cluster

commit 86f32ce7848a7c97f3645fc20b7d80cc5d313591
parent e5348dd36e4e8d6505f244944d23d7d01e10622a
Author: MTRNord <mtrnord1@gmail.com>
Date:   Wed, 20 Mar 2024 11:40:04 +0100

Add basic auth

Diffstat:
M
infrastructure/controllers/capacitor.yaml
 | 
194
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++----------------

1 file changed, 156 insertions(+), 38 deletions(-)
diff --git a/infrastructure/controllers/capacitor.yaml b/infrastructure/controllers/capacitor.yaml
@@ -1,53 +1,171 @@
----
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: OCIRepository
 metadata:
-  name: capacitor
-  namespace: flux-system
+    name: capacitor
+    namespace: flux-system
 spec:
-  interval: 12h
-  url: oci://ghcr.io/gimlet-io/capacitor-manifests
-  ref:
-    semver: ">=0.3.0"
+    interval: 12h
+    url: oci://ghcr.io/gimlet-io/capacitor-manifests
+    ref:
+        semver: '>=0.3.0'
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrZktYSXB6dDgxV2d0TTdj
+            Qm0zSzgxcStTa2ZyL0N2aG1MVEFBM0ozWDFVCnhFWS9iWUJyalpwSlJsWTVocUsw
+            aEtxL280ZTh6TmNUaWI2WlQwc2tuQWcKLS0tIEUzK29HV0x3M0h2ajY5QlV1TERy
+            V0E1R3ZETlBEWVFuWFBtSW5FQmtGSDQKuc9oZDqCLw4fW/BnvyJHyA4XfW/tfxRU
+            Vi8Auuzda6DYcpChudMDQu4EIP86SfggX0qL8KepwLt37zRVqQzS4g==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-03-20T10:39:31Z"
+    mac: ENC[AES256_GCM,data:LgClZ5tSKRgeYjNL7NJ6CHSOF4T3m8yr4tOCm+HWIIRi8BRY5VQLOHHyLFqX6CQt4AvSgiyMv/AMnHRMSqG5gRtPfrDq9tKWpTqe50OGi7h6I5DiWoDtpfYkN7YJXTYeT3OChv+AyYGzEyJN8v5slv+bMkLLZtNrmKSQKAjmhEg=,iv:g7Vm8y+31Wwwf1NFWkqqvPTWUAsXCmjAAY74hg4iQqM=,tag:ISGptzHAjoqF7r1MxoxUkw==,type:str]
+    pgp: []
+    encrypted_regex: ^(adminPassword|configPassword|adminUser|configUser|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|adminPassword|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret)$
+    version: 3.8.1
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: capacitor
-  namespace: flux-system
-spec:
-  targetNamespace: flux-system
-  interval: 1h
-  retryInterval: 2m
-  timeout: 5m
-  wait: true
-  prune: true
-  path: "./"
-  sourceRef:
-    kind: OCIRepository
     name: capacitor
+    namespace: flux-system
+spec:
+    targetNamespace: flux-system
+    interval: 1h
+    retryInterval: 2m
+    timeout: 5m
+    wait: true
+    prune: true
+    path: ./
+    sourceRef:
+        kind: OCIRepository
+        name: capacitor
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrZktYSXB6dDgxV2d0TTdj
+            Qm0zSzgxcStTa2ZyL0N2aG1MVEFBM0ozWDFVCnhFWS9iWUJyalpwSlJsWTVocUsw
+            aEtxL280ZTh6TmNUaWI2WlQwc2tuQWcKLS0tIEUzK29HV0x3M0h2ajY5QlV1TERy
+            V0E1R3ZETlBEWVFuWFBtSW5FQmtGSDQKuc9oZDqCLw4fW/BnvyJHyA4XfW/tfxRU
+            Vi8Auuzda6DYcpChudMDQu4EIP86SfggX0qL8KepwLt37zRVqQzS4g==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-03-20T10:39:31Z"
+    mac: ENC[AES256_GCM,data:LgClZ5tSKRgeYjNL7NJ6CHSOF4T3m8yr4tOCm+HWIIRi8BRY5VQLOHHyLFqX6CQt4AvSgiyMv/AMnHRMSqG5gRtPfrDq9tKWpTqe50OGi7h6I5DiWoDtpfYkN7YJXTYeT3OChv+AyYGzEyJN8v5slv+bMkLLZtNrmKSQKAjmhEg=,iv:g7Vm8y+31Wwwf1NFWkqqvPTWUAsXCmjAAY74hg4iQqM=,tag:ISGptzHAjoqF7r1MxoxUkw==,type:str]
+    pgp: []
+    encrypted_regex: ^(adminPassword|configPassword|adminUser|configUser|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|adminPassword|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret)$
+    version: 3.8.1
 ---
+apiVersion: v1
+kind: Secret
+metadata:
+    name: authsecret-capacitor
+    namespace: flux-system
+type: kubernetes.io/basic-auth
+stringData:
+    username: ENC[AES256_GCM,data:UXJgfJ3ZPQ==,iv:TWH++dcamk5d+ZDR6Vwxk7SF8J+Ciw0Ue7a9ANzDYcU=,tag:XFPb2OFK7GZ5w6t2g2jU6A==,type:str]
+    password: ENC[AES256_GCM,data:r8xTZJ6oNaSs,iv:F6ur7klHQQwycKGXzYtIxEi49X+xzX/VXIsElgclGhE=,tag:iSzl0NWfuhthWeq1J3qwdw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrZktYSXB6dDgxV2d0TTdj
+            Qm0zSzgxcStTa2ZyL0N2aG1MVEFBM0ozWDFVCnhFWS9iWUJyalpwSlJsWTVocUsw
+            aEtxL280ZTh6TmNUaWI2WlQwc2tuQWcKLS0tIEUzK29HV0x3M0h2ajY5QlV1TERy
+            V0E1R3ZETlBEWVFuWFBtSW5FQmtGSDQKuc9oZDqCLw4fW/BnvyJHyA4XfW/tfxRU
+            Vi8Auuzda6DYcpChudMDQu4EIP86SfggX0qL8KepwLt37zRVqQzS4g==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-03-20T10:39:31Z"
+    mac: ENC[AES256_GCM,data:LgClZ5tSKRgeYjNL7NJ6CHSOF4T3m8yr4tOCm+HWIIRi8BRY5VQLOHHyLFqX6CQt4AvSgiyMv/AMnHRMSqG5gRtPfrDq9tKWpTqe50OGi7h6I5DiWoDtpfYkN7YJXTYeT3OChv+AyYGzEyJN8v5slv+bMkLLZtNrmKSQKAjmhEg=,iv:g7Vm8y+31Wwwf1NFWkqqvPTWUAsXCmjAAY74hg4iQqM=,tag:ISGptzHAjoqF7r1MxoxUkw==,type:str]
+    pgp: []
+    encrypted_regex: ^(adminPassword|configPassword|adminUser|configUser|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|adminPassword|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret)$
+    version: 3.8.1
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+    name: capacitor-auth
+    namespace: flux-system
+spec:
+    basicAuth:
+        secret: ENC[AES256_GCM,data:JSbclJt+aYOr8x/9sfHZjn+FQ4w=,iv:nLtD9Oixdec81dNEGW+z8a86/tn/Q6rJLrfrzUMdeFE=,tag:aqAqedpaGEEw7ranGfY3PA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrZktYSXB6dDgxV2d0TTdj
+            Qm0zSzgxcStTa2ZyL0N2aG1MVEFBM0ozWDFVCnhFWS9iWUJyalpwSlJsWTVocUsw
+            aEtxL280ZTh6TmNUaWI2WlQwc2tuQWcKLS0tIEUzK29HV0x3M0h2ajY5QlV1TERy
+            V0E1R3ZETlBEWVFuWFBtSW5FQmtGSDQKuc9oZDqCLw4fW/BnvyJHyA4XfW/tfxRU
+            Vi8Auuzda6DYcpChudMDQu4EIP86SfggX0qL8KepwLt37zRVqQzS4g==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-03-20T10:39:31Z"
+    mac: ENC[AES256_GCM,data:LgClZ5tSKRgeYjNL7NJ6CHSOF4T3m8yr4tOCm+HWIIRi8BRY5VQLOHHyLFqX6CQt4AvSgiyMv/AMnHRMSqG5gRtPfrDq9tKWpTqe50OGi7h6I5DiWoDtpfYkN7YJXTYeT3OChv+AyYGzEyJN8v5slv+bMkLLZtNrmKSQKAjmhEg=,iv:g7Vm8y+31Wwwf1NFWkqqvPTWUAsXCmjAAY74hg4iQqM=,tag:ISGptzHAjoqF7r1MxoxUkw==,type:str]
+    pgp: []
+    encrypted_regex: ^(adminPassword|configPassword|adminUser|configUser|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|adminPassword|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret)$
+    version: 3.8.1
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-http
-  name: capacitor
-  namespace: flux-system
+    annotations:
+        cert-manager.io/cluster-issuer: letsencrypt-http
+        traefik.ingress.kubernetes.io/router.middlewares: flux-system-capacitor-auth-auth@kubernetescrd
+    name: capacitor
+    namespace: flux-system
 spec:
-  rules:
-  - host: ui.k8s.midnightthoughts.space
-    http:
-      paths:
-      - backend:
-          service:
-            name: capacitor
-            port:
-              number: 9000
-        path: /
-        pathType: ImplementationSpecific
-  tls:
-  - hosts:
-    - ui.k8s.midnightthoughts.space
-    secretName: ui.k8s.midnightthoughts.space-tls
+    rules:
+        - host: ui.k8s.midnightthoughts.space
+          http:
+            paths:
+                - backend:
+                    service:
+                        name: capacitor
+                        port:
+                            number: 9000
+                  path: /
+                  pathType: ImplementationSpecific
+    tls:
+        - hosts:
+            - ui.k8s.midnightthoughts.space
+          secretName: ui.k8s.midnightthoughts.space-tls
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrZktYSXB6dDgxV2d0TTdj
+            Qm0zSzgxcStTa2ZyL0N2aG1MVEFBM0ozWDFVCnhFWS9iWUJyalpwSlJsWTVocUsw
+            aEtxL280ZTh6TmNUaWI2WlQwc2tuQWcKLS0tIEUzK29HV0x3M0h2ajY5QlV1TERy
+            V0E1R3ZETlBEWVFuWFBtSW5FQmtGSDQKuc9oZDqCLw4fW/BnvyJHyA4XfW/tfxRU
+            Vi8Auuzda6DYcpChudMDQu4EIP86SfggX0qL8KepwLt37zRVqQzS4g==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-03-20T10:39:31Z"
+    mac: ENC[AES256_GCM,data:LgClZ5tSKRgeYjNL7NJ6CHSOF4T3m8yr4tOCm+HWIIRi8BRY5VQLOHHyLFqX6CQt4AvSgiyMv/AMnHRMSqG5gRtPfrDq9tKWpTqe50OGi7h6I5DiWoDtpfYkN7YJXTYeT3OChv+AyYGzEyJN8v5slv+bMkLLZtNrmKSQKAjmhEg=,iv:g7Vm8y+31Wwwf1NFWkqqvPTWUAsXCmjAAY74hg4iQqM=,tag:ISGptzHAjoqF7r1MxoxUkw==,type:str]
+    pgp: []
+    encrypted_regex: ^(adminPassword|configPassword|adminUser|configUser|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|adminPassword|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret)$
+    version: 3.8.1