refactor: 폴더 구조 변경
This commit is contained in:
donghyeon-ka
@@ -0,0 +1,6 @@
|
||||
# gitops/platform AGENTS
|
||||
|
||||
Shared platform services and environment-neutral operator sources live in
|
||||
unit-level `base` directories. Cluster-specific CIDRs, namespaces, ingress,
|
||||
service mesh, load balancer, and K3s packaged-component configuration belong
|
||||
in focused overlays selected by a cluster stage.
|
||||
@@ -0,0 +1,23 @@
|
||||
# Platform Catalog
|
||||
|
||||
클러스터 전체에서 사용하는 addon과 controller의 재사용 구성을 둡니다.
|
||||
|
||||
예:
|
||||
|
||||
```text
|
||||
platform/
|
||||
├── ingress/
|
||||
├── certificates/
|
||||
├── external-dns/
|
||||
├── external-secrets/
|
||||
├── storage/
|
||||
├── autoscaling/
|
||||
└── observability/
|
||||
```
|
||||
|
||||
실제로 사용하는 항목만 만듭니다. 각 component는 자신의 CRD, controller,
|
||||
configuration과 values/patch를 응집해서 관리합니다. component 간 숨은 의존을
|
||||
만들지 말고 cluster root 또는 선택한 GitOps controller의 ordering 기능으로
|
||||
순서를 표현합니다.
|
||||
|
||||
새 component는 `_template`을 복사해 시작합니다.
|
||||
@@ -0,0 +1,21 @@
|
||||
# __REPLACE_ME_PLATFORM_COMPONENT_NAME__
|
||||
|
||||
## 책임
|
||||
|
||||
이 component가 소유하는 CRD, controller와 configuration을 적습니다.
|
||||
|
||||
## 의존성
|
||||
|
||||
선행 component, namespace, identity와 최소 Kubernetes version을 적습니다.
|
||||
|
||||
## 구성
|
||||
|
||||
- `base`: 모든 대상에서 공유하는 기본값
|
||||
- `overlays`: 환경/규모별 차이가 실제로 있을 때만 추가
|
||||
|
||||
Helm을 사용하면 chart source/version, values와 release 리소스를 이 component
|
||||
안에 함께 둡니다. 원격 version은 고정합니다.
|
||||
|
||||
## 운영
|
||||
|
||||
upgrade 순서, health check, rollback과 uninstall 영향을 runbook으로 연결합니다.
|
||||
@@ -0,0 +1,7 @@
|
||||
# Base
|
||||
|
||||
환경과 클러스터를 모르는 재사용 가능한 기본 manifest만 둡니다.
|
||||
|
||||
- 실제 domain, account ID, credential을 하드코딩하지 않습니다.
|
||||
- resource request/limit와 security context의 안전한 기본값을 둡니다.
|
||||
- 환경 차이는 `overlays`에서 patch합니다.
|
||||
@@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources: []
|
||||
@@ -0,0 +1,7 @@
|
||||
# Overlays
|
||||
|
||||
공통 base와 다른 값이 있을 때만 `<environment-or-profile>/` overlay를 만듭니다.
|
||||
overlay는 base를 참조하고 patch만 포함해야 합니다.
|
||||
|
||||
`dev`, `prod` 전체 manifest 복사보다 replica, resource, retention처럼 실제로
|
||||
달라지는 항목만 표현합니다.
|
||||
@@ -0,0 +1,5 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- https://github.com/cert-manager/cert-manager/releases/download/v1.20.2/cert-manager.yaml
|
||||
@@ -0,0 +1,95 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ../../base
|
||||
|
||||
labels:
|
||||
- pairs:
|
||||
app.kubernetes.io/part-of: certificate-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
includeSelectors: false
|
||||
includeTemplates: true
|
||||
|
||||
patches:
|
||||
- target:
|
||||
kind: Deployment
|
||||
name: cert-manager
|
||||
patch: |-
|
||||
- op: add
|
||||
path: /spec/revisionHistoryLimit
|
||||
value: 5
|
||||
- op: add
|
||||
path: /spec/progressDeadlineSeconds
|
||||
value: 600
|
||||
- op: add
|
||||
path: /spec/template/spec/securityContext/runAsUser
|
||||
value: 1000
|
||||
- op: add
|
||||
path: /spec/template/spec/securityContext/runAsGroup
|
||||
value: 1000
|
||||
- op: add
|
||||
path: /spec/template/spec/securityContext/fsGroup
|
||||
value: 1000
|
||||
- op: add
|
||||
path: /spec/template/spec/containers/0/resources
|
||||
value:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 64Mi
|
||||
limits:
|
||||
memory: 256Mi
|
||||
- target:
|
||||
kind: Deployment
|
||||
name: cert-manager-cainjector
|
||||
patch: |-
|
||||
- op: add
|
||||
path: /spec/revisionHistoryLimit
|
||||
value: 5
|
||||
- op: add
|
||||
path: /spec/progressDeadlineSeconds
|
||||
value: 600
|
||||
- op: add
|
||||
path: /spec/template/spec/securityContext/runAsUser
|
||||
value: 1000
|
||||
- op: add
|
||||
path: /spec/template/spec/securityContext/runAsGroup
|
||||
value: 1000
|
||||
- op: add
|
||||
path: /spec/template/spec/securityContext/fsGroup
|
||||
value: 1000
|
||||
- op: add
|
||||
path: /spec/template/spec/containers/0/resources
|
||||
value:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 64Mi
|
||||
limits:
|
||||
memory: 256Mi
|
||||
- target:
|
||||
kind: Deployment
|
||||
name: cert-manager-webhook
|
||||
patch: |-
|
||||
- op: add
|
||||
path: /spec/revisionHistoryLimit
|
||||
value: 5
|
||||
- op: add
|
||||
path: /spec/progressDeadlineSeconds
|
||||
value: 600
|
||||
- op: add
|
||||
path: /spec/template/spec/securityContext/runAsUser
|
||||
value: 1000
|
||||
- op: add
|
||||
path: /spec/template/spec/securityContext/runAsGroup
|
||||
value: 1000
|
||||
- op: add
|
||||
path: /spec/template/spec/securityContext/fsGroup
|
||||
value: 1000
|
||||
- op: add
|
||||
path: /spec/template/spec/containers/0/resources
|
||||
value:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 64Mi
|
||||
limits:
|
||||
memory: 128Mi
|
||||
@@ -0,0 +1,115 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: oauth2-proxy
|
||||
spec:
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 5
|
||||
progressDeadlineSeconds: 600
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 0
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: oauth2-proxy
|
||||
app.kubernetes.io/instance: oauth2-proxy
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: oauth2-proxy
|
||||
app.kubernetes.io/instance: oauth2-proxy
|
||||
spec:
|
||||
serviceAccountName: oauth2-proxy-sa
|
||||
automountServiceAccountToken: false
|
||||
terminationGracePeriodSeconds: 30
|
||||
topologySpreadConstraints:
|
||||
- maxSkew: 1
|
||||
topologyKey: kubernetes.io/hostname
|
||||
whenUnsatisfiable: ScheduleAnyway
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: oauth2-proxy
|
||||
app.kubernetes.io/instance: oauth2-proxy
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
fsGroup: 65532
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: oauth2-proxy
|
||||
image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.2
|
||||
imagePullPolicy: IfNotPresent
|
||||
args:
|
||||
- --config=/etc/oauth2-proxy/oauth2-proxy.cfg
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 4180
|
||||
protocol: TCP
|
||||
- name: metrics
|
||||
containerPort: 44180
|
||||
protocol: TCP
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
memory: 256Mi
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /ping
|
||||
port: http
|
||||
periodSeconds: 5
|
||||
failureThreshold: 12
|
||||
timeoutSeconds: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ready
|
||||
port: http
|
||||
periodSeconds: 10
|
||||
failureThreshold: 3
|
||||
timeoutSeconds: 3
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /ping
|
||||
port: http
|
||||
periodSeconds: 15
|
||||
failureThreshold: 3
|
||||
timeoutSeconds: 3
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
allowPrivilegeEscalation: false
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /etc/oauth2-proxy
|
||||
readOnly: true
|
||||
- name: secrets
|
||||
mountPath: /etc/oauth2-proxy-secrets
|
||||
readOnly: true
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: oauth2-proxy-config
|
||||
- name: secrets
|
||||
secret:
|
||||
secretName: oauth2-proxy-secrets
|
||||
defaultMode: 0400
|
||||
- name: tmp
|
||||
emptyDir:
|
||||
medium: Memory
|
||||
sizeLimit: 64Mi
|
||||
@@ -0,0 +1,18 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- serviceaccount.yaml
|
||||
- service.yaml
|
||||
- deployment.yaml
|
||||
|
||||
labels:
|
||||
- pairs:
|
||||
app.kubernetes.io/name: oauth2-proxy
|
||||
app.kubernetes.io/instance: oauth2-proxy
|
||||
app.kubernetes.io/version: "7.15.2"
|
||||
app.kubernetes.io/component: auth-proxy
|
||||
app.kubernetes.io/part-of: auth-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
includeSelectors: false
|
||||
includeTemplates: true
|
||||
@@ -0,0 +1,20 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: oauth2-proxy
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app.kubernetes.io/name: oauth2-proxy
|
||||
app.kubernetes.io/instance: oauth2-proxy
|
||||
ports:
|
||||
- name: http
|
||||
port: 4180
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
appProtocol: http
|
||||
- name: metrics
|
||||
port: 44180
|
||||
targetPort: metrics
|
||||
protocol: TCP
|
||||
appProtocol: http
|
||||
@@ -0,0 +1,5 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: oauth2-proxy-sa
|
||||
automountServiceAccountToken: false
|
||||
@@ -0,0 +1,18 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1alpha1
|
||||
kind: Component
|
||||
|
||||
resources:
|
||||
- ../base
|
||||
- oauth2-proxy-config.yaml
|
||||
- oauth2-proxy-ingress.yaml
|
||||
- oauth2-proxy-middleware.yaml
|
||||
- oauth2-proxy-networkpolicy.yaml
|
||||
|
||||
patches:
|
||||
- target:
|
||||
kind: Ingress
|
||||
name: auth-server
|
||||
patch: |-
|
||||
- op: replace
|
||||
path: /metadata/annotations/traefik.ingress.kubernetes.io~1router.middlewares
|
||||
value: mnt-oauth2-proxy-errors@kubernetescrd,mnt-oauth2-proxy-auth@kubernetescrd,kube-system-security-headers@kubernetescrd
|
||||
@@ -0,0 +1,46 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: oauth2-proxy-config
|
||||
labels:
|
||||
app.kubernetes.io/name: oauth2-proxy
|
||||
app.kubernetes.io/instance: oauth2-proxy
|
||||
app.kubernetes.io/version: "7.15.2"
|
||||
app.kubernetes.io/component: auth-proxy
|
||||
app.kubernetes.io/part-of: auth-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
data:
|
||||
oauth2-proxy.cfg: |
|
||||
provider = "keycloak-oidc"
|
||||
http_address = "0.0.0.0:4180"
|
||||
metrics_address = "0.0.0.0:44180"
|
||||
redirect_url = "http://auth.local.test/oauth2/callback"
|
||||
|
||||
oidc_issuer_url = "http://keycloak.local.test/realms/platform"
|
||||
skip_oidc_discovery = true
|
||||
login_url = "http://keycloak.local.test/realms/platform/protocol/openid-connect/auth"
|
||||
redeem_url = "http://keycloak.mnt.svc.cluster.local/realms/platform/protocol/openid-connect/token"
|
||||
profile_url = "http://keycloak.mnt.svc.cluster.local/realms/platform/protocol/openid-connect/userinfo"
|
||||
validate_url = "http://keycloak.mnt.svc.cluster.local/realms/platform/protocol/openid-connect/userinfo"
|
||||
oidc_jwks_url = "http://keycloak.mnt.svc.cluster.local/realms/platform/protocol/openid-connect/certs"
|
||||
|
||||
client_id = "auth-server-ingress"
|
||||
client_secret_file = "/etc/oauth2-proxy-secrets/client-secret"
|
||||
cookie_secret_file = "/etc/oauth2-proxy-secrets/cookie-secret"
|
||||
reverse_proxy = true
|
||||
upstreams = [ "static://202" ]
|
||||
email_domains = [ "*" ]
|
||||
scope = "openid profile email"
|
||||
insecure_oidc_allow_unverified_email = true
|
||||
skip_provider_button = true
|
||||
cookie_secure = false
|
||||
cookie_samesite = "lax"
|
||||
cookie_csrf_per_request = true
|
||||
cookie_refresh = "4m"
|
||||
set_xauthrequest = true
|
||||
set_authorization_header = true
|
||||
pass_access_token = true
|
||||
pass_authorization_header = true
|
||||
ssl_insecure_skip_verify = false
|
||||
whitelist_domains = [ "auth.local.test" ]
|
||||
trusted_proxy_ips = [ "10.42.0.0/16" ]
|
||||
@@ -0,0 +1,27 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: oauth2-proxy
|
||||
labels:
|
||||
app.kubernetes.io/name: oauth2-proxy
|
||||
app.kubernetes.io/instance: oauth2-proxy
|
||||
app.kubernetes.io/version: "7.15.2"
|
||||
app.kubernetes.io/component: auth-proxy
|
||||
app.kubernetes.io/part-of: auth-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: web
|
||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-security-headers@kubernetescrd
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
rules:
|
||||
- host: auth.local.test
|
||||
http:
|
||||
paths:
|
||||
- path: /oauth2/
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: oauth2-proxy
|
||||
port:
|
||||
name: http
|
||||
@@ -0,0 +1,45 @@
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: oauth2-proxy-auth
|
||||
labels:
|
||||
app.kubernetes.io/name: oauth2-proxy
|
||||
app.kubernetes.io/instance: oauth2-proxy
|
||||
app.kubernetes.io/version: "7.15.2"
|
||||
app.kubernetes.io/component: auth-proxy
|
||||
app.kubernetes.io/part-of: auth-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
spec:
|
||||
forwardAuth:
|
||||
address: http://oauth2-proxy.mnt.svc.cluster.local:4180/oauth2/auth
|
||||
trustForwardHeader: true
|
||||
authResponseHeaders:
|
||||
- Authorization
|
||||
- X-Auth-Request-Access-Token
|
||||
- X-Auth-Request-Email
|
||||
- X-Auth-Request-Preferred-Username
|
||||
- X-Auth-Request-User
|
||||
- X-Forwarded-Email
|
||||
- X-Forwarded-User
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: oauth2-proxy-errors
|
||||
labels:
|
||||
app.kubernetes.io/name: oauth2-proxy
|
||||
app.kubernetes.io/instance: oauth2-proxy
|
||||
app.kubernetes.io/version: "7.15.2"
|
||||
app.kubernetes.io/component: auth-proxy
|
||||
app.kubernetes.io/part-of: auth-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
spec:
|
||||
errors:
|
||||
status:
|
||||
- "401"
|
||||
statusRewrites:
|
||||
"401": 302
|
||||
service:
|
||||
name: oauth2-proxy
|
||||
port: 4180
|
||||
query: /oauth2/start?rd={url}
|
||||
@@ -0,0 +1,55 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: oauth2-proxy-ingress-traefik
|
||||
labels:
|
||||
app.kubernetes.io/name: oauth2-proxy
|
||||
app.kubernetes.io/instance: oauth2-proxy
|
||||
app.kubernetes.io/component: auth-proxy
|
||||
app.kubernetes.io/part-of: auth-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: oauth2-proxy
|
||||
app.kubernetes.io/instance: oauth2-proxy
|
||||
policyTypes:
|
||||
- Ingress
|
||||
ingress:
|
||||
- from:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: kube-system
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: traefik
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 4180
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: oauth2-proxy-egress-keycloak
|
||||
labels:
|
||||
app.kubernetes.io/name: oauth2-proxy
|
||||
app.kubernetes.io/instance: oauth2-proxy
|
||||
app.kubernetes.io/component: auth-proxy
|
||||
app.kubernetes.io/part-of: auth-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: oauth2-proxy
|
||||
app.kubernetes.io/instance: oauth2-proxy
|
||||
policyTypes:
|
||||
- Egress
|
||||
egress:
|
||||
- to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: keycloak
|
||||
app.kubernetes.io/managed-by: keycloak-operator
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8080
|
||||
@@ -0,0 +1,7 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
namespace: mnt
|
||||
|
||||
components:
|
||||
- ../../component
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.6.1/kubernetes/keycloaks.k8s.keycloak.org-v1.yml
|
||||
- https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.6.1/kubernetes/keycloakrealmimports.k8s.keycloak.org-v1.yml
|
||||
- https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.6.1/kubernetes/kubernetes.yml
|
||||
|
||||
@@ -0,0 +1,67 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
namespace: mnt
|
||||
|
||||
resources:
|
||||
- ../../base
|
||||
- networkpolicy.yaml
|
||||
|
||||
labels:
|
||||
- pairs:
|
||||
app.kubernetes.io/instance: keycloak-operator
|
||||
app.kubernetes.io/component: identity-operator
|
||||
app.kubernetes.io/part-of: auth-platform
|
||||
includeSelectors: false
|
||||
includeTemplates: true
|
||||
|
||||
patches:
|
||||
- target:
|
||||
kind: ClusterRoleBinding
|
||||
name: keycloak-operator-clusterrole-binding
|
||||
patch: |-
|
||||
- op: replace
|
||||
path: /subjects/0/namespace
|
||||
value: mnt
|
||||
- target:
|
||||
kind: Deployment
|
||||
name: keycloak-operator
|
||||
patch: |-
|
||||
- op: add
|
||||
path: /spec/revisionHistoryLimit
|
||||
value: 5
|
||||
- op: add
|
||||
path: /spec/progressDeadlineSeconds
|
||||
value: 600
|
||||
- op: add
|
||||
path: /spec/template/spec/securityContext
|
||||
value:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
- op: add
|
||||
path: /spec/template/spec/containers/0/securityContext
|
||||
value:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
- op: add
|
||||
path: /spec/template/spec/containers/0/volumeMounts
|
||||
value:
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
- op: add
|
||||
path: /spec/template/spec/volumes
|
||||
value:
|
||||
- name: tmp
|
||||
emptyDir:
|
||||
sizeLimit: 128Mi
|
||||
- op: replace
|
||||
path: /spec/template/spec/containers/0/startupProbe/failureThreshold
|
||||
value: 18
|
||||
@@ -0,0 +1,29 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: keycloak-operator-egress-kubernetes-api
|
||||
labels:
|
||||
app.kubernetes.io/name: keycloak-operator
|
||||
app.kubernetes.io/instance: keycloak-operator
|
||||
app.kubernetes.io/component: identity-operator
|
||||
app.kubernetes.io/part-of: auth-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: keycloak-operator
|
||||
policyTypes:
|
||||
- Egress
|
||||
egress:
|
||||
- to:
|
||||
- ipBlock:
|
||||
cidr: 10.43.0.0/16
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 443
|
||||
- to:
|
||||
- ipBlock:
|
||||
cidr: 10.208.141.0/24
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 6443
|
||||
@@ -0,0 +1,113 @@
|
||||
apiVersion: k8s.keycloak.org/v2beta1
|
||||
kind: Keycloak
|
||||
metadata:
|
||||
name: keycloak
|
||||
labels:
|
||||
app.kubernetes.io/name: keycloak
|
||||
app.kubernetes.io/instance: keycloak
|
||||
app.kubernetes.io/version: "26.6.1"
|
||||
app.kubernetes.io/component: identity-provider
|
||||
app.kubernetes.io/part-of: auth-platform
|
||||
app.kubernetes.io/managed-by: keycloak-operator
|
||||
spec:
|
||||
instances: 2
|
||||
db:
|
||||
vendor: postgres
|
||||
host: identity-postgres
|
||||
port: 5432
|
||||
database: keycloak
|
||||
usernameSecret:
|
||||
name: keycloak-db-operator
|
||||
key: username
|
||||
passwordSecret:
|
||||
name: keycloak-db-operator
|
||||
key: password
|
||||
poolInitialSize: 5
|
||||
poolMinSize: 5
|
||||
poolMaxSize: 20
|
||||
bootstrapAdmin:
|
||||
user:
|
||||
secret: keycloak-bootstrap-admin-operator # 어떤 시크릿에서 읽을지 지정하는 거
|
||||
hostname:
|
||||
strict: true # 명시된 hostname을 기준으로 URL을 만든다.
|
||||
backchannelDynamic: false # 백URL도 프론트 hostname과 동일하게 고정한다.
|
||||
http:
|
||||
httpEnabled: true
|
||||
httpPort: 8080
|
||||
serviceHttpPort: 80
|
||||
serviceName: keycloak
|
||||
labels:
|
||||
app.kubernetes.io/name: keycloak
|
||||
app.kubernetes.io/instance: keycloak
|
||||
app.kubernetes.io/component: identity-provider
|
||||
app.kubernetes.io/part-of: auth-platform
|
||||
app.kubernetes.io/managed-by: keycloak-operator
|
||||
proxy:
|
||||
headers: xforwarded # X-Forwarded-For X-Forwarded-Proto X-Forwarded-Host X-Forwarded-Port 해당 헤더들을 사용하겠다는 의미
|
||||
ingress:
|
||||
enabled: false
|
||||
networkPolicy:
|
||||
enabled: false
|
||||
additionalOptions:
|
||||
- name: cache
|
||||
value: ispn # 애플리케이션의 캐시 엔진으로 ispn으로 사용
|
||||
- name: cache-stack
|
||||
value: jdbc-ping # 클러스터링된 서버끼리 서로를 찾는(Discovery) 방식을 JDBC-PING으로 정한 것
|
||||
- name: health-enabled
|
||||
value: "true" # 상태 확인(Health Check) 엔드포인트를 활성화
|
||||
- name: metrics-enabled
|
||||
value: "true" # 메트릭(성능 지표) 수집 기능을 켬
|
||||
- name: log-console-output
|
||||
value: json # 로그 형식을 JSON 구조로 변경
|
||||
env:
|
||||
- name: JAVA_OPTS_APPEND
|
||||
value: "-XX:MaxRAMPercentage=70 -XX:InitialRAMPercentage=50 -XX:+ExitOnOutOfMemoryError"
|
||||
resources:
|
||||
requests:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 2Gi
|
||||
scheduling:
|
||||
topologySpreadConstraints:
|
||||
- maxSkew: 1
|
||||
topologyKey: kubernetes.io/hostname
|
||||
whenUnsatisfiable: ScheduleAnyway
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: keycloak
|
||||
app.kubernetes.io/managed-by: keycloak-operator
|
||||
affinity: # 특정 노드에 다른 pod에 관계에 따라 배치 위치를 결정하는 규칙을 정의한다
|
||||
podAntiAffinity: # 특정 조건을 만족하는 포드와는 같은 장소에 있지 않는다.
|
||||
preferredDuringSchedulingIgnoredDuringExecution: # 가급적 지켜줘
|
||||
- weight: 100 # 가중치가 100임 매우 중요하다고 알림
|
||||
podAffinityTerm: # 어떤 파드를 피해다닐지
|
||||
topologyKey: kubernetes.io/hostname # 피할 기준은 호스트 네임으로 설정
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: keycloak # keycloak과 피하겠다
|
||||
app.kubernetes.io/managed-by: keycloak-operator # keycloak-operator에 의해 관리되는
|
||||
unsupported:
|
||||
podTemplate:
|
||||
spec:
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: keycloak
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- keycloak.yaml
|
||||
labels:
|
||||
- pairs:
|
||||
app.kubernetes.io/name: keycloak
|
||||
app.kubernetes.io/instance: keycloak
|
||||
app.kubernetes.io/version: "26.6.1"
|
||||
app.kubernetes.io/component: identity-provider
|
||||
app.kubernetes.io/part-of: auth-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
includeSelectors: false
|
||||
includeTemplates: true
|
||||
@@ -0,0 +1,27 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: keycloak-admin
|
||||
labels:
|
||||
app.kubernetes.io/name: keycloak
|
||||
app.kubernetes.io/instance: keycloak
|
||||
app.kubernetes.io/version: "26.6.1"
|
||||
app.kubernetes.io/component: identity-provider
|
||||
app.kubernetes.io/part-of: auth-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: web
|
||||
traefik.ingress.kubernetes.io/router.middlewares: mnt-keycloak-security-headers@kubernetescrd
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
rules:
|
||||
- host: keycloak-admin.local.test
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: keycloak
|
||||
port:
|
||||
name: http
|
||||
@@ -0,0 +1,48 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: keycloak-public
|
||||
labels:
|
||||
app.kubernetes.io/name: keycloak
|
||||
app.kubernetes.io/instance: keycloak
|
||||
app.kubernetes.io/version: "26.6.1"
|
||||
app.kubernetes.io/component: identity-provider
|
||||
app.kubernetes.io/part-of: auth-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: web
|
||||
traefik.ingress.kubernetes.io/router.middlewares: mnt-keycloak-security-headers@kubernetescrd # frameDeny 제외 — admin 콘솔의 silent SSO iframe 허용
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
rules:
|
||||
- host: keycloak.local.test
|
||||
http:
|
||||
paths:
|
||||
- path: /realms/
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: keycloak
|
||||
port:
|
||||
name: http
|
||||
- path: /resources/
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: keycloak
|
||||
port:
|
||||
name: http
|
||||
- path: /.well-known/
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: keycloak
|
||||
port:
|
||||
name: http
|
||||
- path: /js/
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: keycloak
|
||||
port:
|
||||
name: http
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: k8s.keycloak.org/v2beta1
|
||||
kind: Keycloak
|
||||
metadata:
|
||||
name: keycloak
|
||||
spec:
|
||||
hostname:
|
||||
hostname: http://keycloak.local.test
|
||||
admin: http://keycloak-admin.local.test
|
||||
@@ -0,0 +1,17 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
namespace: mnt
|
||||
|
||||
resources:
|
||||
- ../../base
|
||||
- middleware.yaml
|
||||
- ingress-public.yaml
|
||||
- ingress-admin.yaml
|
||||
- networkpolicy.yaml
|
||||
|
||||
patches:
|
||||
- target:
|
||||
kind: Keycloak
|
||||
name: keycloak
|
||||
path: keycloak-hostname-patch.yaml
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: keycloak-security-headers
|
||||
labels:
|
||||
app.kubernetes.io/name: keycloak
|
||||
app.kubernetes.io/instance: keycloak
|
||||
app.kubernetes.io/component: identity-provider
|
||||
app.kubernetes.io/part-of: auth-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
spec:
|
||||
headers:
|
||||
browserXssFilter: true
|
||||
contentTypeNosniff: true
|
||||
referrerPolicy: strict-origin-when-cross-origin
|
||||
@@ -0,0 +1,140 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: keycloak-peer
|
||||
labels:
|
||||
app.kubernetes.io/name: keycloak
|
||||
app.kubernetes.io/instance: keycloak
|
||||
app.kubernetes.io/component: identity-provider
|
||||
app.kubernetes.io/part-of: auth-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: keycloak
|
||||
app.kubernetes.io/managed-by: keycloak-operator
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
ingress:
|
||||
- from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: keycloak
|
||||
app.kubernetes.io/managed-by: keycloak-operator
|
||||
egress:
|
||||
- to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: keycloak
|
||||
app.kubernetes.io/managed-by: keycloak-operator
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: keycloak-ingress-traefik
|
||||
labels:
|
||||
app.kubernetes.io/name: keycloak
|
||||
app.kubernetes.io/instance: keycloak
|
||||
app.kubernetes.io/component: identity-provider
|
||||
app.kubernetes.io/part-of: auth-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: keycloak
|
||||
app.kubernetes.io/managed-by: keycloak-operator
|
||||
policyTypes:
|
||||
- Ingress
|
||||
ingress:
|
||||
- from:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: kube-system
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: traefik
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8080
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: keycloak-egress-postgres
|
||||
labels:
|
||||
app.kubernetes.io/name: keycloak
|
||||
app.kubernetes.io/instance: keycloak
|
||||
app.kubernetes.io/component: identity-provider
|
||||
app.kubernetes.io/part-of: auth-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: keycloak
|
||||
app.kubernetes.io/managed-by: keycloak-operator
|
||||
policyTypes:
|
||||
- Egress
|
||||
egress:
|
||||
- to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: identity-postgres
|
||||
app.kubernetes.io/instance: identity-postgres
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 5432
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: keycloak-ingress-auth-server
|
||||
labels:
|
||||
app.kubernetes.io/name: keycloak
|
||||
app.kubernetes.io/instance: keycloak
|
||||
app.kubernetes.io/component: identity-provider
|
||||
app.kubernetes.io/part-of: auth-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: keycloak
|
||||
app.kubernetes.io/managed-by: keycloak-operator
|
||||
policyTypes:
|
||||
- Ingress
|
||||
ingress:
|
||||
- from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: auth-server
|
||||
app.kubernetes.io/instance: auth-server
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8080
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: keycloak-ingress-oauth2-proxy
|
||||
labels:
|
||||
app.kubernetes.io/name: keycloak
|
||||
app.kubernetes.io/instance: keycloak
|
||||
app.kubernetes.io/component: identity-provider
|
||||
app.kubernetes.io/part-of: auth-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: keycloak
|
||||
app.kubernetes.io/managed-by: keycloak-operator
|
||||
policyTypes:
|
||||
- Ingress
|
||||
ingress:
|
||||
- from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: oauth2-proxy
|
||||
app.kubernetes.io/instance: oauth2-proxy
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8080
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- tenant.yaml
|
||||
labels:
|
||||
- pairs:
|
||||
app.kubernetes.io/name: minio
|
||||
app.kubernetes.io/instance: minio
|
||||
app.kubernetes.io/version: "2025.01.20"
|
||||
app.kubernetes.io/component: object-storage
|
||||
app.kubernetes.io/part-of: storage-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
includeSelectors: false
|
||||
includeTemplates: true
|
||||
@@ -0,0 +1,92 @@
|
||||
apiVersion: minio.min.io/v2
|
||||
kind: Tenant
|
||||
metadata:
|
||||
name: minio
|
||||
labels:
|
||||
app.kubernetes.io/name: minio
|
||||
app.kubernetes.io/instance: minio
|
||||
app.kubernetes.io/version: "2025.01.20"
|
||||
app.kubernetes.io/component: object-storage
|
||||
app.kubernetes.io/part-of: storage-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
spec:
|
||||
image: minio/minio:RELEASE.2025-01-20T14-49-07Z
|
||||
imagePullPolicy: IfNotPresent
|
||||
mountPath: /export
|
||||
configuration:
|
||||
name: minio-tenant-env
|
||||
requestAutoCert: true
|
||||
certConfig:
|
||||
commonName: minio
|
||||
organizationName:
|
||||
- example.com
|
||||
dnsNames:
|
||||
- minio
|
||||
- minio-hl
|
||||
pools:
|
||||
- name: pool-0
|
||||
servers: 4
|
||||
volumesPerServer: 4
|
||||
volumeClaimTemplate:
|
||||
metadata:
|
||||
name: data
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 20Gi
|
||||
storageClassName: replace-in-overlay
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 1Gi
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containerSecurityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
features:
|
||||
bucketDNS: false
|
||||
prometheusOperator: false
|
||||
podManagementPolicy: Parallel
|
||||
exposeServices:
|
||||
minio: false
|
||||
console: false
|
||||
logging:
|
||||
anonymous: false
|
||||
json: true
|
||||
quiet: false
|
||||
---
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: minio-pdb
|
||||
labels:
|
||||
app.kubernetes.io/name: minio
|
||||
app.kubernetes.io/instance: minio
|
||||
app.kubernetes.io/version: "2025.01.20"
|
||||
app.kubernetes.io/component: object-storage
|
||||
app.kubernetes.io/part-of: storage-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
spec:
|
||||
maxUnavailable: 1
|
||||
unhealthyPodEvictionPolicy: AlwaysAllow
|
||||
selector:
|
||||
matchLabels:
|
||||
v1.min.io/tenant: minio
|
||||
@@ -0,0 +1,32 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
namespace: mnt
|
||||
|
||||
resources:
|
||||
- ../../base
|
||||
- networkpolicy.yaml
|
||||
|
||||
patches:
|
||||
- target:
|
||||
group: minio.min.io
|
||||
version: v2
|
||||
kind: Tenant
|
||||
name: minio
|
||||
patch: |-
|
||||
- op: replace
|
||||
path: /spec/certConfig/dnsNames
|
||||
value:
|
||||
- minio
|
||||
- minio-hl
|
||||
- minio.mnt.svc.cluster.local
|
||||
- "*.minio-hl.mnt.svc.cluster.local"
|
||||
- op: replace
|
||||
path: /spec/requestAutoCert
|
||||
value: false
|
||||
- op: replace
|
||||
path: /spec/pools/0/volumesPerServer
|
||||
value: 1
|
||||
- op: replace
|
||||
path: /spec/pools/0/volumeClaimTemplate/spec/storageClassName
|
||||
value: local-path
|
||||
@@ -0,0 +1,140 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: minio-ingress-peer
|
||||
labels:
|
||||
app.kubernetes.io/name: minio
|
||||
app.kubernetes.io/instance: minio
|
||||
app.kubernetes.io/component: object-storage
|
||||
app.kubernetes.io/part-of: storage-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
v1.min.io/tenant: minio
|
||||
policyTypes:
|
||||
- Ingress
|
||||
ingress:
|
||||
- from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
v1.min.io/tenant: minio
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 9000
|
||||
- protocol: TCP
|
||||
port: 9001
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: minio-ingress-operator
|
||||
labels:
|
||||
app.kubernetes.io/name: minio
|
||||
app.kubernetes.io/instance: minio
|
||||
app.kubernetes.io/component: object-storage
|
||||
app.kubernetes.io/part-of: storage-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
v1.min.io/tenant: minio
|
||||
policyTypes:
|
||||
- Ingress
|
||||
ingress:
|
||||
- from:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: minio-operator
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: minio-operator
|
||||
app.kubernetes.io/name: operator
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 9000
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: minio-ingress-clients
|
||||
labels:
|
||||
app.kubernetes.io/name: minio
|
||||
app.kubernetes.io/instance: minio
|
||||
app.kubernetes.io/component: object-storage
|
||||
app.kubernetes.io/part-of: storage-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
v1.min.io/tenant: minio
|
||||
policyTypes:
|
||||
- Ingress
|
||||
ingress:
|
||||
- from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/part-of: auth-platform
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/part-of: platform-registry
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 9000
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: minio-egress-peer
|
||||
labels:
|
||||
app.kubernetes.io/name: minio
|
||||
app.kubernetes.io/instance: minio
|
||||
app.kubernetes.io/component: object-storage
|
||||
app.kubernetes.io/part-of: storage-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
v1.min.io/tenant: minio
|
||||
policyTypes:
|
||||
- Egress
|
||||
egress:
|
||||
- to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
v1.min.io/tenant: minio
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 9000
|
||||
- protocol: TCP
|
||||
port: 9001
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: minio-egress-kubernetes-api
|
||||
labels:
|
||||
app.kubernetes.io/name: minio
|
||||
app.kubernetes.io/instance: minio
|
||||
app.kubernetes.io/component: object-storage
|
||||
app.kubernetes.io/part-of: storage-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
v1.min.io/tenant: minio
|
||||
policyTypes:
|
||||
- Egress
|
||||
egress:
|
||||
- to:
|
||||
- ipBlock:
|
||||
cidr: 10.43.0.0/16
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 443
|
||||
- to:
|
||||
- ipBlock:
|
||||
cidr: 10.208.141.0/24
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 6443
|
||||
Executable
+15
@@ -0,0 +1,15 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: docker-registry-config
|
||||
data:
|
||||
REGISTRY_HTTP_ADDR: "0.0.0.0:5000"
|
||||
REGISTRY_LOG_FORMATTER: "json"
|
||||
REGISTRY_STORAGE: "s3"
|
||||
REGISTRY_STORAGE_S3_REGION: "us-east-1"
|
||||
REGISTRY_STORAGE_S3_REGIONENDPOINT: "https://minio"
|
||||
REGISTRY_STORAGE_S3_BUCKET: "docker-registry"
|
||||
REGISTRY_STORAGE_S3_FORCEPATHSTYLE: "true"
|
||||
REGISTRY_STORAGE_S3_SKIPVERIFY: "true"
|
||||
REGISTRY_STORAGE_REDIRECT_DISABLE: "true"
|
||||
REGISTRY_STORAGE_DELETE_ENABLED: "true"
|
||||
@@ -0,0 +1,94 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: docker-registry
|
||||
spec:
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 5
|
||||
progressDeadlineSeconds: 600
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 0
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: docker-registry
|
||||
app.kubernetes.io/instance: docker-registry
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: docker-registry
|
||||
app.kubernetes.io/instance: docker-registry
|
||||
spec:
|
||||
serviceAccountName: docker-registry
|
||||
automountServiceAccountToken: false
|
||||
terminationGracePeriodSeconds: 45
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 10001
|
||||
runAsGroup: 10001
|
||||
fsGroup: 10001
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: registry
|
||||
image: registry:2.8.3
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 5000
|
||||
protocol: TCP
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: docker-registry-config
|
||||
- secretRef:
|
||||
name: docker-registry-minio
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
memory: 512Mi
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /v2/
|
||||
port: http
|
||||
periodSeconds: 5
|
||||
failureThreshold: 12
|
||||
timeoutSeconds: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /v2/
|
||||
port: http
|
||||
periodSeconds: 10
|
||||
failureThreshold: 3
|
||||
timeoutSeconds: 3
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /v2/
|
||||
port: http
|
||||
periodSeconds: 30
|
||||
failureThreshold: 3
|
||||
timeoutSeconds: 3
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 10001
|
||||
runAsGroup: 10001
|
||||
allowPrivilegeEscalation: false
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts:
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
volumes:
|
||||
- name: tmp
|
||||
emptyDir:
|
||||
medium: Memory
|
||||
sizeLimit: 64Mi
|
||||
+19
@@ -0,0 +1,19 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- serviceaccount.yaml
|
||||
- configmap.yaml
|
||||
- service.yaml
|
||||
- deployment.yaml
|
||||
|
||||
labels:
|
||||
- pairs:
|
||||
app.kubernetes.io/name: docker-registry
|
||||
app.kubernetes.io/instance: docker-registry
|
||||
app.kubernetes.io/version: "2.8.3"
|
||||
app.kubernetes.io/component: registry
|
||||
app.kubernetes.io/part-of: platform-registry
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
includeSelectors: false
|
||||
includeTemplates: true
|
||||
Executable
+15
@@ -0,0 +1,15 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: docker-registry
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app.kubernetes.io/name: docker-registry
|
||||
app.kubernetes.io/instance: docker-registry
|
||||
ports:
|
||||
- name: http
|
||||
port: 5000
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
appProtocol: http
|
||||
@@ -0,0 +1,5 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: docker-registry
|
||||
automountServiceAccountToken: false
|
||||
@@ -0,0 +1,27 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: docker-registry-public
|
||||
labels:
|
||||
app.kubernetes.io/name: docker-registry
|
||||
app.kubernetes.io/instance: docker-registry
|
||||
app.kubernetes.io/version: "2.8.3"
|
||||
app.kubernetes.io/component: registry
|
||||
app.kubernetes.io/part-of: platform-registry
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: web
|
||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-security-headers@kubernetescrd,mnt-docker-registry-basic-auth@kubernetescrd
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
rules:
|
||||
- host: registry.project.com
|
||||
http:
|
||||
paths:
|
||||
- path: /v2
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: docker-registry
|
||||
port:
|
||||
name: http
|
||||
@@ -0,0 +1,22 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
namespace: mnt
|
||||
|
||||
resources:
|
||||
- ../../base
|
||||
- middleware.yaml
|
||||
- ingress-public.yaml
|
||||
- networkpolicy.yaml
|
||||
|
||||
patches:
|
||||
- target:
|
||||
kind: ConfigMap
|
||||
name: docker-registry-config
|
||||
patch: |-
|
||||
- op: replace
|
||||
path: /data/REGISTRY_STORAGE_S3_REGIONENDPOINT
|
||||
value: http://minio
|
||||
- op: replace
|
||||
path: /data/REGISTRY_STORAGE_S3_SKIPVERIFY
|
||||
value: "false"
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: docker-registry-basic-auth
|
||||
labels:
|
||||
app.kubernetes.io/name: docker-registry
|
||||
app.kubernetes.io/instance: docker-registry
|
||||
app.kubernetes.io/component: registry
|
||||
app.kubernetes.io/part-of: platform-registry
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
spec:
|
||||
basicAuth:
|
||||
secret: docker-registry-basic-auth
|
||||
realm: docker-registry
|
||||
@@ -0,0 +1,82 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: docker-registry-ingress-intra
|
||||
labels:
|
||||
app.kubernetes.io/name: docker-registry
|
||||
app.kubernetes.io/instance: docker-registry
|
||||
app.kubernetes.io/component: registry
|
||||
app.kubernetes.io/part-of: platform-registry
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: docker-registry
|
||||
app.kubernetes.io/instance: docker-registry
|
||||
policyTypes:
|
||||
- Ingress
|
||||
ingress:
|
||||
- from:
|
||||
- podSelector: {}
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 5000
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: docker-registry-ingress-traefik
|
||||
labels:
|
||||
app.kubernetes.io/name: docker-registry
|
||||
app.kubernetes.io/instance: docker-registry
|
||||
app.kubernetes.io/component: registry
|
||||
app.kubernetes.io/part-of: platform-registry
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: docker-registry
|
||||
app.kubernetes.io/instance: docker-registry
|
||||
policyTypes:
|
||||
- Ingress
|
||||
ingress:
|
||||
- from:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: kube-system
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: traefik
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 5000
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: docker-registry-egress-minio
|
||||
labels:
|
||||
app.kubernetes.io/name: docker-registry
|
||||
app.kubernetes.io/instance: docker-registry
|
||||
app.kubernetes.io/component: registry
|
||||
app.kubernetes.io/part-of: platform-registry
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: docker-registry
|
||||
app.kubernetes.io/instance: docker-registry
|
||||
policyTypes:
|
||||
- Egress
|
||||
egress:
|
||||
- to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
v1.min.io/tenant: minio
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 80
|
||||
- protocol: TCP
|
||||
port: 443
|
||||
- protocol: TCP
|
||||
port: 9000
|
||||
+38
@@ -0,0 +1,38 @@
|
||||
defaultVaultConnection:
|
||||
enabled: false
|
||||
|
||||
controller:
|
||||
# VSO 는 전용 namespace 에 설치하지만 같은 restricted baseline 을 강제한다.
|
||||
podSecurityContext:
|
||||
runAsNonRoot: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
|
||||
manager:
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 64Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
|
||||
kubeRbacProxy:
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
|
||||
# kubeRBACProxy : metrics 접근 제어
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- serviceaccount.yaml
|
||||
- vault-connection.yaml
|
||||
- vault-auth.yaml
|
||||
|
||||
labels:
|
||||
- pairs:
|
||||
app.kubernetes.io/name: vault-secrets-operator
|
||||
app.kubernetes.io/instance: vso
|
||||
app.kubernetes.io/version: "0.9.0"
|
||||
app.kubernetes.io/component: secret-delivery
|
||||
app.kubernetes.io/part-of: security-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
includeSelectors: false
|
||||
includeTemplates: true
|
||||
@@ -0,0 +1,5 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: vault-secrets-operator
|
||||
automountServiceAccountToken: true
|
||||
+27
@@ -0,0 +1,27 @@
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultAuth
|
||||
metadata:
|
||||
name: vault-auth-auth-platform
|
||||
spec:
|
||||
vaultConnectionRef: vault-connection
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
kubernetes:
|
||||
role: vso-auth-platform
|
||||
serviceAccount: vault-secrets-operator
|
||||
audiences:
|
||||
- vault
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultAuth
|
||||
metadata:
|
||||
name: vault-auth-storage
|
||||
spec:
|
||||
vaultConnectionRef: vault-connection
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
kubernetes:
|
||||
role: vso-storage
|
||||
serviceAccount: vault-secrets-operator
|
||||
audiences:
|
||||
- vault
|
||||
@@ -0,0 +1,7 @@
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultConnection
|
||||
metadata:
|
||||
name: vault-connection
|
||||
spec:
|
||||
address: http://vault.mnt.svc.cluster.local:8200
|
||||
skipTLSVerify: false
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
namespace: mnt
|
||||
|
||||
resources:
|
||||
- oauth2-proxy.yaml
|
||||
|
||||
@@ -0,0 +1,28 @@
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: oauth2-proxy-secrets
|
||||
spec:
|
||||
vaultAuthRef: vault-auth-auth-platform
|
||||
mount: secret
|
||||
path: oauth2-proxy/forward-auth
|
||||
refreshAfter: 60s
|
||||
type: kv-v2
|
||||
destination:
|
||||
name: oauth2-proxy-secrets
|
||||
create: true
|
||||
overwrite: true
|
||||
labels:
|
||||
app.kubernetes.io/name: oauth2-proxy
|
||||
app.kubernetes.io/component: auth-proxy
|
||||
app.kubernetes.io/managed-by: vault-secrets-operator
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
templates:
|
||||
client-secret:
|
||||
text: '{{ if index .Secrets "client_secret" }}{{ index .Secrets "client_secret" }}{{ else }}{{ index .Secrets "client-secret" }}{{ end }}'
|
||||
cookie-secret:
|
||||
text: '{{ if index .Secrets "cookie_secret" }}{{ index .Secrets "cookie_secret" }}{{ else }}{{ index .Secrets "cookie-secret" }}{{ end }}'
|
||||
rolloutRestartTargets:
|
||||
- kind: Deployment
|
||||
name: oauth2-proxy
|
||||
@@ -0,0 +1,94 @@
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: keycloak-bootstrap-admin
|
||||
spec:
|
||||
vaultAuthRef: vault-auth-auth-platform
|
||||
mount: secret
|
||||
type: kv-v2
|
||||
path: keycloak/bootstrap-admin
|
||||
refreshAfter: 60s
|
||||
destination:
|
||||
name: keycloak-bootstrap-admin
|
||||
create: true
|
||||
overwrite: true
|
||||
labels:
|
||||
app.kubernetes.io/name: keycloak
|
||||
app.kubernetes.io/component: identity-provider
|
||||
app.kubernetes.io/managed-by: vault-secrets-operator
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: keycloak-bootstrap-admin-operator
|
||||
spec:
|
||||
vaultAuthRef: vault-auth-auth-platform
|
||||
mount: secret
|
||||
type: kv-v2
|
||||
path: keycloak/bootstrap-admin
|
||||
refreshAfter: 60s
|
||||
destination:
|
||||
name: keycloak-bootstrap-admin-operator
|
||||
create: true
|
||||
overwrite: true
|
||||
labels:
|
||||
app.kubernetes.io/name: keycloak
|
||||
app.kubernetes.io/component: identity-provider
|
||||
app.kubernetes.io/managed-by: vault-secrets-operator
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
templates:
|
||||
username:
|
||||
text: '{{ .Secrets.KEYCLOAK_ADMIN }}'
|
||||
password:
|
||||
text: '{{ .Secrets.KEYCLOAK_ADMIN_PASSWORD }}'
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: keycloak-db-operator
|
||||
spec:
|
||||
vaultAuthRef: vault-auth-auth-platform
|
||||
mount: secret
|
||||
type: kv-v2
|
||||
path: keycloak/db
|
||||
refreshAfter: 60s
|
||||
destination:
|
||||
name: keycloak-db-operator
|
||||
create: true
|
||||
overwrite: true
|
||||
labels:
|
||||
app.kubernetes.io/name: keycloak
|
||||
app.kubernetes.io/component: database
|
||||
app.kubernetes.io/managed-by: vault-secrets-operator
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
templates:
|
||||
username:
|
||||
text: keycloak
|
||||
password:
|
||||
text: '{{ .Secrets.password }}'
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: keycloak-client-auth-server-ingress
|
||||
spec:
|
||||
vaultAuthRef: vault-auth-auth-platform
|
||||
mount: secret
|
||||
type: kv-v2
|
||||
path: keycloak/clients/auth-server-ingress
|
||||
refreshAfter: 60s
|
||||
destination:
|
||||
name: keycloak-client-auth-server-ingress
|
||||
create: true
|
||||
overwrite: true
|
||||
labels:
|
||||
app.kubernetes.io/name: keycloak
|
||||
app.kubernetes.io/component: identity-provider
|
||||
app.kubernetes.io/managed-by: vault-secrets-operator
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
templates:
|
||||
client-secret:
|
||||
text: '{{ .Secrets.client_secret }}'
|
||||
@@ -0,0 +1,9 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
namespace: mnt
|
||||
|
||||
resources:
|
||||
- postgres.yaml
|
||||
- keycloak.yaml
|
||||
|
||||
@@ -0,0 +1,69 @@
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: identity-postgres-superuser
|
||||
spec:
|
||||
vaultAuthRef: vault-auth-auth-platform
|
||||
mount: secret
|
||||
type: kv-v2
|
||||
path: identity-postgres/superuser
|
||||
refreshAfter: 60s
|
||||
destination:
|
||||
name: identity-postgres-superuser
|
||||
create: true
|
||||
overwrite: true
|
||||
labels:
|
||||
app.kubernetes.io/name: identity-postgres
|
||||
app.kubernetes.io/component: database
|
||||
app.kubernetes.io/managed-by: vault-secrets-operator
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: keycloak-db-creds
|
||||
spec:
|
||||
vaultAuthRef: vault-auth-auth-platform
|
||||
mount: secret
|
||||
type: kv-v2
|
||||
path: keycloak/db
|
||||
refreshAfter: 60s
|
||||
destination:
|
||||
name: keycloak-db
|
||||
create: true
|
||||
overwrite: true
|
||||
labels:
|
||||
app.kubernetes.io/name: keycloak
|
||||
app.kubernetes.io/component: database
|
||||
app.kubernetes.io/managed-by: vault-secrets-operator
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: auth-server-db-creds
|
||||
spec:
|
||||
vaultAuthRef: vault-auth-auth-platform
|
||||
mount: secret
|
||||
type: kv-v2
|
||||
path: auth-server/db
|
||||
refreshAfter: 60s
|
||||
destination:
|
||||
name: auth-server-db
|
||||
create: true
|
||||
overwrite: true
|
||||
labels:
|
||||
app.kubernetes.io/name: auth-server
|
||||
app.kubernetes.io/component: database
|
||||
app.kubernetes.io/managed-by: vault-secrets-operator
|
||||
transformation:
|
||||
templates:
|
||||
SPRING_DATASOURCE_USERNAME:
|
||||
text: '{{ index .Secrets "SPRING_DATASOURCE_USERNAME" }}'
|
||||
SPRING_DATASOURCE_PASSWORD:
|
||||
text: '{{ index .Secrets "SPRING_DATASOURCE_PASSWORD" }}'
|
||||
APP_DATASOURCE_USERNAME:
|
||||
text: '{{ index .Secrets "SPRING_DATASOURCE_USERNAME" }}'
|
||||
APP_DATASOURCE_PASSWORD:
|
||||
text: '{{ index .Secrets "SPRING_DATASOURCE_PASSWORD" }}'
|
||||
rolloutRestartTargets:
|
||||
- kind: Deployment
|
||||
name: auth-server
|
||||
@@ -0,0 +1,7 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
namespace: mnt
|
||||
|
||||
resources:
|
||||
- ../../../base
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
namespace: mnt
|
||||
|
||||
resources:
|
||||
- minio.yaml
|
||||
- registry-basic-auth.yaml
|
||||
@@ -0,0 +1,18 @@
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: minio-tenant-env
|
||||
spec:
|
||||
vaultAuthRef: vault-auth-storage
|
||||
mount: secret
|
||||
type: kv-v2
|
||||
path: minio/tenant-env
|
||||
refreshAfter: 60s
|
||||
destination:
|
||||
name: minio-tenant-env
|
||||
create: true
|
||||
overwrite: true
|
||||
labels:
|
||||
app.kubernetes.io/name: minio
|
||||
app.kubernetes.io/component: object-storage
|
||||
app.kubernetes.io/managed-by: vault-secrets-operator
|
||||
@@ -0,0 +1,59 @@
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: docker-registry-basic-auth
|
||||
spec:
|
||||
vaultAuthRef: vault-auth-storage
|
||||
mount: secret
|
||||
type: kv-v2
|
||||
path: docker-registry/basic-auth
|
||||
refreshAfter: 60s
|
||||
destination:
|
||||
name: docker-registry-basic-auth
|
||||
create: true
|
||||
overwrite: true
|
||||
labels:
|
||||
app.kubernetes.io/name: docker-registry
|
||||
app.kubernetes.io/component: registry
|
||||
app.kubernetes.io/managed-by: vault-secrets-operator
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
excludes:
|
||||
- .*
|
||||
templates:
|
||||
users:
|
||||
text: '{{ .Secrets.users }}'
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: docker-registry-pull-credentials
|
||||
spec:
|
||||
vaultAuthRef: vault-auth-storage
|
||||
mount: secret
|
||||
type: kv-v2
|
||||
path: docker-registry/basic-auth
|
||||
refreshAfter: 60s
|
||||
destination:
|
||||
name: docker-registry-pull-credentials
|
||||
create: true
|
||||
overwrite: true
|
||||
type: kubernetes.io/dockerconfigjson
|
||||
labels:
|
||||
app.kubernetes.io/name: docker-registry
|
||||
app.kubernetes.io/component: registry
|
||||
app.kubernetes.io/managed-by: vault-secrets-operator
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
templates:
|
||||
.dockerconfigjson:
|
||||
text: |
|
||||
{
|
||||
"auths": {
|
||||
"registry.project.com": {
|
||||
"username": "{{ .Secrets.username }}",
|
||||
"password": "{{ .Secrets.password }}",
|
||||
"auth": "{{ printf "%s:%s" .Secrets.username .Secrets.password | b64enc }}"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,7 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
namespace: mnt
|
||||
|
||||
resources:
|
||||
- secret.yaml
|
||||
@@ -0,0 +1,25 @@
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: docker-registry-minio
|
||||
spec:
|
||||
vaultAuthRef: vault-auth-storage
|
||||
mount: secret
|
||||
type: kv-v2
|
||||
path: docker-registry/minio
|
||||
refreshAfter: 60s
|
||||
destination:
|
||||
name: docker-registry-minio
|
||||
create: true
|
||||
overwrite: true
|
||||
labels:
|
||||
app.kubernetes.io/name: docker-registry
|
||||
app.kubernetes.io/component: registry
|
||||
app.kubernetes.io/managed-by: vault-secrets-operator
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
templates:
|
||||
REGISTRY_STORAGE_S3_ACCESSKEY:
|
||||
text: '{{ .Secrets.access_key }}'
|
||||
REGISTRY_STORAGE_S3_SECRETKEY:
|
||||
text: '{{ .Secrets.secret_key }}'
|
||||
@@ -0,0 +1,21 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: traefik-dashboard
|
||||
labels:
|
||||
app.kubernetes.io/name: traefik
|
||||
app.kubernetes.io/instance: traefik-dev
|
||||
app.kubernetes.io/component: ingress-controller
|
||||
app.kubernetes.io/part-of: platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app.kubernetes.io/name: traefik
|
||||
app.kubernetes.io/instance: traefik-kube-system
|
||||
ports:
|
||||
- name: admin
|
||||
port: 8080
|
||||
targetPort: traefik
|
||||
protocol: TCP
|
||||
appProtocol: http
|
||||
@@ -0,0 +1,44 @@
|
||||
apiVersion: helm.cattle.io/v1
|
||||
kind: HelmChartConfig
|
||||
metadata:
|
||||
name: traefik
|
||||
labels:
|
||||
app.kubernetes.io/name: traefik
|
||||
app.kubernetes.io/instance: traefik-dev
|
||||
app.kubernetes.io/component: ingress-controller
|
||||
app.kubernetes.io/part-of: platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
spec:
|
||||
valuesContent: |-
|
||||
api:
|
||||
dashboard: true
|
||||
deployment:
|
||||
replicas: 2
|
||||
ingressRoute:
|
||||
dashboard:
|
||||
enabled: true
|
||||
entryPoints:
|
||||
- traefik
|
||||
service:
|
||||
spec:
|
||||
externalTrafficPolicy: Local
|
||||
ports:
|
||||
web:
|
||||
tls:
|
||||
enabled: false
|
||||
websecure:
|
||||
tls:
|
||||
enabled: false
|
||||
ingressClass:
|
||||
enabled: true
|
||||
isDefaultClass: true
|
||||
additionalArguments:
|
||||
- "--providers.kubernetesingress.ingressclass=traefik"
|
||||
- "--metrics.prometheus=true"
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 256Mi
|
||||
@@ -0,0 +1,9 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
namespace: kube-system
|
||||
|
||||
resources:
|
||||
- dashboard-service.yaml
|
||||
- helmchartconfig.yaml
|
||||
- middleware.yaml
|
||||
@@ -0,0 +1,16 @@
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: security-headers
|
||||
labels:
|
||||
app.kubernetes.io/name: traefik
|
||||
app.kubernetes.io/instance: traefik-dev
|
||||
app.kubernetes.io/component: ingress-controller
|
||||
app.kubernetes.io/part-of: platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
spec:
|
||||
headers:
|
||||
contentTypeNosniff: true
|
||||
browserXssFilter: true
|
||||
referrerPolicy: strict-origin-when-cross-origin
|
||||
frameDeny: true
|
||||
@@ -0,0 +1,12 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: vault-tokenreview-binding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: system:auth-delegator
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: vault
|
||||
namespace: mnt
|
||||
Executable
+21
@@ -0,0 +1,21 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: vault-config
|
||||
data:
|
||||
vault.hcl: |
|
||||
ui = true
|
||||
disable_mlock = true
|
||||
|
||||
storage "file" {
|
||||
path = "/vault/data"
|
||||
}
|
||||
|
||||
listener "tcp" {
|
||||
address = "0.0.0.0:8200"
|
||||
cluster_address = "0.0.0.0:8201"
|
||||
tls_disable = 1
|
||||
}
|
||||
|
||||
api_addr = "http://vault:8200"
|
||||
cluster_addr = "http://vault:8201"
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- serviceaccount.yaml
|
||||
- clusterrolebinding.yaml
|
||||
- configmap.yaml
|
||||
- service.yaml
|
||||
- statefulset.yaml
|
||||
|
||||
labels:
|
||||
- pairs:
|
||||
app.kubernetes.io/name: vault
|
||||
app.kubernetes.io/instance: vault
|
||||
app.kubernetes.io/version: "1.17.2"
|
||||
app.kubernetes.io/component: secret-management
|
||||
app.kubernetes.io/part-of: security-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
includeSelectors: false
|
||||
includeTemplates: true
|
||||
Executable
+20
@@ -0,0 +1,20 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: vault
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app.kubernetes.io/name: vault
|
||||
app.kubernetes.io/instance: vault
|
||||
ports:
|
||||
- name: http
|
||||
port: 8200
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
appProtocol: http
|
||||
- name: cluster
|
||||
port: 8201
|
||||
targetPort: cluster
|
||||
protocol: TCP
|
||||
appProtocol: http
|
||||
+4
@@ -0,0 +1,4 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: vault
|
||||
Executable
+128
@@ -0,0 +1,128 @@
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: vault
|
||||
spec:
|
||||
replicas: 1
|
||||
serviceName: vault
|
||||
podManagementPolicy: OrderedReady
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
persistentVolumeClaimRetentionPolicy:
|
||||
whenDeleted: Retain
|
||||
whenScaled: Retain
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: vault
|
||||
app.kubernetes.io/instance: vault
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: vault
|
||||
app.kubernetes.io/instance: vault
|
||||
spec:
|
||||
serviceAccountName: vault
|
||||
automountServiceAccountToken: true
|
||||
terminationGracePeriodSeconds: 60
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 100
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: vault
|
||||
image: hashicorp/vault:1.17.2
|
||||
imagePullPolicy: IfNotPresent
|
||||
command:
|
||||
- vault
|
||||
- server
|
||||
- -config=/vault/config/vault.hcl
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8200
|
||||
protocol: TCP
|
||||
- name: cluster
|
||||
containerPort: 8201
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: VAULT_ADDR
|
||||
value: "http://127.0.0.1:8200"
|
||||
- name: VAULT_API_ADDR
|
||||
value: "http://vault:8200"
|
||||
- name: SKIP_SETCAP
|
||||
value: "true"
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
memory: 512Mi
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /v1/sys/health?standbyok=true&sealedcode=200&uninitcode=200
|
||||
port: http
|
||||
periodSeconds: 5
|
||||
failureThreshold: 30
|
||||
timeoutSeconds: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /v1/sys/health?standbyok=true&sealedcode=503&uninitcode=503
|
||||
port: http
|
||||
periodSeconds: 10
|
||||
failureThreshold: 3
|
||||
timeoutSeconds: 3
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /v1/sys/health?standbyok=true&sealedcode=200&uninitcode=200
|
||||
port: http
|
||||
periodSeconds: 30
|
||||
failureThreshold: 3
|
||||
timeoutSeconds: 3
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 100
|
||||
runAsGroup: 1000
|
||||
allowPrivilegeEscalation: false
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /vault/data
|
||||
- name: config
|
||||
mountPath: /vault/config
|
||||
readOnly: true
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
- name: home
|
||||
mountPath: /home/vault
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: vault-config
|
||||
- name: tmp
|
||||
emptyDir:
|
||||
medium: Memory
|
||||
sizeLimit: 64Mi
|
||||
- name: home
|
||||
emptyDir:
|
||||
medium: Memory
|
||||
sizeLimit: 64Mi
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: data
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: replace-in-overlay
|
||||
volumeMode: Filesystem
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
@@ -0,0 +1,20 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
namespace: mnt
|
||||
|
||||
resources:
|
||||
- ../../base
|
||||
- networkpolicy.yaml
|
||||
|
||||
patches:
|
||||
- target:
|
||||
kind: StatefulSet
|
||||
name: vault
|
||||
patch: |-
|
||||
- op: replace
|
||||
path: /spec/volumeClaimTemplates/0/spec/storageClassName
|
||||
value: local-path
|
||||
- op: replace
|
||||
path: /spec/volumeClaimTemplates/0/spec/resources/requests/storage
|
||||
value: 1Gi
|
||||
@@ -0,0 +1,76 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: vault-ingress-clients
|
||||
labels:
|
||||
app.kubernetes.io/name: vault
|
||||
app.kubernetes.io/instance: vault
|
||||
app.kubernetes.io/component: secret-management
|
||||
app.kubernetes.io/part-of: security-platform
|
||||
app.kubernetes.io/managed-by: kustomize
|
||||
# -----------------------------------------------------------------------------
|
||||
# Vault 정책 — 두 방향 통제
|
||||
#
|
||||
# (1) Ingress: VSO Controller Pod 에서만 8200 수신
|
||||
# VSO 가 `vault-secrets-operator-system` ns 와 `mnt` ns 양쪽에서 접근할
|
||||
# 가능성 (과거 설치 잔존 + 신규 전용 ns) 이 있어 둘 다 허용.
|
||||
#
|
||||
# (2) Egress: kube-apiserver 의 TokenReview 호출만 허용
|
||||
# Vault k8s auth 는 클라이언트가 보낸 SA JWT 를 검증하기 위해
|
||||
# `authentication.k8s.io/v1/tokenreviews` 를 호출한다. kube-apiserver 는
|
||||
# host network 프로세스이므로 Pod/Namespace 라벨로 selector 를 못 쓰고
|
||||
# ipBlock 이 불가피 (stock NetworkPolicy 의 한계; Cilium 이면
|
||||
# `toEntities: [kube-apiserver]` 로 해결됨).
|
||||
#
|
||||
# 두 CIDR 이 필요한 이유:
|
||||
# - 443/TCP → `kubernetes.default.svc` (Service ClusterIP). Vault 가
|
||||
# 먼저 보내는 목적지. Service CIDR 에서 할당됨.
|
||||
# - 6443/TCP → control-plane 노드의 실제 kube-apiserver 포트. k3s 의
|
||||
# kube-proxy(iptables) 가 Service → node DNAT 를 수행하는데, 기본
|
||||
# CNI (flannel + kube-router) 는 NetworkPolicy 를 veth iptables 단에서
|
||||
# 평가하면서 DNAT 전/후 시점이 엇갈려 두 쪽 모두 허용해야 안전.
|
||||
#
|
||||
# CIDR 값의 출처:
|
||||
# - 10.43.0.0/16 → k3s `service-cidr` 기본값. `/etc/rancher/k3s/config.yaml`
|
||||
# 의 값과 동기화. 커스텀 service-cidr 를 쓰면 이 값을 맞춰 변경.
|
||||
# - 10.208.141.0/24 → **이 overlay 의 control-plane 노드 서브넷**.
|
||||
# 노드를 추가/교체하거나 staging/prod overlay 를 만들 때 실제 값으로
|
||||
# 반드시 재지정. dev 단일 노드 기준으로 /24 여유를 둠.
|
||||
#
|
||||
# staging/prod overlay 는 이 파일을 그대로 복붙하지 말고 각자의 서브넷으로
|
||||
# 교체. 재사용 구조가 필요해지면 base + per-env patch 로 분리할 것.
|
||||
# -----------------------------------------------------------------------------
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: vault
|
||||
app.kubernetes.io/instance: vault
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
ingress:
|
||||
- from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: vault-secrets-operator
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: vault-secrets-operator-system
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: vault-secrets-operator
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8200
|
||||
egress:
|
||||
# Vault → kube-apiserver (TokenReview 용)
|
||||
- to:
|
||||
- ipBlock:
|
||||
cidr: 10.43.0.0/16 # k3s service-cidr — kubernetes.default.svc 포함
|
||||
- ipBlock:
|
||||
cidr: 10.208.141.0/24 # dev control-plane 노드 서브넷 (env-specific)
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 443 # Service ClusterIP 경유
|
||||
- protocol: TCP
|
||||
port: 6443 # node DNAT 후 kube-apiserver 실포트
|
||||
Reference in New Issue
Block a user