feat(cluster): update existing traefik middlewares and add cloudflare-only middleware

Signed-off-by: Devin Buhl <devin@buhl.casa>

cluster/apps/default/echo-server/helm-release.yaml

@@ -34,6 +34,7 @@ spec:
         hajimari.io/enable: "true"
         hajimari.io/icon: "video-input-antenna"
         traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+        traefik.ingress.kubernetes.io/router.middlewares: "networking-cloudflare-only@kubernetescrd"
       hosts:
         - host: "echo-server.${SECRET_DOMAIN}"
           paths:

cluster/apps/default/hajimari/helm-release.yaml

@@ -111,7 +111,7 @@ spec:
           hajimari.io/enable: "true"
           hajimari.io/icon: "weather-sunset"
           traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
-          traefik.ingress.kubernetes.io/router.middlewares: "networking-local-only-access@kubernetescrd"
+          traefik.ingress.kubernetes.io/router.middlewares: "networking-internal-only@kubernetescrd"
         hosts:
           - host: "hajimari.${SECRET_DOMAIN}"
             paths:

cluster/apps/networking/traefik/dashboard/ingress.yaml

@@ -10,7 +10,7 @@ metadata:
     hajimari.io/enable: "true"
     hajimari.io/icon: "web"
     traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
-    traefik.ingress.kubernetes.io/router.middlewares: "networking-local-only-access@kubernetescrd"
+    traefik.ingress.kubernetes.io/router.middlewares: "networking-internal-only@kubernetescrd"
 spec:
   ingressClassName: "traefik"
   tls:

cluster/apps/networking/traefik/middlewares/cloudflare-only.yaml

@@ -0,0 +1,46 @@
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: cloudflare-ips
+  namespace: networking
+spec:
+  # https://www.cloudflare.com/ips/
+  ipWhiteList:
+    sourceRange:
+      - 173.245.48.0/20
+      - 103.21.244.0/22
+      - 103.22.200.0/22
+      - 103.31.4.0/22
+      - 141.101.64.0/18
+      - 108.162.192.0/18
+      - 190.93.240.0/20
+      - 188.114.96.0/20
+      - 197.234.240.0/22
+      - 198.41.128.0/17
+      - 162.158.0.0/15
+      - 104.16.0.0/13
+      - 104.24.0.0/14
+      - 172.64.0.0/13
+      - 131.0.72.0/22
+      - 2400:cb00::/32
+      - 2606:4700::/32
+      - 2803:f800::/32
+      - 2405:b500::/32
+      - 2405:8100::/32
+      - 2a06:98c0::/29
+      - 2c0f:f248::/32
+      # include rfc1918 ranges since traefik chains do not support OR operations
+      - 10.0.0.0/8
+      - 172.16.0.0/12
+      - 192.168.0.0/16
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: cloudflare-only
+  namespace: networking
+spec:
+  chain:
+    middlewares:
+      - name: cloudflare-ips

cluster/apps/networking/traefik/middlewares/internal-only.yaml

@@ -2,7 +2,7 @@
 apiVersion: traefik.containo.us/v1alpha1
 kind: Middleware
 metadata:
-  name: rfc1918-ips
+  name: internal-ips
   namespace: networking
 spec:
   ipWhiteList:
@@ -14,9 +14,9 @@ spec:
 apiVersion: traefik.containo.us/v1alpha1
 kind: Middleware
 metadata:
-  name: local-only-access
+  name: internal-only
   namespace: networking
 spec:
   chain:
     middlewares:
-      - name: rfc1918-ips
+      - name: internal-ips

cluster/apps/networking/traefik/middlewares/kustomization.yaml

@@ -2,4 +2,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - local-only-access.yaml
+  - cloudflare-only.yaml
+  - internal-only.yaml