diff --git a/apps/k8s01/iot/kustomization.yaml b/apps/k8s01/iot/kustomization.yaml index ccee6fc2c71c5573b8b2ac28684d348cadb76942..f712fc87f080100a26adf930294a52780247ae20 100644 --- a/apps/k8s01/iot/kustomization.yaml +++ b/apps/k8s01/iot/kustomization.yaml @@ -4,6 +4,7 @@ namespace: iot resources: - ../../base/iot - certificate.yaml +- ../../../shared/applications/oauth2-proxy.yaml - oauth2.yaml - rainer.yaml - shelly.yaml diff --git a/apps/k8s01/iot/oauth2.yaml b/apps/k8s01/iot/oauth2.yaml index c1ffc626001897520c26d8fe35503dc9a9944cbe..3e021a1679e263bfeae5f7e07a13f45c07e260f8 100644 --- a/apps/k8s01/iot/oauth2.yaml +++ b/apps/k8s01/iot/oauth2.yaml @@ -1,215 +1,17 @@ -apiVersion: source.toolkit.fluxcd.io/v1beta1 -kind: HelmRepository +apiVersion: v1 +kind: Secret metadata: - name: oauth2-proxy - namespace: iot -spec: - interval: 30m - url: https://oauth2-proxy.github.io/manifests + name: oauth2-proxy-override-values +stringData: + values-overrides.yaml: ENC[AES256_GCM,data:aHHeg6ihMdpsbgkv1s+1WETLzf0UmfRwrFomAiKaFjArqgGT/uNxH3uKD/wFqKzzPQrV4CfgQOEzljDSrMELCcoENkGZU7EX+1DeAVNv+joNxxESE0f5YzgNs5zHKdSBNAIV3U25el5NAzWhmSMetkAN1frROpevAOYD9nsYhG8JMcD5Rvw4/1Lt+it34BI+Lsq/fyGLmcOe/OZF8hTUbeNgIHxN8R3sjhIj1UCO5L15Bnbeqf7u8/QBOlG/vCkwgbRFacweiYUeYm41QNDY8a/ivyxlM+c8mrs3q3/BFEppYLmgqk29YVtzMh2HtTcOlSUzmjMm4Ssz+wOPueFC1pUEasONp1sqXPq6vlkVtvVBQxVkh5ZTd15k4rQgI7CiS5CUNLRkk68SC/eSj/J47p9ZqwnP/QhqjCyXmc2cMANXbI1HCpRcVrQhnlzg+H7ZF/AGTkWb5lKb2GH1c2e8d3V9+v5kzX81Y+1n29lSQtZcYnvoYRWrpOR8FV8DCs0jd7IKf6yzzWt3XhhTpOY3nHnf9Z5S2r84smXj9ij7Lwtnk2U6hZbrkoe5k0RzLiKbBuqQ3wmiXEZEBksuaEP5Rdq+IJzb7LtZr9gDSPSYLK+c7VDH9mou8aoMfp4vfkXiwq7rXBa7vqJqUiRlWGEca8ZeyMkFxtIqUQ3wfvMlyA66BY+YN/ONZhfUpNQjIrewosnImWyx0ltXLdwcCsfAhO/I1M/wQ/3dPlfMjYb/qvd/0qBAN+aK5TBHVERoNAMnkqlheQn35QvkumlnNqeSab9bfxgCIxTaahVB35GY/7kp3/lspPWGwdy3mDHh/AX2+nLLcrFNozM9qO9o0hurkNg1Chz1oqZ5RPZa1Qu/SZXoJzplzJ7Y8tZu17YqaPHxXrPVr3VX2vTnA8MtUJ2jFU1LQNuv8vMLAr5SWotK3rk/+Qp7dfwF3dnfiz131NEsD8hYWzXk9p+/FBg/GXOKI4WStC3g0P7yCALNYsygTNAD1UZEk8fsggGyMihiyFqjKHtMDu4jGJGhYEUxPey/in/CYNhSXZ7beRtZEsWBpTdSAUOGXJBkyNnf9LDzQuWHaHwTfJ3PeZ6x1OS+Fd0MvWpJvNKMdH9AqWLV+Lfyj4saMwi2GzuN+5N2cR44LbVHVuYxNFVLGiLMSOZgDCkDWMo9d4hVZYTYUn2sGxkW1T00f9SiY34fVveDagoKWQrRTWtNcY3P5hSFaw7/xDCtnMOtKZknSCk9tn7IbpkuuBAtvXgoUpc=,iv:sp15PjDAd/+ztuj3vFXS167WRZSd3KrVf/V886x/dD4=,tag:9s3fx4C/LBCxYCRdrShJ9w==,type:str] sops: kms: [] gcp_kms: [] azure_kv: [] hc_vault: [] age: [] - lastmodified: "2023-09-11T07:18:11Z" - mac: ENC[AES256_GCM,data:kPRTYIh0XOLNquSkAuU6UXmZp5YrcR1YLE6i5zEjWJZ2lQ7/nFv3zoumy5lAVgaGFWZe+DkRmnmAJuX0YrPToVQqAMLxLJiL2ZtnqgsDgCVtz9qhhDzxlCiiEfJ3G5snqH/gqSn+3ToRA5WnirQ/9XLTNHGbVK4vgSNQZnYR7WI=,iv:jvnb0bJAfJ1Gnf9AePj/CQQci6jel5aeOU0zM8W0fh0=,tag:wrakrH1HzqhBESqM7xVxCQ==,type:str] - pgp: - - created_at: "2022-01-22T04:06:16Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - wcFMA7kpg2bgzVHcARAAEMYePDu0adicU5QpAHImOx7hoXF+86zBSi2+y2/jbaAc - RfWBFj6XdBwso+eB7FOab6z4zsFObeIaQPwYm06xcV0BptsLmQFn7WhoY4L+M0Jt - LHH9QnzWhnR7MVKctSuB18AN0gN2f+TpsZ5OAQmYrim4GTexwzXMUSEtO7z8ohUU - FTGbGm9sOGJ6GbFf5QEVuk3/YuVG81Cwqj3Bmj/prARTAqbrRhXkwCGp5f7v7IzG - dMAZOP7Y6ZlU2CVRszTHYGuP92PcopB0rSmrPYizxOkpWOrjsjJJvdA2Kixomf8F - k3MCB9dCIZzWB5GbSdXnxHXa/nflEgK7168JGE8pnPsJv7qj5ex+8kJRyRenZ+CY - Jna9x+0414m8lZY8GhSdsPHK0ieXiGx4Yx2YTRX19JJ2hNhW6m4cFE0JtPba69WS - JWFUz+SKt3bcYOOGefj3b+pmzGOKLLu3C+mRem01o9dSEAFx7XSBBdCHQRRJYPHc - cuPUf9XX7hclqR6Mm+ykVOtnGp0bENv+ioQMPodP1xJc265axqEPiL5X5EZJUsi3 - 5R8FEcf7jCjCjk16tIAT3/A7xjH3QOoF/ybU3fnRFOvKH6URZrsSBBdrZHvdeP9P - XxLxRyeiXT5adhQPq/fHkbie/m6tojZbaSBrQATCkDvfu7A0qJB2/z8uJ5BdUJzS - 5gEDeKWaWfx5rlOsk+YAllr0OGUg0vkuZaF0x0y/cRdv3pJ986kwBj/cyH/WHr0q - AXep5yazGidrbSAn/j73JDrkzMs5x+aOYqksvf3IRN0S6uKODPCQAA== - =b0Da - -----END PGP MESSAGE----- - fp: 286791FB6648539775DB31B8FCB98C2A3EC6F601 - - created_at: "2022-01-22T04:06:16Z" - enc: | - -----BEGIN PGP MESSAGE----- - - hQIMA4oYbIHZIrAPAQ//Rmyvq+jnhjGnKi1NCc5Zf67dxWTChPcRA2L169upfC9O - I+v2ZjfjUF5jEgBXNax6jBK/H2Y7+u1aMRfunVrabgnhoeR0gIDrvphz0TemH7sU - DLrXiSACdlObZUfDMkgbi9f+W9HYWmfAUhAI0ZRxDnUo1wNrAgqqPDkG+XSg11Ev - jnSJGFZi9Z5Ez34/VC9Gh+qE/rqMFGPWZ8aFED37NjHKeDmZ/ZEtaYla/+B7tKv3 - N2U5IzZVSJSbVIojQxo2fIEGPwRjVOCdOzfT4Wlpwd//SvmvxaJysshY5fkeXfLW - 7Kd/b2utwNL4x9kLMrnK9F1aHHxSZ5zkDxZgTrCEk3dawOeoylTckMT7VQ7qJCUT - TmIj7cJuOy9U1jiWDjmVJ8B3PvbudS0/IlTyqnjPax5AizPjKOkcfUkVn3fd/LmV - pV7JqbwRfaVbeD1LFQjppzL7NAqjl+G9g70x4KAXAnaC58m8eLMrNBxKZ8fq0n0H - Up54AO62LXaGQMIkV+8lVXBZDf3ORWAjwbNw8CWxwoTu3W3+Hy0i8C2Eq8DQIinN - PqYSmq0HpJJFrsObRlymciiG0c6w6Ca20LPZBKYjRqmWBUuYRhEMzxob56ueTQnB - e45lGaDoDd+mdI9RHaGvAh64B+e3ebrVWCRcpRDlU66R4Mh+WVMkPjTCkYmLPFnU - ZgEJAhDZzR/ZWWatzIYkHKJM6ksn/zdPO0yuXRIUhEqFCjNfTy29WMKzaTSQC/0M - vDBW2bfq2zQrFCqcE2agsn5rXeii5Q8hj3TrGgzsa/bWf7zFDdogqfjdaZivyTq/ - 4ZHWevz7fQ== - =mefK - -----END PGP MESSAGE----- - fp: B137EE1549DFAF960DD1E2B15147025FB9F09E07 - encrypted_regex: ^(data|stringData|email|dnsZones?|dnsNames?|hosts?|tang|externalURL|.*-secret|.*-url|.*Secret|.*-domain)$ - version: 3.7.3 ---- -apiVersion: helm.toolkit.fluxcd.io/v2beta1 -kind: HelmRelease -metadata: - name: oauth2-proxy - namespace: iot -spec: - serviceAccountName: flux-reconciler - releaseName: oauth2-proxy - chart: - spec: - chart: oauth2-proxy - sourceRef: - kind: HelmRepository - name: oauth2-proxy - namespace: iot - version: 6.17.0 - interval: 5m - upgrade: - remediation: - retries: -1 - install: - remediation: - retries: -1 - values: - config: - clientID: iot-k8s01 - clientSecret: ENC[AES256_GCM,data:NByRpg/0jm3lZvI3f+oEMqvzVbYxlhgid0Pk1NuKVIQ=,iv:VBtyY8GNpGwAgGQmVStMmz8D9iojqH96sbNILb+nvys=,tag:GYyD5pG8+8Tqh9+O5wiDNQ==,type:str] - cookieSecret: ENC[AES256_GCM,data:g0l+5HrakpEO/QIqGwT4yhzWL0+KzAChuGKNLN6cCeZ1TZPWZwQl3pTnAQ==,iv:PBoklIo3LhvLloXUWP5IEtQ46VfJJE7EbXO+LdGD/ks=,tag:M+XK3Rx+WNUIonzwjVtkqg==,type:str] - extraArgs: - provider: keycloak-oidc - provider-display-name: SI-Auth - oidc-issuer-url: ENC[AES256_GCM,data:+cPjWSr7x1gKBLJsDbnyPtR7OFSEdVvGy39JIjbek++RlRXw2mWOMjq5PpP7BBeOhJ2wuEU5WA==,iv:0avQixtcn6Mr87AcloKhIVAIcp08eQk9Ud80CjMRfB4=,tag:kAjkI5SIKdzBgTH+oyHtuw==,type:str] - allowed-role: iot-k8s01:user - whitelist-domain: ENC[AES256_GCM,data:jRPNQJFpx1df8iOADfb4LX/gK9tGnimE,iv:Fti2Z4gAP+AlCp4tiDxjrV/REX7S3neoZs2bMxtN8lM=,tag:YN3ZMpvMRmYdXv5Xr5P2Ag==,type:str] - session-cookie-minimal: "true" - silence-ping-logging: "true" - scope: openid email profile - replicaCount: 2 - securityContext: - enabled: true - affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchLabels: - app: oauth2-proxy - topologyKey: kubernetes.io/hostname - ingress: - enabled: true - path: /oauth2 - pathType: Prefix - hosts: - - ENC[AES256_GCM,data:Cjzb+LBU9CL18HQ0fcY6PmmptlToTlhxfcjPAMnLVqA=,iv:Uu99tFJsy9CJ1gyuB+ix67+IY/U496urRCgSN0EKcIM=,tag:kADui+7jGC5eAS1VkPWisg==,type:str] - - ENC[AES256_GCM,data:Bmem8GvFc0q3lGzGZ8KQym15g9aqVjt/JNFkfxFkvmA=,iv:9EDMDIqOzOdm49c8vKRAAfc8BWpUxyx2VUHP2wJdmeA=,tag:sDG5p5FrMhc8DHl1BkQSvA==,type:str] - - ENC[AES256_GCM,data:Q57ZrLnUIxmx+42NcR3wkjLCCGo3aQ0KVtFRXDwYbIA=,iv:uuAe7C55Z15fZalR0eBQuKqKhdkemekJsLK8x+ggKXk=,tag:jal3w5X2x/TCfbfPy7u3Ow==,type:str] - - ENC[AES256_GCM,data:ulWdzEI2pf8O8lOMRCn90dQByek5scLg2pG53/86GvU=,iv:9z6Bbhc90LxZc7iJOSUz7AvzI4T7RRCEuPvKeiUfja4=,tag:OmJpVhH8WV/tSTIFQKyxEw==,type:str] - - ENC[AES256_GCM,data:a36ILwQrf8Ivtfu6Wbr73NJQ01WbeYuUiR1egUAPPqM=,iv:PmWKxSa/mQIchCuxeeDryz4jVmv0TaVNR4a3mpaKsZU=,tag:Yd5hi1tAttPOh9ebJDI6kQ==,type:str] - - ENC[AES256_GCM,data:L0FA3kKWGDcSPYEUNSezW1bWm5l39EHALGAjFg==,iv:81wrrUVDuRN4l81L2w//u2gj6ykehd9bPJ9PdaDPiDY=,tag:q5gj/ie2+qRuprP6wOzjRw==,type:str] - - ENC[AES256_GCM,data:gUZWJh5q+tsqJRbR072S6qX42kHh5fZud92ZaQ==,iv:WZWo4jA75RDtjxHP8e+j027Yfgaz5bDjIhnPag6vWE8=,tag:xKEvHs0kupXX7NjKUizqSw==,type:str] - tls: - - hosts: - - ENC[AES256_GCM,data:JVigFbKEka5xargdj0SmcT74VDXuHycUgr6zF49+ycw=,iv:dg2Dq5CWwYpUAkNz0KO1qnvOhrBz7y7V5BPbvV1Q2bU=,tag:xkZaVvEImQSYNzm7j22ECQ==,type:str] - - ENC[AES256_GCM,data:98eYLrkn6Nn58H7O+7XKkWSnojdMHf1NTNu4IrCAOt8=,iv:huFJsNKD08SRHo81WcDQwY1+J0lYFBrCqdVEJblvabQ=,tag:Q4YfPZeDuI8TIgkyUmibWg==,type:str] - - ENC[AES256_GCM,data:Yw451etqbRjQwlh/V93HW4BO2r4n/dp2VMzuke3TALs=,iv:PtG9G9U4SQ326j6RVb2HMuP2PeSASTFb7WDgpun3vzA=,tag:NvvwWBpJobqWQXRK+berjw==,type:str] - - ENC[AES256_GCM,data:BmAHl+3yXG21e+muLvBDcwZE9LPBoorUalH6LKSORKQ=,iv:ezC/ic/L+Wcw3BsEty3ZOCsIqsQSluO5o430aQ539p4=,tag:4bUCCF5lUbYuB1pOhgrYcw==,type:str] - - ENC[AES256_GCM,data:Ipc3gVwGuVoVmf5KFiEglYh1u0xVwQQhFdQWm6QWlYA=,iv:wklQg9Ijr+cFhemRHFHwIiUEkct4WD6p9y5XljsU8Fk=,tag:Tm2MdflLlzxOXPatDqgS/w==,type:str] - - ENC[AES256_GCM,data:KvlSkKDLHWioLSJwPyp76tSP+45Kh+S3N8XBCg==,iv:ucS4UhUndyC1xy8ZAHYVp+YRDhzdTnRf9C84c1/eRu4=,tag:7xGfyPuBIpsBT/6IJ+UQjw==,type:str] - - ENC[AES256_GCM,data:ow7/rrp9iy3Wh3zsO728dsjNKl/lDdU2+OP8Jg==,iv:Na8djIwNlZNiN8oPRrKnT0yNaIsNbC/1MXFiD+JM5kk=,tag:VqU43dtysy+lg61iIYt0mA==,type:str] - secretName: ingress-iot-tls - resources: - limits: - cpu: 200m - memory: 100Mi - requests: - cpu: 100m - memory: 25Mi -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: [] - lastmodified: "2023-09-11T07:18:11Z" - mac: ENC[AES256_GCM,data:kPRTYIh0XOLNquSkAuU6UXmZp5YrcR1YLE6i5zEjWJZ2lQ7/nFv3zoumy5lAVgaGFWZe+DkRmnmAJuX0YrPToVQqAMLxLJiL2ZtnqgsDgCVtz9qhhDzxlCiiEfJ3G5snqH/gqSn+3ToRA5WnirQ/9XLTNHGbVK4vgSNQZnYR7WI=,iv:jvnb0bJAfJ1Gnf9AePj/CQQci6jel5aeOU0zM8W0fh0=,tag:wrakrH1HzqhBESqM7xVxCQ==,type:str] - pgp: - - created_at: "2022-01-22T04:06:16Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - wcFMA7kpg2bgzVHcARAAEMYePDu0adicU5QpAHImOx7hoXF+86zBSi2+y2/jbaAc - RfWBFj6XdBwso+eB7FOab6z4zsFObeIaQPwYm06xcV0BptsLmQFn7WhoY4L+M0Jt - LHH9QnzWhnR7MVKctSuB18AN0gN2f+TpsZ5OAQmYrim4GTexwzXMUSEtO7z8ohUU - FTGbGm9sOGJ6GbFf5QEVuk3/YuVG81Cwqj3Bmj/prARTAqbrRhXkwCGp5f7v7IzG - dMAZOP7Y6ZlU2CVRszTHYGuP92PcopB0rSmrPYizxOkpWOrjsjJJvdA2Kixomf8F - k3MCB9dCIZzWB5GbSdXnxHXa/nflEgK7168JGE8pnPsJv7qj5ex+8kJRyRenZ+CY - Jna9x+0414m8lZY8GhSdsPHK0ieXiGx4Yx2YTRX19JJ2hNhW6m4cFE0JtPba69WS - JWFUz+SKt3bcYOOGefj3b+pmzGOKLLu3C+mRem01o9dSEAFx7XSBBdCHQRRJYPHc - cuPUf9XX7hclqR6Mm+ykVOtnGp0bENv+ioQMPodP1xJc265axqEPiL5X5EZJUsi3 - 5R8FEcf7jCjCjk16tIAT3/A7xjH3QOoF/ybU3fnRFOvKH6URZrsSBBdrZHvdeP9P - XxLxRyeiXT5adhQPq/fHkbie/m6tojZbaSBrQATCkDvfu7A0qJB2/z8uJ5BdUJzS - 5gEDeKWaWfx5rlOsk+YAllr0OGUg0vkuZaF0x0y/cRdv3pJ986kwBj/cyH/WHr0q - AXep5yazGidrbSAn/j73JDrkzMs5x+aOYqksvf3IRN0S6uKODPCQAA== - =b0Da - -----END PGP MESSAGE----- - fp: 286791FB6648539775DB31B8FCB98C2A3EC6F601 - - created_at: "2022-01-22T04:06:16Z" - enc: | - -----BEGIN PGP MESSAGE----- - - hQIMA4oYbIHZIrAPAQ//Rmyvq+jnhjGnKi1NCc5Zf67dxWTChPcRA2L169upfC9O - I+v2ZjfjUF5jEgBXNax6jBK/H2Y7+u1aMRfunVrabgnhoeR0gIDrvphz0TemH7sU - DLrXiSACdlObZUfDMkgbi9f+W9HYWmfAUhAI0ZRxDnUo1wNrAgqqPDkG+XSg11Ev - jnSJGFZi9Z5Ez34/VC9Gh+qE/rqMFGPWZ8aFED37NjHKeDmZ/ZEtaYla/+B7tKv3 - N2U5IzZVSJSbVIojQxo2fIEGPwRjVOCdOzfT4Wlpwd//SvmvxaJysshY5fkeXfLW - 7Kd/b2utwNL4x9kLMrnK9F1aHHxSZ5zkDxZgTrCEk3dawOeoylTckMT7VQ7qJCUT - TmIj7cJuOy9U1jiWDjmVJ8B3PvbudS0/IlTyqnjPax5AizPjKOkcfUkVn3fd/LmV - pV7JqbwRfaVbeD1LFQjppzL7NAqjl+G9g70x4KAXAnaC58m8eLMrNBxKZ8fq0n0H - Up54AO62LXaGQMIkV+8lVXBZDf3ORWAjwbNw8CWxwoTu3W3+Hy0i8C2Eq8DQIinN - PqYSmq0HpJJFrsObRlymciiG0c6w6Ca20LPZBKYjRqmWBUuYRhEMzxob56ueTQnB - e45lGaDoDd+mdI9RHaGvAh64B+e3ebrVWCRcpRDlU66R4Mh+WVMkPjTCkYmLPFnU - ZgEJAhDZzR/ZWWatzIYkHKJM6ksn/zdPO0yuXRIUhEqFCjNfTy29WMKzaTSQC/0M - vDBW2bfq2zQrFCqcE2agsn5rXeii5Q8hj3TrGgzsa/bWf7zFDdogqfjdaZivyTq/ - 4ZHWevz7fQ== - =mefK - -----END PGP MESSAGE----- - fp: B137EE1549DFAF960DD1E2B15147025FB9F09E07 - encrypted_regex: ^(data|stringData|email|dnsZones?|dnsNames?|hosts?|tang|externalURL|.*-secret|.*-url|.*Secret|.*-domain)$ - version: 3.7.3 ---- -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: allow-ingress-to-oauth2 - namespace: iot -spec: - podSelector: - matchLabels: - app: oauth2-proxy - ingress: - - from: - - namespaceSelector: - matchLabels: - ingress.shivering-isles.com/network-access-required: "true" -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: [] - lastmodified: "2023-09-11T07:18:11Z" - mac: ENC[AES256_GCM,data:kPRTYIh0XOLNquSkAuU6UXmZp5YrcR1YLE6i5zEjWJZ2lQ7/nFv3zoumy5lAVgaGFWZe+DkRmnmAJuX0YrPToVQqAMLxLJiL2ZtnqgsDgCVtz9qhhDzxlCiiEfJ3G5snqH/gqSn+3ToRA5WnirQ/9XLTNHGbVK4vgSNQZnYR7WI=,iv:jvnb0bJAfJ1Gnf9AePj/CQQci6jel5aeOU0zM8W0fh0=,tag:wrakrH1HzqhBESqM7xVxCQ==,type:str] + lastmodified: "2023-09-16T00:29:43Z" + mac: ENC[AES256_GCM,data:rM433+KgjqexU3X92LOUCD3hHPcA8ze+NkZs9tq5ncaO8EAMwzEgB1FJ77VassAA1DXmfQbn39PvGXscRhXPtorxnw54OHrggVuMhjD1EkaxTZ+EnXBfUJaNrC9OAkLiUeug8QcpB66fGRJExXxM6RQcxVm8w7ZbmDr5Fx+EmFE=,iv:iGchCSZqmm5N09MTeYlfEzD6ADGmQHfZnNn8Rpzq7i8=,tag:iYfWhqMNPKvbL7IbSKf6ww==,type:str] pgp: - created_at: "2022-01-22T04:06:16Z" enc: |-