diff --git a/k8s/M6-ingress-nginx-cm-patch.yaml b/k8s/M6-ingress-nginx-cm-patch.yaml new file mode 100644 index 00000000..37d14632 --- /dev/null +++ b/k8s/M6-ingress-nginx-cm-patch.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: ingress-nginx-controller + namespace: ingress-nginx +data: + use-forwarded-headers: true + compute-full-forwarded-for: true + use-proxy-protocol: true diff --git a/k8s/M6-ingress-nginx-components.yaml b/k8s/M6-ingress-nginx-components.yaml new file mode 100644 index 00000000..e1b18021 --- /dev/null +++ b/k8s/M6-ingress-nginx-components.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: Namespace +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + pod-security.kubernetes.io/warn: restricted + pod-security.kubernetes.io/warn-version: latest + name: ingress-nginx diff --git a/k8s/M6-ingress-nginx-kustomization.yaml b/k8s/M6-ingress-nginx-kustomization.yaml new file mode 100644 index 00000000..70c8929c --- /dev/null +++ b/k8s/M6-ingress-nginx-kustomization.yaml @@ -0,0 +1,12 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- M6-ingress-nginx-components.yaml +- sync.yaml +patches: + - path: M6-ingress-nginx-cm-patch.yaml + target: + kind: ConfigMap + - path: M6-ingress-nginx-svc-patch.yaml + target: + kind: Service diff --git a/k8s/M6-ingress-nginx-svc-patch.yaml b/k8s/M6-ingress-nginx-svc-patch.yaml new file mode 100644 index 00000000..93d5e717 --- /dev/null +++ b/k8s/M6-ingress-nginx-svc-patch.yaml @@ -0,0 +1,8 @@ +apiVersion: v1 +kind: Service +metadata: + name: ingress-nginx-controller + namespace: ingress-nginx + annotations: + service.beta.kubernetes.io/scw-loadbalancer-proxy-protocol-v2: true + service.beta.kubernetes.io/scw-loadbalancer-use-hostname: true diff --git a/k8s/M6-kyverno-components.yaml b/k8s/M6-kyverno-components.yaml new file mode 100644 index 00000000..0a3acb3c --- /dev/null +++ b/k8s/M6-kyverno-components.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: Namespace +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + pod-security.kubernetes.io/warn: restricted + pod-security.kubernetes.io/warn-version: latest + name: kyverno diff --git a/k8s/M6-kyverno-enforce-service-account.yaml b/k8s/M6-kyverno-enforce-service-account.yaml new file mode 100644 index 00000000..8980d492 --- /dev/null +++ b/k8s/M6-kyverno-enforce-service-account.yaml @@ -0,0 +1,72 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + name: flux-multi-tenancy +spec: + validationFailureAction: enforce + rules: + - name: serviceAccountName + exclude: + resources: + namespaces: + - flux-system + match: + resources: + kinds: + - Kustomization + - HelmRelease + validate: + message: ".spec.serviceAccountName is required" + pattern: + spec: + serviceAccountName: "?*" + - name: kustomizationSourceRefNamespace + exclude: + resources: + namespaces: + - flux-system + - ingress-nginx + - kyverno + - monitoring + - openebs + match: + resources: + kinds: + - Kustomization + preconditions: + any: + - key: "{{request.object.spec.sourceRef.namespace}}" + operator: NotEquals + value: "" + validate: + message: "spec.sourceRef.namespace must be the same as metadata.namespace" + deny: + conditions: + - key: "{{request.object.spec.sourceRef.namespace}}" + operator: NotEquals + value: "{{request.object.metadata.namespace}}" + - name: helmReleaseSourceRefNamespace + exclude: + resources: + namespaces: + - flux-system + - ingress-nginx + - kyverno + - monitoring + - openebs + match: + resources: + kinds: + - HelmRelease + preconditions: + any: + - key: "{{request.object.spec.chart.spec.sourceRef.namespace}}" + operator: NotEquals + value: "" + validate: + message: "spec.chart.spec.sourceRef.namespace must be the same as metadata.namespace" + deny: + conditions: + - key: "{{request.object.spec.chart.spec.sourceRef.namespace}}" + operator: NotEquals + value: "{{request.object.metadata.namespace}}" diff --git a/k8s/M6-monitoring-components.yaml b/k8s/M6-monitoring-components.yaml new file mode 100644 index 00000000..ae0569d3 --- /dev/null +++ b/k8s/M6-monitoring-components.yaml @@ -0,0 +1,29 @@ +apiVersion: v1 +kind: Namespace +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + pod-security.kubernetes.io/warn: restricted + pod-security.kubernetes.io/warn-version: latest + name: monitoring +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: grafana + namespace: monitoring +spec: + ingressClassName: nginx + rules: + - host: grafana.test.metal.mybestdomain.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: kube-prometheus-stack-grafana + port: + number: 80 diff --git a/k8s/M6-network-policies.yaml b/k8s/M6-network-policies.yaml new file mode 100644 index 00000000..4d87a658 --- /dev/null +++ b/k8s/M6-network-policies.yaml @@ -0,0 +1,35 @@ +--- +kind: NetworkPolicy +apiVersion: networking.k8s.io/v1 +metadata: + name: deny-from-other-namespaces +spec: + podSelector: {} + ingress: + - from: + - podSelector: {} +--- +kind: NetworkPolicy +apiVersion: networking.k8s.io/v1 +metadata: + name: allow-webui +spec: + podSelector: + matchLabels: + app: web + ingress: + - from: [] +--- +kind: NetworkPolicy +apiVersion: networking.k8s.io/v1 +metadata: + name: allow-db +spec: + podSelector: + matchLabels: + app: db + ingress: + - from: + - podSelector: + matchLabels: + app: web diff --git a/k8s/M6-openebs-components.yaml b/k8s/M6-openebs-components.yaml new file mode 100644 index 00000000..d44b3b2b --- /dev/null +++ b/k8s/M6-openebs-components.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: Namespace +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + pod-security.kubernetes.io/warn: restricted + pod-security.kubernetes.io/warn-version: latest + name: openebs diff --git a/k8s/M6-openebs-kustomization.yaml b/k8s/M6-openebs-kustomization.yaml new file mode 100644 index 00000000..d4db7615 --- /dev/null +++ b/k8s/M6-openebs-kustomization.yaml @@ -0,0 +1,12 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: openebs +resources: + - M6-openebs-components.yaml + - sync.yaml +configMapGenerator: + - name: openebs-values + files: + - values.yaml=M6-openebs-values.yaml +configurations: + - M6-openebs-kustomizeconfig.yaml diff --git a/k8s/M6-openebs-kustomizeconfig.yaml b/k8s/M6-openebs-kustomizeconfig.yaml new file mode 100644 index 00000000..7c31b227 --- /dev/null +++ b/k8s/M6-openebs-kustomizeconfig.yaml @@ -0,0 +1,6 @@ +nameReference: +- kind: ConfigMap + version: v1 + fieldSpecs: + - path: spec/valuesFrom/name + kind: HelmRelease diff --git a/k8s/M6-openebs-values.yaml b/k8s/M6-openebs-values.yaml new file mode 100644 index 00000000..57f563c9 --- /dev/null +++ b/k8s/M6-openebs-values.yaml @@ -0,0 +1,15 @@ +# helm install openebs --namespace openebs openebs/openebs +# --set engines.replicated.mayastor.enabled=false +# --set lvm-localpv.lvmNode.kubeletDir=/var/lib/k0s/kubelet/ +# --create-namespace +engines: + replicated: + mayastor: + enabled: false +# Needed for k0s install since kubelet install is slightly divergent from vanilla install >:-( +lvm-localpv: + lvmNode: + kubeletDir: /var/lib/k0s/kubelet/ +localprovisioner: + hostpathClass: + isDefaultClass: true diff --git a/k8s/M6-rocky-cluster-role.yaml b/k8s/M6-rocky-cluster-role.yaml new file mode 100644 index 00000000..7297de15 --- /dev/null +++ b/k8s/M6-rocky-cluster-role.yaml @@ -0,0 +1,38 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + namespace: rocky-test + name: rocky-full-access +rules: +- apiGroups: ["", extensions, apps] + resources: [deployments, replicasets, pods, services, ingresses, statefulsets] + verbs: [get, list, watch, create, update, patch, delete] # You can also use [*] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: rocky-pv-access +rules: +- apiGroups: [""] + resources: [persistentvolumes] + verbs: [get, list, watch, create, patch] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + toolkit.fluxcd.io/tenant: rocky + name: rocky-reconciler2 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: rocky-pv-access +subjects: +- apiGroup: rbac.authorization.k8s.io + kind: User + name: gotk:rocky-test:reconciler +- kind: ServiceAccount + name: rocky + namespace: rocky-test + \ No newline at end of file diff --git a/k8s/M6-rocky-ingress.yaml b/k8s/M6-rocky-ingress.yaml new file mode 100644 index 00000000..68323173 --- /dev/null +++ b/k8s/M6-rocky-ingress.yaml @@ -0,0 +1,19 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: rocky + namespace: rocky-test +spec: + ingressClassName: nginx + rules: + - host: rocky.test.mybestdomain.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: web + port: + number: 80 + diff --git a/k8s/M6-rocky-test-kustomization.yaml b/k8s/M6-rocky-test-kustomization.yaml new file mode 100644 index 00000000..ccaf2d90 --- /dev/null +++ b/k8s/M6-rocky-test-kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../../base/rocky +patches: + - path: M6-rocky-test-patch.yaml + target: + kind: Kustomization diff --git a/k8s/M6-rocky-test-patch.yaml b/k8s/M6-rocky-test-patch.yaml new file mode 100644 index 00000000..b70fbb4e --- /dev/null +++ b/k8s/M6-rocky-test-patch.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1beta1 +kind: Kustomization +metadata: + name: rocky + namespace: rocky-test +spec: + path: ./k8s/plain