diff --git a/kubernetes/apps/cert-manager/cert-manager/ks.yaml b/kubernetes/apps/cert-manager/cert-manager/ks.yaml index 31ef8635..756f280e 100644 --- a/kubernetes/apps/cert-manager/cert-manager/ks.yaml +++ b/kubernetes/apps/cert-manager/cert-manager/ks.yaml @@ -38,3 +38,25 @@ spec: wait: true interval: 30m timeout: 5m +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: &app self-signed-issuers + namespace: flux-system +spec: + targetNamespace: cert-manager + commonMetadata: + labels: + app.kubernetes.io/name: *app + dependsOn: + - name: cert-manager-issuers + path: ./kubernetes/apps/cert-manager/cert-manager/selfsigned + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + wait: true + interval: 30m + retryInterval: 1m + timeout: 5m diff --git a/kubernetes/apps/cert-manager/cert-manager/selfsigned/certificate.yaml b/kubernetes/apps/cert-manager/cert-manager/selfsigned/certificate.yaml new file mode 100644 index 00000000..3ff94b19 --- /dev/null +++ b/kubernetes/apps/cert-manager/cert-manager/selfsigned/certificate.yaml @@ -0,0 +1,39 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/cert-manager.io/certificate_v1.json +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: &name home-selfsigned-ca +spec: + isCA: true + commonName: *name + subject: + organizations: + - ${SECRET_DOMAIN} + secretName: root-secret + privateKey: + algorithm: ECDSA + size: 256 + issuerRef: + name: selfsigned-issuer + kind: ClusterIssuer + group: cert-manager.io +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: &name strong-selfsigned-ca +spec: + isCA: true + commonName: *name + subject: + organizations: + - ${SECRET_DOMAIN} + secretName: strong-root-secret + privateKey: + algorithm: ECDSA + size: 384 + issuerRef: + name: selfsigned-issuer + kind: ClusterIssuer + group: cert-manager.io diff --git a/kubernetes/apps/cert-manager/cert-manager/selfsigned/clusterissuer.yaml b/kubernetes/apps/cert-manager/cert-manager/selfsigned/clusterissuer.yaml new file mode 100644 index 00000000..d801a661 --- /dev/null +++ b/kubernetes/apps/cert-manager/cert-manager/selfsigned/clusterissuer.yaml @@ -0,0 +1,17 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/cert-manager.io/clusterissuer_v1.json +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: home-ca-issuer +spec: + ca: + secretName: root-secret +--- +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: strong-ca-issuer +spec: + ca: + secretName: strong-root-secret diff --git a/kubernetes/apps/cert-manager/cert-manager/selfsigned/kustomization.yaml b/kubernetes/apps/cert-manager/cert-manager/selfsigned/kustomization.yaml new file mode 100644 index 00000000..c856d5d3 --- /dev/null +++ b/kubernetes/apps/cert-manager/cert-manager/selfsigned/kustomization.yaml @@ -0,0 +1,7 @@ +--- +# yaml-language-server: $schema=https://json.schemastore.org/kustomization +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ./certificate.yaml + - ./clusterissuer.yaml diff --git a/kubernetes/apps/external-secrets/app/helmrelease.yaml b/kubernetes/apps/external-secrets/app/helmrelease.yaml new file mode 100644 index 00000000..34e01b88 --- /dev/null +++ b/kubernetes/apps/external-secrets/app/helmrelease.yaml @@ -0,0 +1,46 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: external-secrets +spec: + interval: 15m + chart: + spec: + chart: external-secrets + version: 0.10.5 + sourceRef: + kind: HelmRepository + name: external-secrets + namespace: flux-charts + + driftDetection: + mode: enabled + maxHistory: 3 + install: + crds: CreateReplace + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + crds: CreateReplace + remediation: + retries: 3 + + # https://github.com/external-secrets/external-secrets/blob/v0.7.2/deploy/charts/external-secrets/values.yaml + values: + installCRDs: true + replicaCount: 2 + leaderElect: true + + extraArgs: + loglevel: debug + + serviceMonitor: + enabled: true + webhook: + serviceMonitor: + enabled: true + certController: + serviceMonitor: + enabled: true diff --git a/kubernetes/apps/external-secrets/app/kustomization.yaml b/kubernetes/apps/external-secrets/app/kustomization.yaml new file mode 100644 index 00000000..a767ce47 --- /dev/null +++ b/kubernetes/apps/external-secrets/app/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: kube-system +resources: + - helmrelease.yaml diff --git a/kubernetes/apps/external-secrets/bitwarden/clustersecretstore.yaml b/kubernetes/apps/external-secrets/bitwarden/clustersecretstore.yaml new file mode 100644 index 00000000..40693bc1 --- /dev/null +++ b/kubernetes/apps/external-secrets/bitwarden/clustersecretstore.yaml @@ -0,0 +1,25 @@ +--- +apiVersion: external-secrets.io/v1beta1 +kind: ClusterSecretStore +metadata: + name: bitwarden-login +spec: + provider: + webhook: + url: "http://bitwarden-cli.kube-system.svc.cluster.local:8087/object/item/{{ .remoteRef.key }}" + headers: + Content-Type: application/json + result: + jsonPath: "$.data.login.{{ .remoteRef.property }}" + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ClusterSecretStore +metadata: + name: bitwarden-fields +spec: + provider: + webhook: + url: "http://bitwarden-cli.kube-system.svc.cluster.local:8087/object/item/{{ .remoteRef.key }}" + result: + jsonPath: "$.data.fields[?@.name==\"{{ .remoteRef.property }}\"].value" diff --git a/kubernetes/apps/external-secrets/bitwarden/helmrelease.yaml b/kubernetes/apps/external-secrets/bitwarden/helmrelease.yaml new file mode 100644 index 00000000..c68b99a9 --- /dev/null +++ b/kubernetes/apps/external-secrets/bitwarden/helmrelease.yaml @@ -0,0 +1,78 @@ +--- +# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: bitwarden-cli +spec: + interval: 15m + chart: + spec: + chart: app-template + version: 3.5.1 + sourceRef: + kind: HelmRepository + name: bjw-s + namespace: flux-charts + + driftDetection: + mode: enabled + maxHistory: 3 + install: + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + remediation: + strategy: rollback + retries: 3 + + values: + defaultPodOptions: + securityContext: + seccompProfile: { type: RuntimeDefault } + + controllers: + bitwarden-cli: + annotations: + reloader.stakater.com/auto: "true" + + containers: + app: + image: + repository: ghcr.io/larivierec/bitwarden-cli + tag: 2024.9.0 + + envFrom: + - secretRef: + name: bitwarden-cli-secret + + probes: + liveness: + enabled: true + custom: true + spec: + exec: + command: [ "sh", "-c", "curl -X POST -s http://127.0.0.1:8087/sync | jq -e '.success == true'" ] + timeoutSeconds: 5 + readiness: + enabled: false + + resources: + requests: + memory: 256Mi + cpu: 100m + limits: + memory: 512Mi + + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: false + capabilities: { drop: [ 'ALL' ] } + + service: + app: + controller: bitwarden-cli + ports: + http: + port: 8087 diff --git a/kubernetes/apps/external-secrets/bitwarden/kustomization.yaml b/kubernetes/apps/external-secrets/bitwarden/kustomization.yaml new file mode 100644 index 00000000..06f2bcef --- /dev/null +++ b/kubernetes/apps/external-secrets/bitwarden/kustomization.yaml @@ -0,0 +1,8 @@ +--- +# yaml-language-server: $schema=https://json.schemastore.org/kustomization +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- ./secret.sops.yaml +- ./helmrelease.yaml +- ./clustersecretstore.yaml diff --git a/kubernetes/apps/external-secrets/bitwarden/secret.sops.yaml b/kubernetes/apps/external-secrets/bitwarden/secret.sops.yaml new file mode 100644 index 00000000..1ba30f92 --- /dev/null +++ b/kubernetes/apps/external-secrets/bitwarden/secret.sops.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +kind: Secret +metadata: + name: bitwarden-cli-secret +stringData: + BW_HOST: https://bitwarden.lordinnovators.com + BW_CLIENTID: user.fb667bd3-55a4-46f1-924d-f4ff504d038d + BW_CLIENTSECRET: 49pcBqtCmLVaul7U27IGjImGfP1y8H + BW_PASSWORD: Jamis-lover-may diff --git a/kubernetes/apps/external-secrets/certificates/bitwarden.yaml b/kubernetes/apps/external-secrets/certificates/bitwarden.yaml new file mode 100644 index 00000000..4758ec02 --- /dev/null +++ b/kubernetes/apps/external-secrets/certificates/bitwarden.yaml @@ -0,0 +1,47 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/cert-manager.io/certificate_v1.json +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: &name bitwarden-tls-certs +spec: + secretName: *name + dnsNames: + - bitwarden-sdk-server.external-secrets.svc.cluster.local + - external-secrets-bitwarden-sdk-server.external-secrets.svc.cluster.local + - localhost + ipAddresses: + - 127.0.0.1 + - ::1 + privateKey: + algorithm: RSA + encoding: PKCS8 + size: 2048 + rotationPolicy: Always + duration: 168h # 7d + renewBefore: 24h # 1d + issuerRef: + name: home-ca-issuer + kind: ClusterIssuer + group: cert-manager.io +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: bitwarden-css-certs + namespace: external-secrets +spec: + secretName: bitwarden-css-certs + dnsNames: + - bitwarden-secrets-manager.external-secrets.svc.cluster.local + privateKey: + algorithm: RSA + encoding: PKCS8 + size: 2048 + rotationPolicy: Always + usages: + - client auth + issuerRef: + name: home-ca-issuer + kind: ClusterIssuer + group: cert-manager.io diff --git a/kubernetes/apps/external-secrets/certificates/kustomization.yaml b/kubernetes/apps/external-secrets/certificates/kustomization.yaml new file mode 100644 index 00000000..7cb73a6e --- /dev/null +++ b/kubernetes/apps/external-secrets/certificates/kustomization.yaml @@ -0,0 +1,6 @@ +--- +# yaml-language-server: $schema=https://json.schemastore.org/kustomization +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ./bitwarden.yaml diff --git a/kubernetes/apps/external-secrets/ks.yaml b/kubernetes/apps/external-secrets/ks.yaml new file mode 100644 index 00000000..f15e7b34 --- /dev/null +++ b/kubernetes/apps/external-secrets/ks.yaml @@ -0,0 +1,44 @@ +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: &app external-secrets + namespace: flux-system +spec: + targetNamespace: external-secrets + commonMetadata: + labels: + app.kubernetes.io/name: *app + dependsOn: + - name: external-secrets-certs + path: ./kubernetes/apps/external-secrets/bitwarden + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + wait: true + interval: 30m + retryInterval: 1m + timeout: 5m +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: &app external-secrets-stores + namespace: flux-system +spec: + targetNamespace: external-secrets + commonMetadata: + labels: + app.kubernetes.io/name: *app + dependsOn: + - name: external-secrets + path: ./kubernetes/apps/external-secrets/app + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + wait: true + interval: 30m + retryInterval: 1m + timeout: 5m diff --git a/kubernetes/apps/external-secrets/kustomization.yaml b/kubernetes/apps/external-secrets/kustomization.yaml new file mode 100644 index 00000000..2dc969c0 --- /dev/null +++ b/kubernetes/apps/external-secrets/kustomization.yaml @@ -0,0 +1,7 @@ +--- +# yaml-language-server: $schema=https://json.schemastore.org/kustomization +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ./namespace.yaml + - ./ks.yaml diff --git a/kubernetes/apps/external-secrets/namespace.yaml b/kubernetes/apps/external-secrets/namespace.yaml new file mode 100644 index 00000000..cf67dad5 --- /dev/null +++ b/kubernetes/apps/external-secrets/namespace.yaml @@ -0,0 +1,8 @@ +--- +# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/namespace-v1.json +apiVersion: v1 +kind: Namespace +metadata: + name: external-secrets + labels: + kustomize.toolkit.fluxcd.io/prune: disabled