feat!: Move networking apps into kube-system namespace

Signed-off-by: Devin Buhl <devin@buhl.casa>

cluster/apps/kube-system/cloudflare-ddns/cloudflare-ddns.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+
+set -o nounset
+set -o errexit
+
+current_ipv4="$(curl -s https://ipv4.icanhazip.com/)"
+zone_id=$(curl -s -X GET \
+    "https://api.cloudflare.com/client/v4/zones?name=${CLOUDFLARE_RECORD_NAME#*.}&status=active" \
+    -H "X-Auth-Email: ${CLOUDFLARE_EMAIL}" \
+    -H "X-Auth-Key: ${CLOUDFLARE_APIKEY}" \
+    -H "Content-Type: application/json" \
+        | jq --raw-output ".result[0] | .id"
+)
+record_ipv4=$(curl -s -X GET \
+    "https://api.cloudflare.com/client/v4/zones/${zone_id}/dns_records?name=${CLOUDFLARE_RECORD_NAME}&type=A" \
+    -H "X-Auth-Email: ${CLOUDFLARE_EMAIL}" \
+    -H "X-Auth-Key: ${CLOUDFLARE_APIKEY}" \
+    -H "Content-Type: application/json" \
+)
+old_ip4=$(echo "$record_ipv4" | jq --raw-output '.result[0] | .content')
+if [[ "${current_ipv4}" == "${old_ip4}" ]]; then
+    printf "%s - IP Address '%s' has not changed" "$(date -u)" "${current_ipv4}"
+    exit 0
+fi
+record_ipv4_identifier="$(echo "$record_ipv4" | jq --raw-output '.result[0] | .id')"
+update_ipv4=$(curl -s -X PUT \
+    "https://api.cloudflare.com/client/v4/zones/${zone_id}/dns_records/${record_ipv4_identifier}" \
+    -H "X-Auth-Email: ${CLOUDFLARE_EMAIL}" \
+    -H "X-Auth-Key: ${CLOUDFLARE_APIKEY}" \
+    -H "Content-Type: application/json" \
+    --data "{\"id\":\"${zone_id}\",\"type\":\"A\",\"proxied\":true,\"name\":\"${CLOUDFLARE_RECORD_NAME}\",\"content\":\"${current_ipv4}\"}" \
+)
+if [[ "$(echo "$update_ipv4" | jq --raw-output '.success')" == "true" ]]; then
+    printf "%s - Success - IP Address '%s' has been updated" "$(date -u)" "${current_ipv4}"
+    exit 0
+else
+    printf "%s - Yikes - Updating IP Address '%s' has failed" "$(date -u)" "${current_ipv4}"
+    exit 1
+fi

cluster/apps/kube-system/cloudflare-ddns/cron-job.yaml

@@ -0,0 +1,42 @@
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: &app cloudflare-ddns
+  namespace: kube-system
+spec:
+  schedule: "@hourly"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 2
+  jobTemplate:
+    spec:
+      ttlSecondsAfterFinished: 3600
+      template:
+        spec:
+          automountServiceAccountToken: false
+          restartPolicy: OnFailure
+          containers:
+            - name: *app
+              image: ghcr.io/onedr0p/kubernetes-kubectl:1.25.4@sha256:0d416e4095a476b900e93c8c818fbb17eda876709e3a00a4a3c7a725e95816ca
+              envFrom:
+                - secretRef:
+                    name: *app
+              command:
+                - "/bin/bash"
+                - &scriptPath "/app/cloudflare-ddns.sh"
+              volumeMounts:
+                - name: *app
+                  mountPath: *scriptPath
+                  subPath: &scriptName cloudflare-ddns.sh
+                  readOnly: true
+          volumes:
+            - name: *app
+              projected:
+                defaultMode: 0775
+                sources:
+                  - configMap:
+                      name: *app
+                      items:
+                        - key: *scriptName
+                          path: *scriptName

cluster/apps/kube-system/cloudflare-ddns/kustomization.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - cron-job.yaml
+  - secret.sops.yaml
+namespace: kube-system
+configMapGenerator:
+  - name: cloudflare-ddns
+    files:
+      - cloudflare-ddns.sh
+generatorOptions:
+  disableNameSuffixHash: true
+  annotations:
+    kustomize.toolkit.fluxcd.io/substitute: disabled