Merge remote-tracking branch 'origin/main' into feat-add-crowdsec

disable crowdsec for now
ci: force crowdsec validation on amd64
2025-12-28 10:11:52 +01:00 · 2025-12-28 10:08:05 +01:00 · 2025-12-28 09:51:08 +01:00 · 2025-12-28 09:50:06 +01:00 · 2025-12-28 09:48:46 +01:00 · 2025-12-28 09:48:42 +01:00
15 changed files with 254 additions and 181 deletions
@@ -1,26 +0,0 @@
-name: Deploy
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'coredns/**'
-  workflow_dispatch:
-
-jobs:
-  deploy-coredns:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
-      - uses: azure/k8s-set-context@8698eba2499e9012f0d5085f8798077cce4bc526 # v5.0.1
-        with:
-          method: kubeconfig
-          kubeconfig: ${{ secrets.KUBECONFIG }}
-      - name: Deploy
-        run: |
-          kubectl apply -n kube-system -f coredns
-      - name: Restart coredns
-        run: |
-          kubectl -n kube-system rollout restart deployment coredns
@@ -1,23 +0,0 @@
-name: Deploy
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'node-labels/**'
-  workflow_dispatch:
-
-jobs:
-  deploy-node-labels:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
-      - uses: azure/k8s-set-context@8698eba2499e9012f0d5085f8798077cce4bc526 # v5.0.1
-        with:
-          method: kubeconfig
-          kubeconfig: ${{ secrets.KUBECONFIG }}
-      - name: Deploy
-        run: |
-          kubectl apply --server-side --field-manager=t000-n -f node-labels
@@ -1,47 +0,0 @@
-name: Deploy
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'traefik/**'
-  workflow_dispatch:
-
-jobs:
-  deploy-traefik:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
-      - uses: azure/k8s-set-context@8698eba2499e9012f0d5085f8798077cce4bc526 # v5.0.1
-        with:
-          method: kubeconfig
-          kubeconfig: ${{ secrets.KUBECONFIG }}
-      - name: Set ionos api credentials
-        uses: azure/k8s-create-secret@ba774cded95cc0d795806a986fecd1205a6c2320 # v6.0.1
-        with:
-          namespace: kube-system
-          secret-name: ionos-api-credentials
-          secret-type: generic
-          data: |
-            {
-              "apiKey": "${{ secrets.IONOS_API_KEY }}"
-            }
-      - name: Set admin basic auth credentials
-        uses: azure/k8s-create-secret@ba774cded95cc0d795806a986fecd1205a6c2320 # v6.0.1
-        with:
-          namespace: kube-system
-          secret-name: admin-basic-auth-credentials
-          secret-type: Opaque
-          data: |
-            {
-              "auth": "${{ secrets.ADMIN_BASIC_AUTH_CREDENTIALS }}"
-            }
-      - name: Deploy
-        uses: azure/k8s-deploy@51ca02a8b7225fbd0924aac359c5b336a5f1e5b4 # v7.0.0
-        with:
-          action: deploy
-          manifests: "traefik/"
-          strategy: basic
-          namespace: kube-system
@@ -4,28 +4,136 @@ on:
  push:
    branches:
      - main
-  workflow_dispatch:

 jobs:
-  deploy-docker-registry-secret:
+  check-changes:
+    runs-on: ubuntu-latest
+    outputs:
+      node-labels: ${{ steps.filter.outputs.node-labels }}
+      coredns: ${{ steps.filter.outputs.coredns }}
+      traefik: ${{ steps.filter.outputs.traefik }}
+      crowdsec: ${{ steps.filter.outputs.crowdsec }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            node-labels:
+              - 'node-labels/**'
+            coredns:
+              - 'coredns/**'
+            traefik:
+              - 'traefik/**'
+            crowdsec:
+              - 'crowdsec/**'
+
+  deploy-node-labels:
    runs-on: ubuntu-latest
    needs: check-changes
+    if: ${{ needs.check-changes.outputs.node-labels == 'true' }}
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
-      - uses: azure/k8s-set-context@8698eba2499e9012f0d5085f8798077cce4bc526 # v5.0.1
+      - uses: actions/checkout@v5
+      - uses: azure/setup-kubectl@v4
+      - uses: azure/k8s-set-context@v4
        with:
          method: kubeconfig
          kubeconfig: ${{ secrets.KUBECONFIG }}
-      - name: Set docker registry credentials
+      - name: Deploy
        run: |
-          kubectl create secret docker-registry regcred-dockerhub \
-            --docker-server=https://index.docker.io/v1/ \
-            --docker-username="${{ secrets.DOCKER_USERNAME }}" \
-            --docker-password="${{ secrets.DOCKER_PASSWORD }}" \
-            --docker-email="${{ secrets.DOCKER_EMAIL }}" \
-            --namespace=default \
-            --dry-run=client -o yaml | kubectl apply -f -
-      - name: Configure image pull secret globally
+          kubectl apply --server-side --field-manager=t000-n -f node-labels
+
+  deploy-coredns:
+    runs-on: ubuntu-latest
+    needs: check-changes
+    if: ${{ needs.check-changes.outputs.coredns == 'true' }}
+    steps:
+      - uses: actions/checkout@v5
+      - uses: azure/setup-kubectl@v4
+      - uses: azure/k8s-set-context@v4
+        with:
+          method: kubeconfig
+          kubeconfig: ${{ secrets.KUBECONFIG }}
+      - name: Deploy
        run: |
-          kubectl patch serviceaccount default -p '{"imagePullSecrets": [{"name": "regcred-dockerhub"}]}'
+          kubectl apply -n kube-system -f coredns
+      - name: Restart coredns
+        run: |
+          kubectl -n kube-system rollout restart deployment coredns
+
+  deploy-traefik:
+    runs-on: ubuntu-latest
+    needs: check-changes
+    if: ${{ needs.check-changes.outputs.traefik == 'true' }}
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4
+      - uses: azure/k8s-set-context@ae59a723ba9abe7a9655538854a025448dbab4aa # v4
+        with:
+          method: kubeconfig
+          kubeconfig: ${{ secrets.KUBECONFIG }}
+      - name: Set ionos api credentials
+        uses: azure/k8s-create-secret@6e0ba8047235646753f2a3a3b359b4d0006ff218 # v5
+        with:
+          namespace: kube-system
+          secret-name: ionos-api-credentials
+          secret-type: generic
+          data: |
+            {
+              "apiKey": "${{ secrets.IONOS_API_KEY }}"
+            }
+      - name: Set admin basic auth credentials
+        uses: azure/k8s-create-secret@6e0ba8047235646753f2a3a3b359b4d0006ff218 # v5
+        with:
+          namespace: kube-system
+          secret-name: admin-basic-auth-credentials
+          secret-type: generic
+          data: |
+            {
+              "username": "bmV0YWRtaW4=",
+              "password": "${{ secrets.ADMIN_BASIC_AUTH_PASSWORD }}"
+            }
+      - name: Set crowdsec bouncer api key
+        uses: azure/k8s-create-secret@6e0ba8047235646753f2a3a3b359b4d0006ff218 # v5
+        with:
+          namespace: kube-system
+          secret-name: crowdsec-bouncer-api-key
+          secret-type: generic
+          data: |
+            {
+              "api-key": "${{ secrets.CROWDSEC_BOUNCER_API_KEY }}"
+            }
+      - name: Deploy
+        uses: azure/k8s-deploy@6f7c489cecd8da05646259d9fa3daae92e095c7b # v5.0.4
+        with:
+          action: deploy
+          manifests: "traefik/"
+          strategy: basic
+          namespace: kube-system
+
+  deploy-crowdsec:
+    runs-on: ubuntu-latest
+    needs: check-changes
+    if: ${{ needs.check-changes.outputs.crowdsec == 'true' }}
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: https://gitea.t000-n.de/t.behrendt/k_deploy_workflows/.gitea/actions/extract-namespace-from-repo-name@v0
+        id: namespace
+        with:
+          repo: ${{ github.repository }}
+      - uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4
+      - uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
+        with:
+          version: "3.15.0"
+      - uses: azure/k8s-set-context@ae59a723ba9abe7a9655538854a025448dbab4aa # v4
+        with:
+          method: kubeconfig
+          kubeconfig: ${{ secrets.KUBECONFIG }}
+      - name: Deploy helm
+        uses: helmfile/helmfile-action@f64d5db9f8660aae0205b5fcfc56577d44acefab # v2.1.0
+        with:
+          helmfile-args: apply
+          helm-plugins: https://github.com/databus23/helm-diff@v3.12.0
+          helmfile-workdirectory: "crowdsec"
@@ -9,9 +9,9 @@ jobs:
  validate-node-lables:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
-      - uses: azure/k8s-set-context@8698eba2499e9012f0d5085f8798077cce4bc526 # v5.0.1
+      - uses: actions/checkout@v5
+      - uses: azure/setup-kubectl@v4
+      - uses: azure/k8s-set-context@v4
        with:
          method: kubeconfig
          kubeconfig: ${{ secrets.KUBECONFIG }}
@@ -22,9 +22,9 @@ jobs:
  validate-coredns:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
-      - uses: azure/k8s-set-context@8698eba2499e9012f0d5085f8798077cce4bc526 # v5.0.1
+      - uses: actions/checkout@v5
+      - uses: azure/setup-kubectl@v4
+      - uses: azure/k8s-set-context@v4
        with:
          method: kubeconfig
          kubeconfig: ${{ secrets.KUBECONFIG }}
@@ -35,15 +35,36 @@ jobs:
  validate-traefik:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
-      - uses: azure/k8s-set-context@8698eba2499e9012f0d5085f8798077cce4bc526 # v5.0.1
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4
+      - uses: azure/k8s-set-context@ae59a723ba9abe7a9655538854a025448dbab4aa # v4
        with:
          method: kubeconfig
          kubeconfig: ${{ secrets.KUBECONFIG }}
      - name: Validate
-        uses: azure/k8s-lint@e4234c50ea835112e72b145bdecd00a94bad42fd # v4.0.0
+        uses: azure/k8s-lint@6aefe5066f95e73d2b140d8835cc95583b886989 # v3
        with:
          namespace: kube-system
          lintType: dryrun
          manifests: "traefik/"
+
+  validate-crowdsec:
+    runs-on:
+      - ubuntu-latest
+      - linux_amd64
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4
+      - uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
+        with:
+          version: "3.15.0"
+      - uses: azure/k8s-set-context@ae59a723ba9abe7a9655538854a025448dbab4aa # v4
+        with:
+          method: kubeconfig
+          kubeconfig: ${{ secrets.KUBECONFIG }}
+      - name: Validate Helm
+        uses: helmfile/helmfile-action@f64d5db9f8660aae0205b5fcfc56577d44acefab # v2.1.0
+        with:
+          helmfile-args: diff
+          helm-plugins: https://github.com/databus23/helm-diff@v3.12.0
+          helmfile-workdirectory: "crowdsec"
@@ -7,14 +7,14 @@ data:
  Corefile: |
    t00n.de:53 {
      errors
-      forward . 192.168.0.9
+      forward . 192.168.0.1 192.168.0.9 192.168.0.10
      cache 300
      reload
    }

    t000-n.de:53 {
        errors
-        forward . 192.168.0.9
+        forward . 192.168.0.1 192.168.0.9 192.168.0.10
        cache 300
        reload
    }
@@ -43,4 +43,5 @@ data:
    import /etc/coredns/custom/*.server
  NodeHosts: |
    192.168.0.50 k3sh0
-    192.168.0.53 k3sh3
+    192.168.0.51 k3sh1
+    192.168.0.52 k3sh2
@@ -0,0 +1,12 @@
+repositories:
+  - name: crowdsec
+    url: https://crowdsecurity.github.io/helm-charts
+
+releases:
+  - name: crowdsec
+    namespace: kube-system
+    createNamespace: false
+    chart: crowdsec/crowdsec
+    version: 0.20.0
+    values:
+      - values.yaml
@@ -0,0 +1,35 @@
+container_runtime: containerd
+
+agent:
+  enabled: true
+  acquisition:
+    - namespace: kube-system
+      podName: traefik-*
+      program: traefik
+  metrics:
+    enabled: false
+
+lapi:
+  enabled: true
+  replicas: 1
+  metrics:
+    enabled: true
+  persistentVolume:
+    data:
+      enabled: true
+      size: 1Gi
+    config:
+      enabled: true
+      size: 100Mi
+
+config:
+  config.yaml.local: |
+    api:
+      server:
+        auto_registration:
+          enabled: true
+          token: "${REGISTRATION_TOKEN}"
+          allowed_ranges:
+            - "10.0.0.0/8"
+            - "172.16.0.0/12"
+            - "192.168.0.0/16"
@@ -5,6 +5,3 @@ metadata:
  labels:
    de.t000-n.net.class: "fast"
    de.t000-n.net.bw: "10g"
-    de.t000-n.drive.mnt-syncthing: ""
-    de.t000-n.drive.mnt-torrent: ""
-    de.t000-n.sysctl.net.ipv4.conf.all.src_valid_mark: "1"
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Node
+metadata:
+  name: k3sh1
+  labels:
+    de.t000-n.net.class: "fast"
+    de.t000-n.net.bw: "10g"
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Node
+metadata:
+  name: k3sh2
+  labels:
+    de.t000-n.net.class: "fast"
+    de.t000-n.net.bw: "10g"
+    de.t000-n.drive.mnt-syncthing: ""
+    de.t000-n.drive.mnt-torrent: ""
+    de.t000-n.sysctl.net.ipv4.conf.all.src_valid_mark: "1"
@@ -1,19 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "local>t.behrendt/renovate-configs:common",
-    "local>t.behrendt/renovate-configs:k8s",
-    "local>t.behrendt/renovate-configs:action",
-    "local>t.behrendt/renovate-configs:helm"
-  ],
-  "kubernetes": {
-    "managerFilePatterns": [
-      "/^node-labels/.*\\.yaml$/",
-      "/^coredns/.*\\.yaml$/",
-      "/^traefik/.*\\.yaml$/"
-    ]
-  },
-  "helm-values": {
-    "managerFilePatterns": ["/(^|/)crowdsec/values.ya?ml$/"]
-  }
-}
@@ -0,0 +1,13 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+    name: crowdsec-bouncer
+    namespace: kube-system
+spec:
+    plugin:
+        crowdsec-bouncer-traefik-plugin:
+            Enabled: true
+            CrowdsecMode: live
+            CrowdsecLapiUrl: "http://crowdsec-service.kube-system.svc.cluster.local:8080"
+            CrowdsecLapiKey: "${CROWDSEC_BOUNCER_API_KEY}"
+            UpdateIntervalSeconds: 10
@@ -1,34 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: pv-traefik-hostpath-static
-spec:
-  capacity:
-    storage: 10Gi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: traefik-certificates
-  local:
-    path: /mnt/longhorn1/svc/kube-system/main/traefik/data
-  nodeAffinity:
-    required:
-      nodeSelectorTerms:
-        - matchExpressions:
-            - key: kubernetes.io/hostname
-              operator: In
-              values:
-                - k3sh0
---
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: pvc-traefik
-  namespace: kube-system
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: traefik-certificates
-  resources:
-    requests:
-      storage: 10Gi
@@ -32,6 +32,11 @@ spec:
          secretKeyRef:
            key: apiKey
            name: ionos-api-credentials
+      - name: CROWDSEC_BOUNCER_API_KEY
+        valueFrom:
+          secretKeyRef:
+            name: crowdsec-bouncer-api-key
+            key: api-key
    ports:
      web:
        port: 8000
@@ -54,9 +59,22 @@ spec:
        externalTrafficPolicy: Local
      externalIPs:
        - 192.168.0.50
+        - 192.168.0.51
+        - 192.168.0.52
        - 192.168.0.53
    persistence:
      enabled: true
      name: data
-      existingClaim: pvc-traefik
+      accessMode: ReadWriteMany
+      size: 1Gi
+      storageClass: longhorn
      path: /data
+    #experimental:
+    #  plugins:
+    #    crowdsec-bouncer-traefik-plugin:
+    #      moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
+    #      version: v1.4.6
+    #additionalArguments:
+    #  - "--providers.kubernetescrd"
+    #  - "--entrypoints.web.http.middlewares=crowdsec-bouncer@kubernetescrd"
+    #  - "--entrypoints.websecure.http.middlewares=kube-system-crowdsec-bouncer@kubernetescrd"
Author	SHA1	Message	Date
t.behrendt	be0dfeab27	Merge remote-tracking branch 'origin/main' into feat-add-crowdsec Validate / validate-node-lables (push) Successful in 7s Details Validate / validate-traefik (push) Successful in 8s Details Validate / validate-crowdsec (push) Successful in 13s Details Validate / validate-coredns (push) Successful in 19s Details	2025-12-28 10:11:52 +01:00
t.behrendt	e10e4f2c6c	disable crowdsec for now	2025-12-28 10:08:05 +01:00
t.behrendt	9bf8b1b545	ci: force crowdsec validation on amd64 Validate / validate-coredns (push) Successful in 7s Details Validate / validate-crowdsec (push) Successful in 12s Details Validate / validate-node-lables (push) Successful in 28s Details Validate / validate-traefik (push) Successful in 26s Details	2025-12-28 09:51:08 +01:00
t.behrendt	5a44a408a3	ci: add ci steps for traefik and crowdsec Validate / validate-node-lables (push) Successful in 7s Details Validate / validate-traefik (push) Successful in 7s Details Validate / validate-coredns (push) Successful in 25s Details Validate / validate-crowdsec (push) Successful in 49s Details	2025-12-28 09:50:06 +01:00
t.behrendt	94420fb710	adjust cicd Validate / validate-node-lables (push) Successful in 8s Details Validate / validate-coredns (push) Successful in 23s Details	2025-12-28 09:48:46 +01:00
t.behrendt	bbd8b8dcb6	feat: add traefik	2025-12-28 09:48:42 +01:00
t.behrendt	292dcbe909	feat: add crowdsec	2025-12-28 09:48:33 +01:00