bluejay
fef68a9560
Sprint 8 IMPL lane Cx-5: fc-devicemgmt K8s manifests (rebased onto main 2026-05-18; 13 files, +944).
Namespace + Web Deployment (replicas:2, MySQL backend) + Operator Deployment (replicas:1, KubeOps leader-elect) + Service + Certificate (step-ca-acme ClusterIssuer) + Traefik IngressRoute (devices.iamworkin.lan internal) + ServiceAccount + ClusterRole + ClusterRoleBinding + NetworkPolicy (CNI DNAT-aware backend ports) + OnePasswordItem (5-field consolidated) + ArgoCD Application bootstrap shape + lint coverage.
Follow-ups (not merge blockers):
- localhost/fc-devicemgmt-{web,operator}:v20260512-cx5 must be imported to all 3 RKE2 nodes; pods will ErrImageNeverPull until imported.
- 1Password vault item 'FlowerCore DeviceManagement Runtime' must be created with 5 fields before pods can start.
- DNS devices.iamworkin.lan -> 10.0.56.200 already present.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
225 lines
5.8 KiB
YAML
225 lines
5.8 KiB
YAML
# FlowerCore.DeviceManagement NetworkPolicies.
|
|
#
|
|
# NetworkPolicies belong in bluejay-infra so ArgoCD owns rebuild state.
|
|
# Rules include Traefik post-DNAT backend ports per
|
|
# feedback_netpol_dnat_backend_port and Synology NFS egress for the requested
|
|
# cold-tier / future artifact path.
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: fc-devicemgmt-web-isolation
|
|
namespace: fc-devicemgmt
|
|
labels:
|
|
app.kubernetes.io/name: fc-devicemgmt-web
|
|
app.kubernetes.io/component: web
|
|
app.kubernetes.io/part-of: flowercore
|
|
app.kubernetes.io/managed-by: argocd
|
|
flowercore.io/tenant-id: system
|
|
flowercore.io/created-by: bluejay-infra
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: fc-devicemgmt-web
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
ingress:
|
|
# LAN edge: only cluster Traefik should reach the Web pod for
|
|
# devices.iamworkin.lan.
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: traefik-system
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: traefik
|
|
ports:
|
|
- port: 8080
|
|
protocol: TCP
|
|
# Direct LAN diagnostics are allowed only from FlowerCore LAN/VPN ranges.
|
|
- from:
|
|
- ipBlock:
|
|
cidr: 10.0.56.0/24
|
|
- ipBlock:
|
|
cidr: 10.0.57.0/24
|
|
- ipBlock:
|
|
cidr: 10.0.58.0/24
|
|
- ipBlock:
|
|
cidr: 10.0.68.0/27
|
|
ports:
|
|
- port: 8080
|
|
protocol: TCP
|
|
egress:
|
|
# CoreDNS.
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
podSelector:
|
|
matchLabels:
|
|
k8s-app: kube-dns
|
|
ports:
|
|
- port: 53
|
|
protocol: UDP
|
|
- port: 53
|
|
protocol: TCP
|
|
# Database namespace.
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: fc-mysql
|
|
ports:
|
|
- port: 3306
|
|
protocol: TCP
|
|
# Redis backplane for multi-replica SignalR / live-status fan-out.
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: fc-redis
|
|
ports:
|
|
- port: 6379
|
|
protocol: TCP
|
|
# Traefik VIP / in-cluster Traefik for self-callbacks and public URL
|
|
# generation tests. Include post-DNAT backend ports 8443 + 8080.
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 10.0.56.200/32
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: traefik-system
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: traefik
|
|
ports:
|
|
- port: 80
|
|
protocol: TCP
|
|
- port: 443
|
|
protocol: TCP
|
|
- port: 8080
|
|
protocol: TCP
|
|
- port: 8443
|
|
protocol: TCP
|
|
# Agent egress: LAN/VPN devices may run DM Agent in Generic, Kiosk, Pi,
|
|
# ThinClient, or Server mode. Keep this private-range only.
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 10.0.56.0/24
|
|
- ipBlock:
|
|
cidr: 10.0.57.0/24
|
|
- ipBlock:
|
|
cidr: 10.0.58.0/24
|
|
- ipBlock:
|
|
cidr: 10.0.68.0/27
|
|
ports:
|
|
- port: 80
|
|
protocol: TCP
|
|
- port: 443
|
|
protocol: TCP
|
|
- port: 8080
|
|
protocol: TCP
|
|
- port: 8443
|
|
protocol: TCP
|
|
- port: 5000
|
|
protocol: TCP
|
|
- port: 5001
|
|
protocol: TCP
|
|
# Synology NFS cold-tier / artifact mount allowance.
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 10.0.58.3/32
|
|
ports:
|
|
- port: 2049
|
|
protocol: TCP
|
|
- port: 2049
|
|
protocol: UDP
|
|
- port: 111
|
|
protocol: TCP
|
|
- port: 111
|
|
protocol: UDP
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: fc-devicemgmt-operator-isolation
|
|
namespace: fc-devicemgmt
|
|
labels:
|
|
app.kubernetes.io/name: fc-devicemgmt-operator
|
|
app.kubernetes.io/component: operator
|
|
app.kubernetes.io/part-of: flowercore
|
|
app.kubernetes.io/managed-by: argocd
|
|
flowercore.io/tenant-id: system
|
|
flowercore.io/created-by: bluejay-infra
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: fc-devicemgmt-operator
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: monitoring
|
|
ports:
|
|
- port: 8080
|
|
protocol: TCP
|
|
egress:
|
|
# CoreDNS.
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
podSelector:
|
|
matchLabels:
|
|
k8s-app: kube-dns
|
|
ports:
|
|
- port: 53
|
|
protocol: UDP
|
|
- port: 53
|
|
protocol: TCP
|
|
# Kubernetes API for KubeOps reconciliation and Deployment UID lookup.
|
|
- to: []
|
|
ports:
|
|
- port: 443
|
|
protocol: TCP
|
|
- port: 6443
|
|
protocol: TCP
|
|
# Agent egress for operator-initiated probes / fallback command dispatch.
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 10.0.56.0/24
|
|
- ipBlock:
|
|
cidr: 10.0.57.0/24
|
|
- ipBlock:
|
|
cidr: 10.0.58.0/24
|
|
- ipBlock:
|
|
cidr: 10.0.68.0/27
|
|
ports:
|
|
- port: 80
|
|
protocol: TCP
|
|
- port: 443
|
|
protocol: TCP
|
|
- port: 8080
|
|
protocol: TCP
|
|
- port: 8443
|
|
protocol: TCP
|
|
- port: 5000
|
|
protocol: TCP
|
|
- port: 5001
|
|
protocol: TCP
|
|
# Synology NFS allowance for future cold-tier/audit archival jobs.
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 10.0.58.3/32
|
|
ports:
|
|
- port: 2049
|
|
protocol: TCP
|
|
- port: 2049
|
|
protocol: UDP
|
|
- port: 111
|
|
protocol: TCP
|
|
- port: 111
|
|
protocol: UDP
|