Give vlogs its own namespace (#507)

The Vault KV layout is kubernetes/namespace/<ns>/<sa>/<secret>, so vlogs and logviewer both running as SA default in the shared logging namespace would collide on one oauth-credentials entry. Splitting vlogs out resolves it without widening any Vault policy.

- Move apps/base/logging/vlogs to apps/base/vlogs, namespace vlogs
- Add namespace.yaml and a vlogs-scoped VaultAuth (role default)
- Point the VaultStaticSecret at kubernetes/namespace/vlogs/default/oauth-credentials
- Add the au-syd1 overlay, platform ApplicationSet path and project destination
- Move the wildcard-unkin-net-tls reflection from logging to vlogs; vlogs was its only consumer there

Secret is already seeded at the new Vault path.

Reviewed-on: #507
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

apps/base/cert-manager/certificate_wildcard-unkin-net.yaml

@@ -14,9 +14,9 @@ spec:
   secretTemplate:
     annotations:
       reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
-      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner,haproxy,logging"
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner,haproxy,vlogs"
       reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
-      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner,haproxy,logging"
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner,haproxy,vlogs"
   privateKey:
     size: 4096
   dnsNames:

apps/base/logging/kustomization.yaml

@@ -9,4 +9,3 @@ resources:
   - vlagent.yaml
   - gateway.yaml
   - httproute.yaml
-  - vlogs

apps/base/vlogs/gateway.yaml

@@ -12,7 +12,7 @@ metadata:
   labels:
     traefik.io/instance: external
   name: vlogs-external
-  namespace: logging
+  namespace: vlogs
 spec:
   gatewayClassName: traefik-external
   listeners:

apps/base/vlogs/httproute.yaml

@@ -3,7 +3,7 @@ apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
   name: vlogs-http-redirect
-  namespace: logging
+  namespace: vlogs
 spec:
   hostnames:
     - vlogs.unkin.net
@@ -27,7 +27,7 @@ apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
   name: vlogs
-  namespace: logging
+  namespace: vlogs
 spec:
   hostnames:
     - vlogs.unkin.net

apps/base/vlogs/kustomization.yaml

@@ -3,6 +3,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
+  - namespace.yaml
+  - vaultauth.yaml
   - vaultstaticsecret.yaml
   - oauth2-proxy-configmap.yaml
   - oauth2-proxy-deployment.yaml

apps/base/vlogs/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vlogs

apps/base/vlogs/oauth2-proxy-configmap.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: vlogs-oauth2-env
-  namespace: logging
+  namespace: vlogs
 data:
   OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:4180"
   OAUTH2_PROXY_PROVIDER: "oidc"

apps/base/vlogs/oauth2-proxy-deployment.yaml

@@ -3,7 +3,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: vlogs-oauth2
-  namespace: logging
+  namespace: vlogs
   annotations:
     configmap.reloader.stakater.com/auto: "true"
     secret.reloader.stakater.com/reload: "vlogs-oauth-credentials,vault-ca-cert"

apps/base/vlogs/service.yaml

@@ -5,7 +5,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: vlogs-oauth2
-  namespace: logging
+  namespace: vlogs
 spec:
   internalTrafficPolicy: Cluster
   ports:

apps/base/vlogs/vaultauth.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: vlogs
+spec:
+  allowedNamespaces:
+    - vlogs
+  kubernetes:
+    audiences:
+      - vault
+    role: default
+    serviceAccount: default
+    tokenExpirationSeconds: 600
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default

apps/base/vlogs/vaultstaticsecret.yaml

@@ -3,7 +3,7 @@ apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
 metadata:
   name: vlogs-oauth-credentials
-  namespace: logging
+  namespace: vlogs
 spec:
   destination:
     create: true
@@ -11,7 +11,7 @@ spec:
     overwrite: true
   hmacSecretData: true
   mount: kv
-  path: kubernetes/namespace/logging/default/vlogs-oauth-credentials
+  path: kubernetes/namespace/vlogs/default/oauth-credentials
   refreshAfter: 5m
   type: kv-v2
   vaultAuthRef: default

apps/overlays/au-syd1/vlogs/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/vlogs

argocd/applicationsets/platform.yaml

@@ -49,6 +49,7 @@ spec:
       - path: apps/overlays/*/vm-system
       - path: apps/overlays/*/vpa-system
       - path: apps/overlays/*/vault
+      - path: apps/overlays/*/vlogs
       - path: apps/overlays/*/vso-system
       - path: apps/overlays/*/woodpecker
   template:

argocd/projects/platform.yaml

@@ -67,6 +67,8 @@ spec:
       server: https://kubernetes.default.svc
     - namespace: 'vault'
       server: https://kubernetes.default.svc
+    - namespace: 'vlogs'
+      server: https://kubernetes.default.svc
     - namespace: 'woodpecker'
       server: https://kubernetes.default.svc
   clusterResourceWhitelist: