diff --git a/applications/pelican/pelican-httproute.yaml b/applications/pelican/pelican-httproute.yaml index cc0b796..eb8d290 100644 --- a/applications/pelican/pelican-httproute.yaml +++ b/applications/pelican/pelican-httproute.yaml @@ -39,7 +39,7 @@ spec: - name: Permissions-Policy value: "camera=(), microphone=(), geolocation=(), payment=()" - name: Content-Security-Policy - value: "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; img-src 'self' data: blob: https://gravatar.com https://www.gravatar.com; font-src 'self' data: https://cdnjs.cloudflare.com; connect-src 'self' https://wings.jsme.be wss://wings.jsme.be ws: wss:; worker-src blob:; frame-ancestors 'self'" + value: "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; img-src 'self' data: blob: https://gravatar.com https://www.gravatar.com; font-src 'self' data: https://cdnjs.cloudflare.com; connect-src 'self' https://wings-mc.jsme.be wss://wings-mc.jsme.be https://wings-ark.jsme.be wss://wings-ark.jsme.be ws: wss:; worker-src blob:; frame-ancestors 'self'" backendRefs: - name: pelican port: 80 diff --git a/applications/pelican/pelican-wings-ark-endpointslice.yaml b/applications/pelican/pelican-wings-ark-endpointslice.yaml new file mode 100644 index 0000000..711f7aa --- /dev/null +++ b/applications/pelican/pelican-wings-ark-endpointslice.yaml @@ -0,0 +1,20 @@ +apiVersion: discovery.k8s.io/v1 +kind: EndpointSlice +metadata: + name: wings-ark + namespace: pelican + labels: + kubernetes.io/service-name: wings-ark +addressType: IPv4 +ports: + - port: 8080 + protocol: TCP +endpoints: + # PLACEHOLDER: replace with the ARK wings VM IP once it exists, + # then flip ready/serving to true + - addresses: + - "10.8.11.51" + conditions: + ready: false + serving: false + terminating: false diff --git a/applications/pelican/pelican-wings-ark-httproute.yaml b/applications/pelican/pelican-wings-ark-httproute.yaml new file mode 100644 index 0000000..b08c0e9 --- /dev/null +++ b/applications/pelican/pelican-wings-ark-httproute.yaml @@ -0,0 +1,25 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: wings-ark-route + namespace: pelican +spec: + parentRefs: + - group: gateway.networking.k8s.io + kind: Gateway + name: gateway-internal + namespace: envoy-gateway + sectionName: wings-ark + hostnames: + - "wings-ark.jsme.be" + rules: + - matches: + - path: + type: PathPrefix + value: / + backendRefs: + - name: wings-ark + port: 8080 + kind: Service + group: "" + weight: 1 diff --git a/applications/pelican/pelican-wings-ark-service.yaml b/applications/pelican/pelican-wings-ark-service.yaml new file mode 100644 index 0000000..3567fdc --- /dev/null +++ b/applications/pelican/pelican-wings-ark-service.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: Service +metadata: + name: wings-ark + namespace: pelican +spec: + ports: + - protocol: TCP + port: 8080 + targetPort: 8080 + type: ClusterIP diff --git a/applications/pelican/pelican-wings-endpointslice.yaml b/applications/pelican/pelican-wings-mc-endpointslice.yaml similarity index 82% rename from applications/pelican/pelican-wings-endpointslice.yaml rename to applications/pelican/pelican-wings-mc-endpointslice.yaml index b378f0f..3c2b634 100644 --- a/applications/pelican/pelican-wings-endpointslice.yaml +++ b/applications/pelican/pelican-wings-mc-endpointslice.yaml @@ -1,10 +1,10 @@ apiVersion: discovery.k8s.io/v1 kind: EndpointSlice metadata: - name: wings + name: wings-mc namespace: pelican labels: - kubernetes.io/service-name: wings + kubernetes.io/service-name: wings-mc addressType: IPv4 ports: - port: 8080 diff --git a/applications/pelican/pelican-wings-httproute.yaml b/applications/pelican/pelican-wings-mc-httproute.yaml similarity index 81% rename from applications/pelican/pelican-wings-httproute.yaml rename to applications/pelican/pelican-wings-mc-httproute.yaml index 8fd50c1..ac3434b 100644 --- a/applications/pelican/pelican-wings-httproute.yaml +++ b/applications/pelican/pelican-wings-mc-httproute.yaml @@ -1,7 +1,7 @@ apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: - name: wings-route + name: wings-mc-route namespace: pelican spec: parentRefs: @@ -9,16 +9,16 @@ spec: kind: Gateway name: gateway-internal namespace: envoy-gateway - sectionName: wings + sectionName: wings-mc hostnames: - - "wings.jsme.be" + - "wings-mc.jsme.be" rules: - matches: - path: type: PathPrefix value: / backendRefs: - - name: wings + - name: wings-mc port: 8080 kind: Service group: "" diff --git a/applications/pelican/pelican-wings-service.yaml b/applications/pelican/pelican-wings-mc-service.yaml similarity index 90% rename from applications/pelican/pelican-wings-service.yaml rename to applications/pelican/pelican-wings-mc-service.yaml index 9148f4c..27f6198 100644 --- a/applications/pelican/pelican-wings-service.yaml +++ b/applications/pelican/pelican-wings-mc-service.yaml @@ -1,7 +1,7 @@ apiVersion: v1 kind: Service metadata: - name: wings + name: wings-mc namespace: pelican spec: ports: diff --git a/infra/envoy-gateway/kustomization.yaml b/infra/envoy-gateway/kustomization.yaml index 8e3bc3c..9a8dfa7 100644 --- a/infra/envoy-gateway/kustomization.yaml +++ b/infra/envoy-gateway/kustomization.yaml @@ -2,9 +2,15 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: + - envoy-gateway-namespace.yaml - gateway.yaml - gateway-public.yaml + # CrowdSec (public gateway hardening) — HELD pending enforcement-scope decision + # (EG v1.3.2 SecurityPolicy does not support sectionName; see it-tools-securitypolicy.yaml) + # - crowdsec/envoyproxy-public.yaml + # - crowdsec/it-tools-securitypolicy.yaml + # Policies - pelican/pelican-wings-clienttrafficpolicy.yaml - minio-aistor/minio-aistor-clienttrafficpolicy.yaml @@ -46,7 +52,8 @@ resources: - searxng/searxng-certificate.yaml - affine/affine-certificate.yaml - pelican/pelican-certificate.yaml - - pelican/pelican-wings-certificate.yaml + - pelican/pelican-wings-mc-certificate.yaml + - pelican/pelican-wings-ark-certificate.yaml - outline/outline-certificate.yaml patches: @@ -266,7 +273,13 @@ patches: version: v1 kind: Gateway name: gateway-internal - path: pelican/pelican-wings-gateway-patch.yaml + path: pelican/pelican-wings-mc-gateway-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-internal + path: pelican/pelican-wings-ark-gateway-patch.yaml - target: group: gateway.networking.k8s.io version: v1 diff --git a/infra/envoy-gateway/pelican/pelican-wings-ark-certificate.yaml b/infra/envoy-gateway/pelican/pelican-wings-ark-certificate.yaml new file mode 100644 index 0000000..592d7f9 --- /dev/null +++ b/infra/envoy-gateway/pelican/pelican-wings-ark-certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: wings-ark-tls + namespace: envoy-gateway +spec: + secretName: wings-ark-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - wings-ark.jsme.be diff --git a/infra/envoy-gateway/pelican/pelican-wings-ark-gateway-patch.yaml b/infra/envoy-gateway/pelican/pelican-wings-ark-gateway-patch.yaml new file mode 100644 index 0000000..928d483 --- /dev/null +++ b/infra/envoy-gateway/pelican/pelican-wings-ark-gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: wings-ark + protocol: HTTPS + port: 443 + hostname: "wings-ark.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: pelican + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: wings-ark-tls + namespace: envoy-gateway diff --git a/infra/envoy-gateway/pelican/pelican-wings-clienttrafficpolicy.yaml b/infra/envoy-gateway/pelican/pelican-wings-clienttrafficpolicy.yaml index 0f196c8..14f1c07 100644 --- a/infra/envoy-gateway/pelican/pelican-wings-clienttrafficpolicy.yaml +++ b/infra/envoy-gateway/pelican/pelican-wings-clienttrafficpolicy.yaml @@ -8,7 +8,11 @@ spec: - group: gateway.networking.k8s.io kind: Gateway name: gateway-internal - sectionName: wings + sectionName: wings-mc + - group: gateway.networking.k8s.io + kind: Gateway + name: gateway-internal + sectionName: wings-ark tls: # Wings only speaks HTTP/1.1; disabling h2 ALPN prevents Guzzle connection-reuse broken pipe alpnProtocols: diff --git a/infra/envoy-gateway/pelican/pelican-wings-certificate.yaml b/infra/envoy-gateway/pelican/pelican-wings-mc-certificate.yaml similarity index 73% rename from infra/envoy-gateway/pelican/pelican-wings-certificate.yaml rename to infra/envoy-gateway/pelican/pelican-wings-mc-certificate.yaml index db2f270..ad8ed1e 100644 --- a/infra/envoy-gateway/pelican/pelican-wings-certificate.yaml +++ b/infra/envoy-gateway/pelican/pelican-wings-mc-certificate.yaml @@ -1,14 +1,14 @@ apiVersion: cert-manager.io/v1 kind: Certificate metadata: - name: wings-tls + name: wings-mc-tls namespace: envoy-gateway spec: - secretName: wings-tls + secretName: wings-mc-tls privateKey: rotationPolicy: Always issuerRef: name: azure-dns kind: ClusterIssuer dnsNames: - - wings.jsme.be + - wings-mc.jsme.be diff --git a/infra/envoy-gateway/pelican/pelican-wings-gateway-patch.yaml b/infra/envoy-gateway/pelican/pelican-wings-mc-gateway-patch.yaml similarity index 80% rename from infra/envoy-gateway/pelican/pelican-wings-gateway-patch.yaml rename to infra/envoy-gateway/pelican/pelican-wings-mc-gateway-patch.yaml index 9f1ba64..c6de90b 100644 --- a/infra/envoy-gateway/pelican/pelican-wings-gateway-patch.yaml +++ b/infra/envoy-gateway/pelican/pelican-wings-mc-gateway-patch.yaml @@ -1,10 +1,10 @@ - op: add path: /spec/listeners/- value: - name: wings + name: wings-mc protocol: HTTPS port: 443 - hostname: "wings.jsme.be" + hostname: "wings-mc.jsme.be" allowedRoutes: namespaces: from: Selector @@ -15,5 +15,5 @@ mode: Terminate certificateRefs: - kind: Secret - name: wings-tls + name: wings-mc-tls namespace: envoy-gateway