
+
+    volumes:
+      - name: crowdsec-lapi-secret
+        mountPath: /etc/traefik/crowdsec
+        type: secret
+        secretName: crowdsec-lapi-secret
+
     service:
       enabled: true
       type: LoadBalancer
       annotations:
-        service.beta.kubernetes.io/ovh-loadbalancer-proxy-protocol: v2
+        loadbalancer.ovhcloud.com/class: "octavia"
+        loadbalancer.openstack.org/proxy-protocol: "v2"
+        loadbalancer.openstack.org/keep-floatingip: "true"
+        # Protection Flux : empêche la suppression accidentelle
+        kustomize.toolkit.fluxcd.io/prune: disabled
       spec:
-        loadBalancerIP: "${TRAEFIK_LOAD_BALANCER_IP}"
         externalTrafficPolicy: Local
 
     ingressRoute:
@@ -103,6 +114,28 @@ spec:
         enabled: true
 
     extraObjects:
+      - apiVersion: traefik.io/v1alpha1
+        kind: Middleware
+        metadata:
+          name: crowdsec-bouncer
+          namespace: common-services
+        spec:
+          plugin:
+            bouncer:
+              forwardedHeadersTrustedIps: "${OVH_LOAD_BALANCER_EGRESS_IP}/32"
+              enabled: true
+              crowdsecMode: stream
+              crowdsecLapiScheme: http
+              crowdsecLapiHost: crowdsec-service.common-services.svc.cluster.local:8080
+              crowdsecLapiPath: /
+              crowdsecLapiKeyFile: /etc/traefik/crowdsec/BOUNCER_KEY_traefik
+              crowdsecAppsecEnabled: true
+              crowdsecAppsecHost: crowdsec-appsec-service.common-services.svc.cluster.local:7422
+              crowdsecAppsecPath: /
+              crowdsecAppsecFailureBlock: true
+              crowdsecAppsecUnreachableBlock: true
+              crowdsecAppsecBodyLimit: 10485760
+
       - apiVersion: traefik.io/v1alpha1 # Redirect www URLs to their no-www equivalent
         kind: Middleware
         metadata:
@@ -257,23 +290,6 @@ spec:
             customResponseHeaders:
               Cross-Origin-Opener-Policy: "same-origin"
 
-      - apiVersion: traefik.io/v1alpha1
-        kind: MiddlewareTCP
-        metadata:
-          name: ipwhitelist-acces-mariadb
-          namespace: common-services
-        spec:
-          ipAllowList:
-            sourceRange:
-              - 46.18.126.208/28 # LDC
-              - 62.193.56.48/32 # OPENevents - Bureau Neuville
-              - 86.65.205.240/28 # LDC
-              - 135.125.42.176/28 # LDC
-              - 149.202.23.64/26 # LDC
-              - 151.80.95.176/28 # LDC
-              - 217.15.92.64/28 # LDC
-              - 10.124.0.0/16 # Kubernetes internal resources
-
       - apiVersion: traefik.io/v1alpha1
         kind: Middleware
         metadata:
@@ -351,23 +367,9 @@ spec:
               - 168.119.123.75 # UptimeRobot
               - 78.46.215.1 # UptimeRobot
               - 91.99.101.207 # UptimeRobot
-
-      - apiVersion: traefik.io/v1alpha1
-        kind: IngressRouteTCP
-        metadata:
-          name: mariadb-ingressroutetcp
-          namespace: common-services
-        spec:
-          entryPoints:
-            - mariadb
-          routes:
-            - match: HostSNI(`*`) # Hostname to match
-              middlewares:
-                - name: ipwhitelist-acces-mariadb
-                  namespace: common-services
-              services:
-                - name: mariadb
-                  port: 3306
+              - 46.224.188.186 # BugSmash
+              - 178.156.178.124 # BugSmash
+              - 5.161.29.18 # BugSmash
 
       # AJOUT : Service Octavia en parallèle
       - apiVersion: v1
@@ -397,10 +399,6 @@ spec:
               port: 443
               targetPort: 8443
               protocol: TCP
-            - name: mariadb
-              port: 54322
-              targetPort: 54322
-              protocol: TCP
 
       - apiVersion: v1
         kind: Service
@@ -437,7 +435,25 @@ spec:
           routes:
             - kind: Rule
               match: >-
-                ClientIP(`45.88.138.45/32`)
+                ClientIP(`45.88.138.45/32`) ||
+                ClientIP(`8.34.210.32/32`) ||
+                ClientIP(`8.34.210.37/32`) ||
+                ClientIP(`8.34.210.42/32`) ||
+                ClientIP(`8.34.210.43/32`) ||
+                ClientIP(`8.34.210.45/32`) ||
+                ClientIP(`34.68.34.65/32`) ||
+                ClientIP(`34.68.34.66/32`) ||
+                ClientIP(`34.68.34.67/32`) ||
+                ClientIP(`34.68.34.69/32`) ||
+                ClientIP(`34.68.34.71/32`) ||
+                ClientIP(`34.68.34.72/32`) ||
+                ClientIP(`34.68.34.77/32`) ||
+                ClientIP(`34.68.34.79/32`) ||
+                ClientIP(`34.68.34.81/32`) ||
+                ClientIP(`34.68.34.84/32`) ||
+                ClientIP(`94.74.106.96/32`) ||
+                ClientIP(`20.220.225.223/32`) ||
+                ClientIP(`52.182.173.140/32`)
               priority: 100000
               middlewares:
                 - name: deny-ip-blocklist