d770504fa5
This commit includes the complete Kubernetes infrastructure deployment for NGE6: - Crossplane setup with providers (Kubernetes, Helm, Civo) - Ambassador/Emissary ingress controller with SSL termination - Cert-manager with Let's Encrypt and Gandi webhook for DNS01 challenges - ExternalDNS integration with Gandi for automatic DNS management - Keycloak authentication server with PostgreSQL - Pomerium identity-aware proxy with OIDC integration - Forgejo Git server with persistent storage and authentication - Spire/SPIFFE for secure service communication All services are deployed using Infrastructure as Code principles with Crossplane managing Kubernetes and Helm resources declaratively. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
207 lines
7.8 KiB
YAML
207 lines
7.8 KiB
YAML
{{- if and .Values.ingress.enabled (and .Values.ingressController.enabled .Values.ingressController.config.operatorMode ) }}
|
|
{{- if not .Values.ingress.secretName }}
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: {{ .Values.ingress.secret.name }}
|
|
labels:
|
|
app.kubernetes.io/name: {{ template "pomerium.name" . }}
|
|
helm.sh/chart: {{ template "pomerium.chart" . }}
|
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
|
type: kubernetes.io/tls
|
|
data:
|
|
tls.crt: {{ .Values.ingress.secret.cert | quote }}
|
|
tls.key: {{ .Values.ingress.secret.key | quote }}
|
|
---
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- define "pomerium.authenticate.tlsSecretObject" -}}
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: {{ template "pomerium.name" . }}
|
|
helm.sh/chart: {{ template "pomerium.chart" . }}
|
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
|
annotations:
|
|
helm.sh/hook-delete-policy: before-hook-creation
|
|
{{- if .Values.config.forceGenerateTLS }}
|
|
helm.sh/hook: pre-upgrade
|
|
{{- else if .Values.config.generateTLS }}
|
|
helm.sh/hook: pre-install
|
|
{{- end }}
|
|
{{- if .Values.config.generateTLSAnnotations }}
|
|
{{- range $key, $value := .Values.config.generateTLSAnnotations }}
|
|
{{ $key }}: {{ $value | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
name: {{ template "pomerium.authenticate.tlsSecret.name" . }}
|
|
type: kubernetes.io/tls
|
|
data:
|
|
{{- end -}}
|
|
|
|
{{- define "pomerium.authorize.tlsSecretObject" -}}
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: {{ template "pomerium.name" . }}
|
|
helm.sh/chart: {{ template "pomerium.chart" . }}
|
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
|
annotations:
|
|
helm.sh/hook-delete-policy: before-hook-creation
|
|
{{- if .Values.config.forceGenerateTLS }}
|
|
helm.sh/hook: pre-upgrade
|
|
{{- else if .Values.config.generateTLS }}
|
|
helm.sh/hook: pre-install
|
|
{{- end }}
|
|
{{- if .Values.config.generateTLSAnnotations }}
|
|
{{- range $key, $value := .Values.config.generateTLSAnnotations }}
|
|
{{ $key }}: {{ $value | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
name: {{ template "pomerium.authorize.tlsSecret.name" . }}
|
|
type: kubernetes.io/tls
|
|
data:
|
|
{{- end -}}
|
|
|
|
{{- define "pomerium.databroker.tlsSecretObject" -}}
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: {{ template "pomerium.name" . }}
|
|
helm.sh/chart: {{ template "pomerium.chart" . }}
|
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
|
annotations:
|
|
helm.sh/hook-delete-policy: before-hook-creation
|
|
{{- if .Values.config.forceGenerateTLS }}
|
|
helm.sh/hook: pre-upgrade
|
|
{{- else if .Values.config.generateTLS }}
|
|
helm.sh/hook: pre-install
|
|
{{- end }}
|
|
{{- if .Values.config.generateTLSAnnotations }}
|
|
{{- range $key, $value := .Values.config.generateTLSAnnotations }}
|
|
{{ $key }}: {{ $value | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
name: {{ template "pomerium.databroker.tlsSecret.name" . }}
|
|
type: kubernetes.io/tls
|
|
data:
|
|
{{- end -}}
|
|
|
|
{{- define "pomerium.proxy.tlsSecretObject" -}}
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: {{ template "pomerium.name" . }}
|
|
helm.sh/chart: {{ template "pomerium.chart" . }}
|
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
|
annotations:
|
|
helm.sh/hook-delete-policy: before-hook-creation
|
|
{{- if .Values.config.forceGenerateTLS }}
|
|
helm.sh/hook: pre-upgrade
|
|
{{- else if .Values.config.generateTLS }}
|
|
helm.sh/hook: pre-install
|
|
{{- end }}
|
|
{{- if .Values.config.generateTLSAnnotations }}
|
|
{{- range $key, $value := .Values.config.generateTLSAnnotations }}
|
|
{{ $key }}: {{ $value | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
name: {{ template "pomerium.proxy.tlsSecret.name" . }}
|
|
type: kubernetes.io/tls
|
|
data:
|
|
{{- end -}}
|
|
|
|
{{- define "pomerium.ca.tlsSecretObject" -}}
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: {{ template "pomerium.name" . }}
|
|
helm.sh/chart: {{ template "pomerium.chart" . }}
|
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
|
annotations:
|
|
helm.sh/hook-delete-policy: before-hook-creation
|
|
{{- if .Values.config.forceGenerateTLS }}
|
|
helm.sh/hook: pre-upgrade
|
|
{{- else if .Values.config.generateTLS }}
|
|
helm.sh/hook: pre-install
|
|
{{- end }}
|
|
{{- if .Values.config.generateTLSAnnotations }}
|
|
{{- range $key, $value := .Values.config.generateTLSAnnotations }}
|
|
{{ $key }}: {{ $value | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
name: {{ template "pomerium.caSecret.name" . }}
|
|
type: Opaque
|
|
data:
|
|
{{- end -}}
|
|
|
|
|
|
{{- if and .Values.config.generateTLS (or .Release.IsInstall .Values.config.forceGenerateTLS) }}
|
|
{{- $ca := genCA "default-ca" 3650 }}
|
|
{{- $authenticateSN:= list (printf "authenticate.%s" .Values.config.rootDomain) (printf "%s.%s.svc.cluster.local" (include "pomerium.authenticate.fullname" .) .Release.Namespace )}}
|
|
{{- $authorizeSN:= list (printf "authorize.%s" .Values.config.rootDomain) (printf "%s.%s.svc.cluster.local" (include "pomerium.authorize.fullname" .) .Release.Namespace )}}
|
|
{{- $databrokerSN:= list (printf "databroker.%s" .Values.config.rootDomain) (printf "%s.%s.svc.cluster.local" (include "pomerium.databroker.fullname" .) .Release.Namespace ) }}
|
|
{{- $proxySN:= list (printf "authenticate.%s" .Values.config.rootDomain) }}
|
|
|
|
{{- $cn := default "example.com" .Values.config.rootDomain }}
|
|
{{ template "pomerium.ca.tlsSecretObject" . }}
|
|
ca.crt: {{ $ca.Cert | b64enc }}
|
|
ca.key: {{ $ca.Key | b64enc }}
|
|
---
|
|
{{- $kp := genSignedCert $cn ( default nil .Values.authenticate.tls.defaultIPList ) ( default $authenticateSN .Values.authenticate.tls.defaultSANList ) 3650 $ca }}
|
|
{{ template "pomerium.authenticate.tlsSecretObject" . }}
|
|
tls.crt: {{ $kp.Cert | b64enc }}
|
|
tls.key: {{ $kp.Key | b64enc }}
|
|
---
|
|
{{- $kp := genSignedCert $cn ( default nil .Values.authorize.tls.defaultIPList ) ( default $authorizeSN .Values.authorize.tls.defaultSANList ) 3650 $ca }}
|
|
{{ template "pomerium.authorize.tlsSecretObject" . }}
|
|
tls.crt: {{ $kp.Cert | b64enc }}
|
|
tls.key: {{ $kp.Key | b64enc }}
|
|
---
|
|
{{- $kp := genSignedCert $cn ( default nil .Values.databroker.tls.defaultIPList ) ( default $databrokerSN .Values.databroker.tls.defaultSANList ) 3650 $ca }}
|
|
{{ template "pomerium.databroker.tlsSecretObject" . }}
|
|
tls.crt: {{ $kp.Cert | b64enc }}
|
|
tls.key: {{ $kp.Key | b64enc }}
|
|
{{- else if not .Values.config.generateTLS }}
|
|
{{- if and (not .Values.config.existingCASecret) .Values.config.ca.cert .Values.config.ca.key }}
|
|
{{ template "pomerium.ca.tlsSecretObject" . }}
|
|
ca.crt: {{ .Values.config.ca.cert | b64enc }}
|
|
ca.key: {{ .Values.config.ca.key | b64enc }}
|
|
{{- end }}
|
|
{{- if and (not .Values.authenticate.existingTLSSecret) .Values.authenticate.tls.cert .Values.authenticate.tls.key }}
|
|
---
|
|
{{ template "pomerium.authenticate.tlsSecretObject" . }}
|
|
tls.crt: {{ .Values.authenticate.tls.cert | b64enc }}
|
|
tls.key: {{ .Values.authenticate.tls.key | b64enc }}
|
|
{{- end }}
|
|
{{- if and (not .Values.authorize.existingTLSSecret) .Values.authorize.tls.cert .Values.authorize.tls.key }}
|
|
---
|
|
{{ template "pomerium.authorize.tlsSecretObject" . }}
|
|
tls.crt: {{ .Values.authorize.tls.cert | b64enc }}
|
|
tls.key: {{ .Values.authorize.tls.key | b64enc }}
|
|
{{- end }}
|
|
{{- if and (not .Values.databroker.existingTLSSecret) .Values.databroker.tls.cert .Values.databroker.tls.key }}
|
|
---
|
|
{{ template "pomerium.databroker.tlsSecretObject" . }}
|
|
tls.crt: {{ .Values.databroker.tls.cert | b64enc }}
|
|
tls.key: {{ .Values.databroker.tls.key | b64enc }}
|
|
{{- end }}
|
|
{{- if and (not .Values.proxy.existingTLSSecret) .Values.proxy.tls.cert .Values.proxy.tls.key }}
|
|
---
|
|
{{ template "pomerium.proxy.tlsSecretObject" . }}
|
|
tls.crt: {{ .Values.proxy.tls.cert | b64enc }}
|
|
tls.key: {{ .Values.proxy.tls.key | b64enc }}
|
|
{{- end }}
|
|
{{- end }}
|