481 lines
12 KiB
YAML
481 lines
12 KiB
YAML
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: fc-dns
|
|
labels:
|
|
app.kubernetes.io/part-of: flowercore
|
|
---
|
|
# 1Password-backed Secret for the pfSense admin password.
|
|
# The operator watches this CRD, resolves the vault item, and produces a
|
|
# K8s Secret of the same name with each 1P field as a key. The `password`
|
|
# field of the "pfSense Admin" item becomes Secret key `password`.
|
|
apiVersion: onepassword.com/v1
|
|
kind: OnePasswordItem
|
|
metadata:
|
|
name: pfsense-admin
|
|
namespace: fc-dns
|
|
spec:
|
|
itemPath: "vaults/IAmWorkin/items/pfSense Admin"
|
|
---
|
|
apiVersion: onepassword.com/v1
|
|
kind: OnePasswordItem
|
|
metadata:
|
|
name: dns-oidc-client
|
|
namespace: fc-dns
|
|
spec:
|
|
itemPath: "vaults/IAmWorkin/items/dns-oidc-client"
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: dns-web-data
|
|
namespace: fc-dns
|
|
spec:
|
|
accessModes: [ReadWriteOnce]
|
|
storageClassName: longhorn
|
|
resources:
|
|
requests:
|
|
storage: 1Gi
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: dns-web-config
|
|
namespace: fc-dns
|
|
data:
|
|
appsettings.Production.json: |
|
|
{
|
|
"FlowerCore": {
|
|
"Auth": {
|
|
"Enabled": true,
|
|
"Oidc": {
|
|
"Enabled": true,
|
|
"Audience": "dns",
|
|
"RequireHttpsMetadata": true
|
|
}
|
|
},
|
|
"Database": {
|
|
"Provider": "Sqlite",
|
|
"ConnectionStrings": {
|
|
"Sqlite": "Data Source=/data/dns.db"
|
|
}
|
|
},
|
|
"Tenant": {
|
|
"DefaultTenantId": "default",
|
|
"JwtClaimsEnabled": false,
|
|
"DefaultTenantHosts": [
|
|
"dns.iamworkin.lan"
|
|
]
|
|
},
|
|
"Audit": {
|
|
"HashChain": {
|
|
"BridgeSensitivity": {
|
|
"Distribution": "Warn"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: dns-web
|
|
namespace: fc-dns
|
|
labels:
|
|
app.kubernetes.io/name: dns-web
|
|
app.kubernetes.io/managed-by: flowercore
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: dns-web
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: dns-web
|
|
annotations:
|
|
prometheus.io/scrape: "true"
|
|
prometheus.io/port: "5320"
|
|
prometheus.io/path: "/metrics/prometheus"
|
|
spec:
|
|
serviceAccountName: dns-web
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1654
|
|
runAsGroup: 1654
|
|
fsGroup: 1654
|
|
containers:
|
|
- name: dns-web
|
|
image: localhost/fc-dns-web:v20260604-oidc-proper
|
|
imagePullPolicy: Never
|
|
securityContext:
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: [ALL]
|
|
ports:
|
|
- containerPort: 5320
|
|
env:
|
|
# pfSense admin password resolved by the 1Password operator.
|
|
# `FallbackPassword` is the Slice A seam exposed by
|
|
# OptionsFallbackPasswordResolver; Slice B will replace it with
|
|
# a pull-at-runtime 1P Connect resolver once Shared.Vault ships.
|
|
- name: FlowerCore__Dns__Providers__PfSenseUnbound__FallbackPassword
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: pfsense-admin
|
|
key: password
|
|
- name: FlowerCore__Auth__Oidc__Authority
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: dns-oidc-client
|
|
key: issuer_url
|
|
optional: true
|
|
- name: FlowerCore__Auth__Oidc__ClientId
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: dns-oidc-client
|
|
key: client_id
|
|
optional: true
|
|
- name: FlowerCore__Auth__Oidc__ClientSecret
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: dns-oidc-client
|
|
key: client_secret
|
|
optional: true
|
|
- name: FlowerCore__Auth__Enabled
|
|
value: "true"
|
|
- name: FlowerCore__Auth__Oidc__Enabled
|
|
value: "true"
|
|
- name: FlowerCore__Auth__Oidc__Audience
|
|
value: "dns"
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /data
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
- name: logs
|
|
mountPath: /app/logs
|
|
- name: config
|
|
mountPath: /app/appsettings.Production.json
|
|
subPath: appsettings.Production.json
|
|
readOnly: true
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 96Mi
|
|
limits:
|
|
cpu: 300m
|
|
memory: 384Mi
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: 5320
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: 5320
|
|
initialDelaySeconds: 20
|
|
periodSeconds: 30
|
|
volumes:
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: dns-web-data
|
|
- name: tmp
|
|
emptyDir: {}
|
|
- name: logs
|
|
emptyDir: {}
|
|
- name: config
|
|
configMap:
|
|
name: dns-web-config
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: dns-web
|
|
namespace: fc-dns
|
|
spec:
|
|
selector:
|
|
app.kubernetes.io/name: dns-web
|
|
ports:
|
|
- port: 5320
|
|
targetPort: 5320
|
|
type: ClusterIP
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: dns-web
|
|
namespace: fc-dns
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: dns-web
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["namespaces", "pods", "services", "secrets", "configmaps"]
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: ["cert-manager.io"]
|
|
resources: ["certificates"]
|
|
verbs: ["get", "list", "watch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: dns-web
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: dns-web
|
|
namespace: fc-dns
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: dns-web
|
|
apiGroup: rbac.authorization.k8s.io
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: dns-web-cert
|
|
namespace: fc-dns
|
|
spec:
|
|
secretName: dns-web-tls
|
|
issuerRef:
|
|
name: step-ca-dns01
|
|
kind: ClusterIssuer
|
|
dnsNames:
|
|
- dns.iamworkin.lan
|
|
duration: 720h
|
|
renewBefore: 240h
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: dns-web
|
|
namespace: fc-dns
|
|
spec:
|
|
entryPoints: [websecure]
|
|
routes:
|
|
- match: Host(`dns.iamworkin.lan`)
|
|
kind: Rule
|
|
services:
|
|
- name: dns-web
|
|
port: 5320
|
|
tls:
|
|
secretName: dns-web-tls
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: dns-acme-webhook
|
|
namespace: fc-dns
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: dns-acme-webhook
|
|
namespace: fc-dns
|
|
labels:
|
|
app.kubernetes.io/name: dns-acme-webhook
|
|
app.kubernetes.io/managed-by: flowercore
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: dns-acme-webhook
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: dns-acme-webhook
|
|
spec:
|
|
serviceAccountName: dns-acme-webhook
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1654
|
|
runAsGroup: 1654
|
|
fsGroup: 1654
|
|
containers:
|
|
- name: dns-acme-webhook
|
|
image: localhost/fc-dns-acme-webhook:v202604290845
|
|
imagePullPolicy: Never
|
|
securityContext:
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: [ALL]
|
|
ports:
|
|
- containerPort: 9443
|
|
name: https
|
|
env:
|
|
- name: ASPNETCORE_URLS
|
|
value: https://+:9443
|
|
- name: Kestrel__Certificates__Default__Path
|
|
value: /tls/tls.crt
|
|
- name: Kestrel__Certificates__Default__KeyPath
|
|
value: /tls/tls.key
|
|
- name: FlowerCore__Dns__AcmeWebhook__ServiceBaseUrl
|
|
value: http://dns-web:5320
|
|
- name: FlowerCore__Dns__AcmeWebhook__GroupName
|
|
value: acme.flowercore.io
|
|
- name: FlowerCore__Dns__AcmeWebhook__SolverName
|
|
value: flowercore-dns
|
|
- name: FlowerCore__Dns__AcmeWebhook__Version
|
|
value: v1alpha1
|
|
volumeMounts:
|
|
- name: tls
|
|
mountPath: /tls
|
|
readOnly: true
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
- name: logs
|
|
mountPath: /app/logs
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 256Mi
|
|
readinessProbe:
|
|
httpGet:
|
|
scheme: HTTPS
|
|
path: /readyz
|
|
port: https
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
livenessProbe:
|
|
httpGet:
|
|
scheme: HTTPS
|
|
path: /healthz
|
|
port: https
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 20
|
|
timeoutSeconds: 5
|
|
volumes:
|
|
- name: tls
|
|
secret:
|
|
secretName: dns-acme-webhook-tls
|
|
- name: tmp
|
|
emptyDir: {}
|
|
- name: logs
|
|
emptyDir: {}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: dns-acme-webhook
|
|
namespace: fc-dns
|
|
spec:
|
|
selector:
|
|
app.kubernetes.io/name: dns-acme-webhook
|
|
ports:
|
|
- port: 443
|
|
targetPort: https
|
|
name: https
|
|
type: ClusterIP
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Issuer
|
|
metadata:
|
|
name: dns-acme-webhook-selfsigned
|
|
namespace: fc-dns
|
|
spec:
|
|
selfSigned: {}
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: dns-acme-webhook-ca
|
|
namespace: fc-dns
|
|
spec:
|
|
secretName: dns-acme-webhook-ca
|
|
duration: 43800h
|
|
issuerRef:
|
|
name: dns-acme-webhook-selfsigned
|
|
commonName: ca.dns-acme-webhook.fc-dns
|
|
isCA: true
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Issuer
|
|
metadata:
|
|
name: dns-acme-webhook-ca-issuer
|
|
namespace: fc-dns
|
|
spec:
|
|
ca:
|
|
secretName: dns-acme-webhook-ca
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: dns-acme-webhook-serving-cert
|
|
namespace: fc-dns
|
|
spec:
|
|
secretName: dns-acme-webhook-tls
|
|
duration: 8760h
|
|
issuerRef:
|
|
name: dns-acme-webhook-ca-issuer
|
|
dnsNames:
|
|
- dns-acme-webhook
|
|
- dns-acme-webhook.fc-dns
|
|
- dns-acme-webhook.fc-dns.svc
|
|
---
|
|
apiVersion: apiregistration.k8s.io/v1
|
|
kind: APIService
|
|
metadata:
|
|
name: v1alpha1.acme.flowercore.io
|
|
annotations:
|
|
cert-manager.io/inject-ca-from: fc-dns/dns-acme-webhook-serving-cert
|
|
spec:
|
|
group: acme.flowercore.io
|
|
groupPriorityMinimum: 1000
|
|
service:
|
|
name: dns-acme-webhook
|
|
namespace: fc-dns
|
|
version: v1alpha1
|
|
versionPriority: 15
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: dns-acme-webhook-solver
|
|
rules:
|
|
- apiGroups: ["acme.flowercore.io"]
|
|
resources: ["flowercore-dns"]
|
|
verbs: ["create"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: dns-acme-webhook-solver
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: cert-manager
|
|
namespace: cert-manager
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: dns-acme-webhook-solver
|
|
apiGroup: rbac.authorization.k8s.io
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: step-ca-dns01
|
|
spec:
|
|
acme:
|
|
caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJ4RENDQVdxZ0F3SUJBZ0lSQVBZMzU3RzZvdzZ6TUFMNSs0YlMya2t3Q2dZSUtvWkl6ajBFQXdJd1FERWEKTUJnR0ExVUVDaE1SU1VGdFYyOXlhMmx1SUVGRFRVVWdRMEV4SWpBZ0JnTlZCQU1UR1VsQmJWZHZjbXRwYmlCQgpRMDFGSUVOQklGSnZiM1FnUTBFd0hoY05Nall3TXpBNE1UZ3dOekV4V2hjTk16WXdNekExTVRnd056RXhXakJBCk1Sb3dHQVlEVlFRS0V4RkpRVzFYYjNKcmFXNGdRVU5OUlNCRFFURWlNQ0FHQTFVRUF4TVpTVUZ0VjI5eWEybHUKSUVGRFRVVWdRMEVnVW05dmRDQkRRVEJaTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCSjJuMDRYMQpKWm81WmRxL2kxSWR2OCtmcXdaeUF6Qmg3d2hicWowU1dzSkw4VVdSYWJDTXFZQ3M3K2RYTzB4UlN6cWt3RkRMCngrdm9vT2FpOFJnUk5oYWpSVEJETUE0R0ExVWREd0VCL3dRRUF3SUJCakFTQmdOVkhSTUJBZjhFQ0RBR0FRSC8KQWdFQk1CMEdBMVVkRGdRV0JCUm51UFBRUjZpTS9INnZPbHVpVTNTeWdheXo4akFLQmdncWhrak9QUVFEQWdOSQpBREJGQWlFQXJRSzlkWVBHbUFac2RZbmp6aXVGVlZFNU5LWlVjY2VZdkdmR0MrdExYVXNDSUF1ZEYyekpyQ1JxCjNtSzUwWlpFVC9md1RrSndpRUY0ODI0bWpQOHAxQ0tNCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
|
|
privateKeySecretRef:
|
|
name: step-ca-dns01-account-key
|
|
server: https://10.0.56.10:9443/acme/acme/directory
|
|
solvers:
|
|
- dns01:
|
|
webhook:
|
|
groupName: acme.flowercore.io
|
|
solverName: flowercore-dns
|