Compare commits
15 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 unkin-agent
|
4a66973653 | ||
|
unkin-agent
|
f9f6f1df68 | ||
|
unkin-agent
|
a34ff4be91 | ||
|
unkin-agent
|
6cc752336e | ||
|
unkin-agent
|
47a2ab9152 | ||
|
unkin-agent
|
4748df497a | ||
|
unkin-agent
|
ba14f85e51 | ||
|
unkin-agent
|
8a00ddb82c | ||
|
unkin-agent
|
d4aed39f6a | ||
|
unkin-agent
|
d6a1279efe | ||
|
unkin-agent
|
55af4b2f16 | ||
|
unkin-agent
|
783a3db0fd | ||
|
unkin-agent
|
84f09f89ff | ||
|
unkin-agent
|
5b07157eeb | ||
|
unkin-agent
|
7aec9a9021 |
@@ -22,10 +22,10 @@ make kubeconform
|
||||
make clean
|
||||
|
||||
# Quick build + inspect without persisting output
|
||||
kustomize build --enable-helm apps/overlays/au-syd1/<app-name>
|
||||
kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/<app-name>
|
||||
|
||||
# Check all resource kinds produced by an overlay
|
||||
kustomize build --enable-helm apps/overlays/au-syd1/<app-name> | grep "^kind:" | sort | uniq -c
|
||||
kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/<app-name> | grep "^kind:" | sort | uniq -c
|
||||
|
||||
# Run pre-commit checks against all files
|
||||
uvx pre-commit run --all-files
|
||||
@@ -118,7 +118,7 @@ In `argocd/projects/platform.yaml` (or `storage.yaml`):
|
||||
|
||||
### 5. Validate
|
||||
```bash
|
||||
kustomize build --enable-helm apps/overlays/au-syd1/<app-name>
|
||||
kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/<app-name>
|
||||
make kubeconform
|
||||
```
|
||||
|
||||
@@ -215,7 +215,7 @@ Examples:
|
||||
|
||||
Some overlays vendor Helm charts locally under `apps/overlays/au-syd1/<app-name>/charts/<chart-name>/`. When a chart is vendored, the overlay's `kustomization.yaml` references the local path. When not vendored, it references the OCI or HTTP repo directly.
|
||||
|
||||
Current Kubernetes target version: **1.33.7** (used by kubeconform in CI).
|
||||
The Kubernetes target version lives in `ci/kube-version`; the Makefile and CI scripts read it for both the Helm capabilities version and kubeconform.
|
||||
|
||||
---
|
||||
|
||||
|
||||
@@ -3,8 +3,11 @@
|
||||
# Build a kustomization path to manifests directory
|
||||
# Usage: make build clusters/au-syd1/bootstrap
|
||||
build:
|
||||
@mkdir -p manifests/$(filter-out $@,$(MAKECMDGOALS))
|
||||
@kustomize build --enable-helm $(filter-out $@,$(MAKECMDGOALS)) --output manifests/$(filter-out $@,$(MAKECMDGOALS))
|
||||
@kube_version="$$(cat ci/kube-version)"; \
|
||||
if [ -z "$$kube_version" ]; then echo "cannot read ci/kube-version" >&2; exit 1; fi; \
|
||||
target="$(filter-out $@,$(MAKECMDGOALS))"; \
|
||||
mkdir -p "manifests/$$target"; \
|
||||
kustomize build --enable-helm --helm-kube-version "$$kube_version" "$$target" --output "manifests/$$target"
|
||||
|
||||
# Generate JSON schemas from CRDs and Kubernetes swagger spec (run manually, results committed)
|
||||
schemas:
|
||||
|
||||
@@ -1,4 +1,21 @@
|
||||
---
|
||||
# Path split between the authenticated UI and the unauthenticated machine API.
|
||||
# Longest matching prefix wins, so the two UI rules take precedence over "/".
|
||||
#
|
||||
# AUTHENTICATED (oauth2 Service -> oauth2-proxy -> ui Service):
|
||||
# /oauth2 oauth2-proxy sign_in / start / callback / sign_out
|
||||
# /ui the human-facing SPA
|
||||
#
|
||||
# NOT AUTHENTICATED (artifactapi Service, unchanged):
|
||||
# /api/v1/{remote,local,virtual}/* package proxy reads (yum/dnf, pip, ...)
|
||||
# /api/v2/remotes|virtuals|locals/* management API + the UI's own XHR calls
|
||||
# /api/v2/remotes/{name}/files/* CI publish uploads (PUT) and downloads
|
||||
# /v2/* Docker Registry V2 (containerd, buildah)
|
||||
# /terraform/v1/providers/* Terraform provider registry
|
||||
# /.well-known/terraform.json Terraform service discovery
|
||||
# /health, /version, / probes and the redirect to /ui/
|
||||
# Those clients cannot complete a browser OIDC flow, so they must never be
|
||||
# routed through oauth2-proxy.
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
@@ -22,7 +39,17 @@ spec:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: ui
|
||||
name: oauth2
|
||||
port: 80
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /oauth2
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: oauth2
|
||||
port: 80
|
||||
weight: 1
|
||||
matches:
|
||||
|
||||
@@ -12,6 +12,8 @@ resources:
|
||||
- gateway.yaml
|
||||
- httproute.yaml
|
||||
- namespace.yaml
|
||||
- oauth2-proxy-configmap.yaml
|
||||
- oauth2-proxy-deployment.yaml
|
||||
- redis-deployment.yaml
|
||||
- services.yaml
|
||||
- ui-deployment.yaml
|
||||
|
||||
@@ -0,0 +1,46 @@
|
||||
---
|
||||
# Non-secret oauth2-proxy configuration (client_id/secret/cookie_secret come
|
||||
# from the oauth-credentials Secret).
|
||||
#
|
||||
# SCOPE: this proxy fronts the artifactapi web UI ONLY. The HTTPRoute sends just
|
||||
# /ui and /oauth2 here; every machine surface (/api/v1, /api/v2, /v2 docker
|
||||
# registry, /terraform, /.well-known/terraform.json, /health, /version, /) goes
|
||||
# straight to the api Service and is NOT authenticated. yum/dnf, containerd
|
||||
# registry mirrors, docker/buildah, terraform init and Woodpecker publish steps
|
||||
# cannot complete a browser OIDC flow, so they must never reach this container.
|
||||
# Its only upstream is the ui Service -- there is deliberately no api upstream.
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: artifactapi-oauth2-env
|
||||
namespace: artifactapi
|
||||
data:
|
||||
OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:4180"
|
||||
OAUTH2_PROXY_METRICS_ADDRESS: "0.0.0.0:44180"
|
||||
OAUTH2_PROXY_PROVIDER: "oidc"
|
||||
# Publicly-trusted Authentik host: the authorize step is a browser redirect,
|
||||
# so the issuer must present a cert every user's browser already trusts (the
|
||||
# k8s host serves an internal-CA cert). Slug from terraform-authentik.
|
||||
OAUTH2_PROXY_OIDC_ISSUER_URL: "https://identity.unkin.net/application/o/artifactapi/"
|
||||
OAUTH2_PROXY_REDIRECT_URL: "https://artifactapi.k8s.syd1.au.unkin.net/oauth2/callback"
|
||||
OAUTH2_PROXY_UPSTREAMS: "http://ui.artifactapi.svc.cluster.local:80/"
|
||||
OAUTH2_PROXY_SCOPE: "openid email profile ak_groups"
|
||||
# Populate session.Groups from the Authentik hierarchical ak_groups claim.
|
||||
OAUTH2_PROXY_OIDC_GROUPS_CLAIM: "ak_groups"
|
||||
OAUTH2_PROXY_ALLOWED_GROUPS: "akP-artifactapi-admin"
|
||||
OAUTH2_PROXY_PASS_USER_HEADERS: "true"
|
||||
OAUTH2_PROXY_EMAIL_DOMAINS: "*"
|
||||
# Authentik hardcodes email_verified=false in the id_token; authorization is
|
||||
# enforced via ak_groups, so accepting the unverified email is safe.
|
||||
OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: "true"
|
||||
OAUTH2_PROXY_COOKIE_SECURE: "true"
|
||||
OAUTH2_PROXY_COOKIE_DOMAINS: "artifactapi.k8s.syd1.au.unkin.net"
|
||||
OAUTH2_PROXY_WHITELIST_DOMAINS: "artifactapi.k8s.syd1.au.unkin.net"
|
||||
OAUTH2_PROXY_REVERSE_PROXY: "true"
|
||||
OAUTH2_PROXY_CODE_CHALLENGE_METHOD: "S256"
|
||||
OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"
|
||||
# Back-channel discovery/token calls resolve the issuer inside the cluster,
|
||||
# where it is served under the internal unkin.net CA rather than the publicly
|
||||
# trusted cert the browser sees. Trust the bundle the combine-certs init
|
||||
# container assembles, as every other oauth2-proxy in the estate does.
|
||||
OAUTH2_PROXY_PROVIDER_CA_FILES: "/etc/ssl/combined/ca-certificates.crt"
|
||||
@@ -0,0 +1,136 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: oauth2
|
||||
namespace: artifactapi
|
||||
annotations:
|
||||
configmap.reloader.stakater.com/auto: "true"
|
||||
secret.reloader.stakater.com/reload: "oauth-credentials,vault-ca-cert"
|
||||
spec:
|
||||
replicas: 2
|
||||
selector:
|
||||
matchLabels:
|
||||
app: oauth2
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: oauth2
|
||||
spec:
|
||||
serviceAccountName: default
|
||||
automountServiceAccountToken: false
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
fsGroup: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
initContainers:
|
||||
# The Authentik issuer is served behind the internal unkin.net CA;
|
||||
# combine the system roots with it so oauth2-proxy's OIDC HTTP client
|
||||
# trusts the discovery endpoint.
|
||||
- name: combine-certs
|
||||
image: docker.io/library/alpine:3
|
||||
imagePullPolicy: IfNotPresent
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt > /combined-certs/ca-certificates.crt
|
||||
volumeMounts:
|
||||
- name: vault-ca-cert
|
||||
mountPath: /custom-ca
|
||||
readOnly: true
|
||||
- name: combined-certs
|
||||
mountPath: /combined-certs
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 64Mi
|
||||
containers:
|
||||
- name: oauth2-proxy
|
||||
image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 4180
|
||||
name: http
|
||||
protocol: TCP
|
||||
- containerPort: 44180
|
||||
name: metrics
|
||||
protocol: TCP
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: artifactapi-oauth2-env
|
||||
optional: false
|
||||
env:
|
||||
- name: OAUTH2_PROXY_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: oauth-credentials
|
||||
key: client_id
|
||||
- name: OAUTH2_PROXY_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: oauth-credentials
|
||||
key: client_secret
|
||||
- name: OAUTH2_PROXY_COOKIE_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: oauth-credentials
|
||||
key: cookie_secret
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /ping
|
||||
port: http
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ready
|
||||
port: http
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
volumeMounts:
|
||||
- name: combined-certs
|
||||
mountPath: /etc/ssl/combined
|
||||
readOnly: true
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 256Mi
|
||||
volumes:
|
||||
- name: vault-ca-cert
|
||||
secret:
|
||||
secretName: vault-ca-cert
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- name: combined-certs
|
||||
emptyDir: {}
|
||||
restartPolicy: Always
|
||||
@@ -16,6 +16,26 @@ spec:
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
---
|
||||
# Authenticated front door for the web UI only: api-route sends /ui and /oauth2
|
||||
# here, oauth2-proxy authenticates and forwards to the ui Service. Every other
|
||||
# path reaches the api Service above directly and stays unauthenticated.
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: oauth2
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
internalTrafficPolicy: Cluster
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
selector:
|
||||
app: oauth2
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
|
||||
@@ -32,3 +32,26 @@ spec:
|
||||
refreshAfter: 5m
|
||||
type: kv-v2
|
||||
vaultAuthRef: default
|
||||
---
|
||||
# Authentik OIDC client for the artifactapi UI front door (client_id,
|
||||
# client_secret, cookie_secret). Seeded out of band at
|
||||
# kv/kubernetes/namespace/artifactapi/default/oauth-credentials; the default
|
||||
# k8s auth role already grants the artifactapi/default ServiceAccount read on
|
||||
# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/*, so no
|
||||
# terraform-vault change is needed. Consumed by the oauth2 Deployment.
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: oauth-credentials
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
destination:
|
||||
create: true
|
||||
name: oauth-credentials
|
||||
overwrite: true
|
||||
hmacSecretData: true
|
||||
mount: kv
|
||||
path: kubernetes/namespace/artifactapi/default/oauth-credentials
|
||||
refreshAfter: 5m
|
||||
type: kv-v2
|
||||
vaultAuthRef: default
|
||||
|
||||
@@ -14,3 +14,17 @@ spec:
|
||||
podMetricsEndpoints:
|
||||
- port: metrics
|
||||
path: /metrics
|
||||
---
|
||||
# Scrape the UI oauth2-proxy (:44180), which exposes sign-in/authz counters.
|
||||
apiVersion: operator.victoriametrics.com/v1beta1
|
||||
kind: VMPodScrape
|
||||
metadata:
|
||||
name: oauth2
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: oauth2
|
||||
podMetricsEndpoints:
|
||||
- port: metrics
|
||||
path: /metrics
|
||||
|
||||
@@ -26,7 +26,7 @@ data:
|
||||
</key>
|
||||
<value>
|
||||
<PluginConfiguration>
|
||||
<OidEndpoint>https://identity.k8s.syd1.au.unkin.net/application/o/jellyfin/</OidEndpoint>
|
||||
<OidEndpoint>https://identity.unkin.net/application/o/jellyfin/</OidEndpoint>
|
||||
<OidClientId>jellyfin</OidClientId>
|
||||
<OidSecret>@@CLIENT_SECRET@@</OidSecret>
|
||||
<Enabled>true</Enabled>
|
||||
|
||||
@@ -162,7 +162,7 @@ spec:
|
||||
readOnly: true
|
||||
containers:
|
||||
- name: cheeztv
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.2.0
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.3.2
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- name: http
|
||||
|
||||
@@ -26,7 +26,7 @@ data:
|
||||
</key>
|
||||
<value>
|
||||
<PluginConfiguration>
|
||||
<OidEndpoint>https://identity.k8s.syd1.au.unkin.net/application/o/jellyfin/</OidEndpoint>
|
||||
<OidEndpoint>https://identity.unkin.net/application/o/jellyfin/</OidEndpoint>
|
||||
<OidClientId>jellyfin</OidClientId>
|
||||
<OidSecret>@@CLIENT_SECRET@@</OidSecret>
|
||||
<Enabled>true</Enabled>
|
||||
|
||||
@@ -162,7 +162,7 @@ spec:
|
||||
readOnly: true
|
||||
containers:
|
||||
- name: fafflix
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.2.0
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.3.2
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- name: http
|
||||
|
||||
@@ -25,7 +25,7 @@ spec:
|
||||
- name: pdbmux
|
||||
# Image is published by the pdbmux repo's .woodpecker/docker.yaml on
|
||||
# a v* tag. It only exists after that tag is cut (see PR merge gates).
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/pdbmux:v0.2.0
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/pdbmux:v0.4.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
|
||||
@@ -99,6 +99,12 @@ spec:
|
||||
- mountPath: /docker-custom-entrypoint.d/post-startup/additional-ruby-gems.sh
|
||||
name: additional-ruby-gems
|
||||
subPath: additional-ruby-gems.sh
|
||||
- mountPath: /configmaps/auth.conf
|
||||
name: compiler-auth-conf
|
||||
subPath: auth.conf
|
||||
- mountPath: /docker-custom-entrypoint.d/pre-default/10-auth-conf.sh
|
||||
name: compiler-auth-conf-seed
|
||||
subPath: 10-auth-conf.sh
|
||||
initContainers:
|
||||
- name: copy-configmaps
|
||||
image: busybox:1.35
|
||||
@@ -234,5 +240,12 @@ spec:
|
||||
configMap:
|
||||
name: additional-ruby-gems
|
||||
defaultMode: 0755
|
||||
- name: compiler-auth-conf
|
||||
configMap:
|
||||
name: compiler-auth.conf
|
||||
- name: compiler-auth-conf-seed
|
||||
configMap:
|
||||
name: compiler-auth-conf-seed
|
||||
defaultMode: 0755
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
|
||||
@@ -54,6 +54,16 @@ configMapGenerator:
|
||||
- resources/compiler/puppetdb.conf
|
||||
options:
|
||||
disableNameSuffixHash: true
|
||||
- name: compiler-auth.conf
|
||||
files:
|
||||
- resources/compiler/auth.conf
|
||||
options:
|
||||
disableNameSuffixHash: true
|
||||
- name: compiler-auth-conf-seed
|
||||
files:
|
||||
- resources/compiler/10-auth-conf.sh
|
||||
options:
|
||||
disableNameSuffixHash: true
|
||||
- name: additional-ruby-gems
|
||||
files:
|
||||
- resources/additional-ruby-gems.sh
|
||||
|
||||
@@ -6,4 +6,6 @@ echo "Installing additional Ruby gems..."
|
||||
/opt/puppetlabs/puppet/bin/gem install ipaddr
|
||||
/opt/puppetlabs/puppet/bin/gem install hiera-eyaml
|
||||
/opt/puppetlabs/puppet/bin/gem install toml
|
||||
# Under set -e a failed install kills the entrypoint post-startup hooks, taking down an already-serving compiler.
|
||||
/opt/puppetlabs/bin/puppetserver gem install toml
|
||||
echo "Additional Ruby gems installed successfully"
|
||||
|
||||
+14
@@ -0,0 +1,14 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
|
||||
SRC=/configmaps/auth.conf
|
||||
DST=/etc/puppetlabs/puppetserver/conf.d/auth.conf
|
||||
|
||||
# Copied rather than mounted: the entrypoint chowns conf.d and rewrites auth.conf,
|
||||
# both of which fail on a read-only configmap mount and abort container startup.
|
||||
if [ ! -s "$SRC" ]; then
|
||||
echo "FATAL: $SRC missing or empty; refusing to start on the image default auth.conf" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
cp "$SRC" "$DST"
|
||||
@@ -0,0 +1,320 @@
|
||||
# Copied into conf.d at startup by 10-auth-conf.sh; the entrypoint then appends the
|
||||
# admin API cache rule and re-renders the result, so the running file is not byte-identical.
|
||||
authorization: {
|
||||
version: 1
|
||||
rules: [
|
||||
{
|
||||
# Allow nodes to retrieve their own catalog
|
||||
match-request: {
|
||||
path: "^/puppet/v3/catalog/([^/]+)$"
|
||||
type: regex
|
||||
method: [get, post]
|
||||
}
|
||||
allow: "$1"
|
||||
sort-order: 500
|
||||
name: "puppetlabs v3 catalog from agents"
|
||||
},
|
||||
{
|
||||
# Allow catalog-diff to retrieve catalogs on behalf of others.
|
||||
# sort-order 400 must stay lower than the puppetlabs deny that follows: rules
|
||||
# sort by [sort-order, name] and the first match wins.
|
||||
match-request: {
|
||||
path: "^/puppet/v4/catalog/?$"
|
||||
type: regex
|
||||
method: post
|
||||
}
|
||||
allow: "catalog-diff.main.unkin.net"
|
||||
sort-order: 400
|
||||
name: "unkin v4 catalog for catalog-diff"
|
||||
},
|
||||
{
|
||||
# Allow services to retrieve catalogs on behalf of others
|
||||
match-request: {
|
||||
path: "^/puppet/v4/catalog/?$"
|
||||
type: regex
|
||||
method: post
|
||||
}
|
||||
deny: "*"
|
||||
sort-order: 500
|
||||
name: "puppetlabs v4 catalog for services"
|
||||
},
|
||||
{
|
||||
# Allow nodes to retrieve the certificate they requested earlier
|
||||
match-request: {
|
||||
path: "/puppet-ca/v1/certificate/"
|
||||
type: path
|
||||
method: get
|
||||
}
|
||||
allow-unauthenticated: true
|
||||
sort-order: 500
|
||||
name: "puppetlabs certificate"
|
||||
},
|
||||
{
|
||||
# Allow all nodes to access the certificate revocation list
|
||||
match-request: {
|
||||
path: "/puppet-ca/v1/certificate_revocation_list/ca"
|
||||
type: path
|
||||
method: get
|
||||
}
|
||||
allow-unauthenticated: true
|
||||
sort-order: 500
|
||||
name: "puppetlabs crl"
|
||||
},
|
||||
{
|
||||
# Allow nodes to request a new certificate
|
||||
match-request: {
|
||||
path: "/puppet-ca/v1/certificate_request"
|
||||
type: path
|
||||
method: [get, put]
|
||||
}
|
||||
allow-unauthenticated: true
|
||||
sort-order: 500
|
||||
name: "puppetlabs csr"
|
||||
},
|
||||
{
|
||||
# Allow nodes to renew their certificate
|
||||
match-request: {
|
||||
path: "/puppet-ca/v1/certificate_renewal"
|
||||
type: path
|
||||
method: post
|
||||
}
|
||||
# this endpoint should never be unauthenticated, as it requires the cert to be provided.
|
||||
allow: "*"
|
||||
sort-order: 500
|
||||
name: "puppetlabs certificate renewal"
|
||||
},
|
||||
{
|
||||
# Allow the CA CLI to access the certificate_status endpoint
|
||||
match-request: {
|
||||
path: "/puppet-ca/v1/certificate_status"
|
||||
type: path
|
||||
method: [get, put, delete]
|
||||
}
|
||||
allow: {
|
||||
extensions: {
|
||||
pp_cli_auth: "true"
|
||||
}
|
||||
}
|
||||
sort-order: 500
|
||||
name: "puppetlabs cert status"
|
||||
},
|
||||
{
|
||||
match-request: {
|
||||
path: "^/puppet-ca/v1/certificate_revocation_list$"
|
||||
type: regex
|
||||
method: put
|
||||
}
|
||||
allow: {
|
||||
extensions: {
|
||||
pp_cli_auth: "true"
|
||||
}
|
||||
}
|
||||
sort-order: 500
|
||||
name: "puppetlabs CRL update"
|
||||
},
|
||||
{
|
||||
# Allow the CA CLI to access the certificate_statuses endpoint
|
||||
match-request: {
|
||||
path: "/puppet-ca/v1/certificate_statuses"
|
||||
type: path
|
||||
method: get
|
||||
}
|
||||
allow: {
|
||||
extensions: {
|
||||
pp_cli_auth: "true"
|
||||
}
|
||||
}
|
||||
sort-order: 500
|
||||
name: "puppetlabs cert statuses"
|
||||
},
|
||||
{
|
||||
# Allow authenticated access to the CA expirations endpoint
|
||||
match-request: {
|
||||
path: "/puppet-ca/v1/expirations"
|
||||
type: path
|
||||
method: get
|
||||
}
|
||||
allow: "*"
|
||||
sort-order: 500
|
||||
name: "puppetlabs CA cert and CRL expirations"
|
||||
},
|
||||
{
|
||||
# Allow the CA CLI to access the certificate clean endpoint
|
||||
match-request: {
|
||||
path: "/puppet-ca/v1/clean"
|
||||
type: path
|
||||
method: put
|
||||
}
|
||||
allow: {
|
||||
extensions: {
|
||||
pp_cli_auth: "true"
|
||||
}
|
||||
}
|
||||
sort-order: 500
|
||||
name: "puppetlabs cert clean"
|
||||
},
|
||||
{
|
||||
# Allow the CA CLI to access the certificate sign endpoint
|
||||
match-request: {
|
||||
path: "/puppet-ca/v1/sign"
|
||||
type: path
|
||||
method: post
|
||||
}
|
||||
allow: {
|
||||
extensions: {
|
||||
pp_cli_auth: "true"
|
||||
}
|
||||
}
|
||||
sort-order: 500
|
||||
name: "puppetlabs cert sign"
|
||||
},
|
||||
{
|
||||
# Allow the CA CLI to access the certificate sign all endpoint
|
||||
match-request: {
|
||||
path: "/puppet-ca/v1/sign/all"
|
||||
type: path
|
||||
method: post
|
||||
}
|
||||
allow: {
|
||||
extensions: {
|
||||
pp_cli_auth: "true"
|
||||
}
|
||||
}
|
||||
sort-order: 500
|
||||
name: "puppetlabs cert sign all"
|
||||
},
|
||||
{
|
||||
# Allow unauthenticated access to the status service endpoint
|
||||
match-request: {
|
||||
path: "/status/v1/services"
|
||||
type: path
|
||||
method: get
|
||||
}
|
||||
allow-unauthenticated: true
|
||||
sort-order: 500
|
||||
name: "puppetlabs status service - full"
|
||||
},
|
||||
{
|
||||
match-request: {
|
||||
path: "/status/v1/simple"
|
||||
type: path
|
||||
method: get
|
||||
}
|
||||
allow-unauthenticated: true
|
||||
sort-order: 500
|
||||
name: "puppetlabs status service - simple"
|
||||
},
|
||||
{
|
||||
match-request: {
|
||||
path: "/puppet/v3/environments"
|
||||
type: path
|
||||
method: get
|
||||
}
|
||||
allow: "*"
|
||||
sort-order: 500
|
||||
name: "puppetlabs environments"
|
||||
},
|
||||
{
|
||||
# Allow nodes to access all file_bucket_files. Note that access for
|
||||
# the 'delete' method is forbidden by Puppet regardless of the
|
||||
# configuration of this rule.
|
||||
match-request: {
|
||||
path: "/puppet/v3/file_bucket_file"
|
||||
type: path
|
||||
method: [get, head, post, put]
|
||||
}
|
||||
allow: "*"
|
||||
sort-order: 500
|
||||
name: "puppetlabs file bucket file"
|
||||
},
|
||||
{
|
||||
# Allow nodes to access all file_content. Note that access for the
|
||||
# 'delete' method is forbidden by Puppet regardless of the
|
||||
# configuration of this rule.
|
||||
match-request: {
|
||||
path: "/puppet/v3/file_content"
|
||||
type: path
|
||||
method: [get, post]
|
||||
}
|
||||
allow: "*"
|
||||
sort-order: 500
|
||||
name: "puppetlabs file content"
|
||||
},
|
||||
{
|
||||
# Allow nodes to access all file_metadata. Note that access for the
|
||||
# 'delete' method is forbidden by Puppet regardless of the
|
||||
# configuration of this rule.
|
||||
match-request: {
|
||||
path: "/puppet/v3/file_metadata"
|
||||
type: path
|
||||
method: [get, post]
|
||||
}
|
||||
allow: "*"
|
||||
sort-order: 500
|
||||
name: "puppetlabs file metadata"
|
||||
},
|
||||
{
|
||||
# Allow nodes to retrieve only their own node definition
|
||||
match-request: {
|
||||
path: "^/puppet/v3/node/([^/]+)$"
|
||||
type: regex
|
||||
method: get
|
||||
}
|
||||
allow: "$1"
|
||||
sort-order: 500
|
||||
name: "puppetlabs node"
|
||||
},
|
||||
{
|
||||
# Allow nodes to store only their own reports
|
||||
match-request: {
|
||||
path: "^/puppet/v3/report/([^/]+)$"
|
||||
type: regex
|
||||
method: put
|
||||
}
|
||||
allow: "$1"
|
||||
sort-order: 500
|
||||
name: "puppetlabs report"
|
||||
},
|
||||
{
|
||||
# Allow nodes to update their own facts
|
||||
match-request: {
|
||||
path: "^/puppet/v3/facts/([^/]+)$"
|
||||
type: regex
|
||||
method: put
|
||||
}
|
||||
allow: "$1"
|
||||
sort-order: 500
|
||||
name: "puppetlabs facts"
|
||||
},
|
||||
{
|
||||
match-request: {
|
||||
path: "/puppet/v3/static_file_content"
|
||||
type: path
|
||||
method: get
|
||||
}
|
||||
allow: "*"
|
||||
sort-order: 500
|
||||
name: "puppetlabs static file content"
|
||||
},
|
||||
{
|
||||
match-request: {
|
||||
path: "/puppet/v3/tasks"
|
||||
type: path
|
||||
}
|
||||
allow: "*"
|
||||
sort-order: 500
|
||||
name: "puppet tasks information"
|
||||
},
|
||||
{
|
||||
# Deny everything else. This ACL is not strictly
|
||||
# necessary, but illustrates the default policy
|
||||
match-request: {
|
||||
path: "/"
|
||||
type: path
|
||||
}
|
||||
deny: "*"
|
||||
sort-order: 999
|
||||
name: "puppetlabs deny all"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -4,7 +4,7 @@ agent:
|
||||
WOODPECKER_MAX_WORKFLOWS: "8"
|
||||
WOODPECKER_BACKEND_K8S_PRIORITY_CLASS: power
|
||||
WOODPECKER_BACKEND_K8S_STORAGE_CLASS: cephrbd-fast-delete
|
||||
WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 10G
|
||||
WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 20Gi
|
||||
WOODPECKER_BACKEND_K8S_STORAGE_RWX: false
|
||||
# Required from woodpecker 3.16.0 (GHSA-qf34-295c-26v8): step-level
|
||||
# serviceAccountName is gated behind this agent flag (default false).
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
1.33.13
|
||||
+2
-2
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
KUBE_VERSION="1.33.7"
|
||||
KUBE_VERSION="$(cat ci/kube-version)"
|
||||
|
||||
SCHEMA_DIR="${SCHEMA_DIR:-schemas}"
|
||||
|
||||
@@ -15,7 +15,7 @@ while IFS= read -r -d "" k; do
|
||||
dir="$(dirname "$k")"
|
||||
echo "==> kubeconform: $dir" >&2
|
||||
|
||||
kustomize build --enable-helm "$dir" \
|
||||
kustomize build --enable-helm --helm-kube-version "$KUBE_VERSION" "$dir" \
|
||||
| kubeconform \
|
||||
-kubernetes-version "$KUBE_VERSION" \
|
||||
-summary \
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
KUBE_VERSION="1.33.7"
|
||||
KUBE_VERSION="$(cat ci/kube-version)"
|
||||
|
||||
SCHEMA_DIR="${SCHEMA_DIR:-schemas}"
|
||||
|
||||
@@ -15,7 +15,7 @@ while IFS= read -r -d "" k; do
|
||||
dir="$(dirname "$k")"
|
||||
echo "==> kubeconform: $dir" >&2
|
||||
|
||||
kustomize build --enable-helm "$dir" \
|
||||
kustomize build --enable-helm --helm-kube-version "$KUBE_VERSION" "$dir" \
|
||||
| kubeconform \
|
||||
-kubernetes-version "$KUBE_VERSION" \
|
||||
-summary \
|
||||
|
||||
+2
-2
@@ -49,8 +49,8 @@
|
||||
- Use existing patterns like `apps/overlays/*/csi-*` or `apps/overlays/*/<app-name>`
|
||||
|
||||
### 9. Validation
|
||||
- Run `kustomize build --enable-helm apps/overlays/au-syd1/<app-name>` to generate all resources
|
||||
- Check resource types: `kustomize build --enable-helm apps/overlays/au-syd1/<app-name> | grep "^kind:" | sort | uniq -c`
|
||||
- Run `kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/<app-name>` to generate all resources
|
||||
- Check resource types: `kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/<app-name> | grep "^kind:" | sort | uniq -c`
|
||||
- Verify all resource types are permitted in the target project's `clusterResourceWhitelist` and `namespaceResourceWhitelist`
|
||||
- Run `make kubeconform` to validate all resources
|
||||
- Fix any validation errors
|
||||
|
||||
Reference in New Issue
Block a user