correctly create the secret

feat: add docker hub registry token
ci: remove helmfile action overrides (#39 )
2026-01-25 17:16:51 +01:00 · 2026-01-25 17:10:03 +01:00 · 2026-01-25 17:09:48 +01:00 · 2026-01-25 17:07:02 +01:00
6 changed files with 148 additions and 62 deletions
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -13,11 +13,12 @@ jobs:
      node-labels: ${{ steps.filter.outputs.node-labels }}
      coredns: ${{ steps.filter.outputs.coredns }}
      traefik: ${{ steps.filter.outputs.traefik }}
+      crowdsec: ${{ steps.filter.outputs.crowdsec }}
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          fetch-depth: 0
-      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
        id: filter
        with:
          filters: |
@@ -27,15 +28,17 @@ jobs:
              - 'coredns/**'
            traefik:
              - 'traefik/**'
+            crowdsec:
+              - 'crowdsec/**'

  deploy-node-labels:
    runs-on: ubuntu-latest
    needs: check-changes
    if: ${{ needs.check-changes.outputs.node-labels == 'true' || github.event_name == 'workflow_dispatch' }}
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
-      - uses: azure/k8s-set-context@89b837d75b40a7bd2ddafde837473c212db8b313 # v5.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4
+      - uses: azure/k8s-set-context@ae59a723ba9abe7a9655538854a025448dbab4aa # v4
        with:
          method: kubeconfig
          kubeconfig: ${{ secrets.KUBECONFIG }}
@@ -48,9 +51,9 @@ jobs:
    needs: check-changes
    if: ${{ needs.check-changes.outputs.coredns == 'true' || github.event_name == 'workflow_dispatch' }}
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
-      - uses: azure/k8s-set-context@89b837d75b40a7bd2ddafde837473c212db8b313 # v5.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4
+      - uses: azure/k8s-set-context@ae59a723ba9abe7a9655538854a025448dbab4aa # v4
        with:
          method: kubeconfig
          kubeconfig: ${{ secrets.KUBECONFIG }}
@@ -66,14 +69,14 @@ jobs:
    needs: check-changes
    if: ${{ needs.check-changes.outputs.traefik == 'true' || github.event_name == 'workflow_dispatch' }}
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
-      - uses: azure/k8s-set-context@89b837d75b40a7bd2ddafde837473c212db8b313 # v5.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4
+      - uses: azure/k8s-set-context@ae59a723ba9abe7a9655538854a025448dbab4aa # v4
        with:
          method: kubeconfig
          kubeconfig: ${{ secrets.KUBECONFIG }}
      - name: Set ionos api credentials
-        uses: azure/k8s-create-secret@6e0ba8047235646753f2a3a3b359b4d0006ff218 # v5.0.1
+        uses: azure/k8s-create-secret@6e0ba8047235646753f2a3a3b359b4d0006ff218 # v5
        with:
          namespace: kube-system
          secret-name: ionos-api-credentials
@@ -83,7 +86,7 @@ jobs:
              "apiKey": "${{ secrets.IONOS_API_KEY }}"
            }
      - name: Set admin basic auth credentials
-        uses: azure/k8s-create-secret@6e0ba8047235646753f2a3a3b359b4d0006ff218 # v5.0.1
+        uses: azure/k8s-create-secret@6e0ba8047235646753f2a3a3b359b4d0006ff218 # v5
        with:
          namespace: kube-system
          secret-name: admin-basic-auth-credentials
@@ -92,21 +95,55 @@ jobs:
            {
              "auth": "${{ secrets.ADMIN_BASIC_AUTH_CREDENTIALS }}"
            }
+      - name: Set crowdsec bouncer api key
+        uses: azure/k8s-create-secret@6e0ba8047235646753f2a3a3b359b4d0006ff218 # v5
+        with:
+          namespace: kube-system
+          secret-name: crowdsec-bouncer-api-key
+          secret-type: generic
+          data: |
+            {
+              "api-key": "${{ secrets.CROWDSEC_BOUNCER_API_KEY }}"
+            }
      - name: Deploy
-        uses: azure/k8s-deploy@c8cfec839dc09896b3b8cc40cd13d04792680771 # v5.1.0
+        uses: azure/k8s-deploy@6f7c489cecd8da05646259d9fa3daae92e095c7b # v5.0.4
        with:
          action: deploy
          manifests: "traefik/"
          strategy: basic
          namespace: kube-system

+  deploy-crowdsec:
+    runs-on: ubuntu-latest
+    needs: check-changes
+    if: ${{ needs.check-changes.outputs.crowdsec == 'true' || github.event_name == 'workflow_dispatch' }}
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: https://gitea.t000-n.de/t.behrendt/k_deploy_workflows/.gitea/actions/extract-namespace-from-repo-name@v0
+        id: namespace
+        with:
+          repo: ${{ github.repository }}
+      - uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4
+      - uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
+        with:
+          version: "3.15.0"
+      - uses: azure/k8s-set-context@ae59a723ba9abe7a9655538854a025448dbab4aa # v4
+        with:
+          method: kubeconfig
+          kubeconfig: ${{ secrets.KUBECONFIG }}
+      - name: Deploy helm
+        uses: helmfile/helmfile-action@f64d5db9f8660aae0205b5fcfc56577d44acefab # v2.1.0
+        with:
+          helmfile-args: apply
+          helmfile-workdirectory: "crowdsec"
+
  deploy-docker-registry-secret:
    runs-on: ubuntu-latest
    needs: check-changes
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
-      - uses: azure/k8s-set-context@89b837d75b40a7bd2ddafde837473c212db8b313 # v5.0.0
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4
+      - uses: azure/k8s-set-context@ae59a723ba9abe7a9655538854a025448dbab4aa # v4
        with:
          method: kubeconfig
          kubeconfig: ${{ secrets.KUBECONFIG }}
--- a/.gitea/workflows/validate.yaml
+++ b/.gitea/workflows/validate.yaml
@@ -9,9 +9,9 @@ jobs:
  validate-node-lables:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
-      - uses: azure/k8s-set-context@89b837d75b40a7bd2ddafde837473c212db8b313 # v5.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4
+      - uses: azure/k8s-set-context@ae59a723ba9abe7a9655538854a025448dbab4aa # v4
        with:
          method: kubeconfig
          kubeconfig: ${{ secrets.KUBECONFIG }}
@@ -22,9 +22,9 @@ jobs:
  validate-coredns:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
-      - uses: azure/k8s-set-context@89b837d75b40a7bd2ddafde837473c212db8b313 # v5.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4
+      - uses: azure/k8s-set-context@ae59a723ba9abe7a9655538854a025448dbab4aa # v4
        with:
          method: kubeconfig
          kubeconfig: ${{ secrets.KUBECONFIG }}
@@ -35,15 +35,35 @@ jobs:
  validate-traefik:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
-      - uses: azure/k8s-set-context@89b837d75b40a7bd2ddafde837473c212db8b313 # v5.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4
+      - uses: azure/k8s-set-context@ae59a723ba9abe7a9655538854a025448dbab4aa # v4
        with:
          method: kubeconfig
          kubeconfig: ${{ secrets.KUBECONFIG }}
      - name: Validate
-        uses: azure/k8s-lint@6aefe5066f95e73d2b140d8835cc95583b886989 # v3.0.1
+        uses: azure/k8s-lint@6aefe5066f95e73d2b140d8835cc95583b886989 # v3
        with:
          namespace: kube-system
          lintType: dryrun
          manifests: "traefik/"
+
+  validate-crowdsec:
+    runs-on:
+      - ubuntu-latest
+      - linux_amd64
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4
+      - uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
+        with:
+          version: "3.15.0"
+      - uses: azure/k8s-set-context@ae59a723ba9abe7a9655538854a025448dbab4aa # v4
+        with:
+          method: kubeconfig
+          kubeconfig: ${{ secrets.KUBECONFIG }}
+      - name: Validate Helm
+        uses: helmfile/helmfile-action@f64d5db9f8660aae0205b5fcfc56577d44acefab # v2.1.0
+        with:
+          helmfile-args: diff
+          helmfile-workdirectory: "crowdsec"
--- a/crowdsec/helmfile.yaml
+++ b/crowdsec/helmfile.yaml
@@ -0,0 +1,12 @@
+repositories:
+  - name: crowdsec
+    url: https://crowdsecurity.github.io/helm-charts
+
+releases:
+  - name: crowdsec
+    namespace: kube-system
+    createNamespace: false
+    chart: crowdsec/crowdsec
+    version: 0.20.0
+    values:
+      - values.yaml
--- a/crowdsec/values.yaml
+++ b/crowdsec/values.yaml
@@ -0,0 +1,35 @@
+container_runtime: containerd
+
+agent:
+  enabled: true
+  acquisition:
+    - namespace: kube-system
+      podName: traefik-*
+      program: traefik
+  metrics:
+    enabled: false
+
+lapi:
+  enabled: true
+  replicas: 1
+  metrics:
+    enabled: true
+  persistentVolume:
+    data:
+      enabled: true
+      size: 1Gi
+    config:
+      enabled: true
+      size: 100Mi
+
+config:
+  config.yaml.local: |
+    api:
+      server:
+        auto_registration:
+          enabled: true
+          token: "${REGISTRATION_TOKEN}"
+          allowed_ranges:
+            - "10.0.0.0/8"
+            - "172.16.0.0/12"
+            - "192.168.0.0/16"
--- a/traefik/pvc.yaml
+++ b/traefik/pvc.yaml
@@ -1,34 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: pv-traefik-hostpath-static
-spec:
-  capacity:
-    storage: 10Gi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: traefik-certificates
-  local:
-    path: /mnt/longhorn1/svc/kube-system/main/traefik/data
-  nodeAffinity:
-    required:
-      nodeSelectorTerms:
-        - matchExpressions:
-            - key: kubernetes.io/hostname
-              operator: In
-              values:
-                - k3sh0
---
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: pvc-traefik
-  namespace: kube-system
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: traefik-certificates
-  resources:
-    requests:
-      storage: 10Gi
--- a/traefik/traefik-config.yaml
+++ b/traefik/traefik-config.yaml
@@ -32,6 +32,11 @@ spec:
          secretKeyRef:
            key: apiKey
            name: ionos-api-credentials
+      - name: CROWDSEC_BOUNCER_API_KEY
+        valueFrom:
+          secretKeyRef:
+            name: crowdsec-bouncer-api-key
+            key: api-key
    ports:
      web:
        port: 8000
@@ -60,5 +65,16 @@ spec:
    persistence:
      enabled: true
      name: data
-      existingClaim: pvc-traefik
+      accessMode: ReadWriteMany
+      size: 1Gi
+      storageClass: longhorn
      path: /data
+    #experimental:
+    #  plugins:
+    #    crowdsec-bouncer-traefik-plugin:
+    #      moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
+    #      version: v1.4.6
+    #additionalArguments:
+    #  - "--providers.kubernetescrd"
+    #  - "--entrypoints.web.http.middlewares=crowdsec-bouncer@kubernetescrd"
+    #  - "--entrypoints.websecure.http.middlewares=kube-system-crowdsec-bouncer@kubernetescrd"
Author	SHA1	Message	Date
Timo Behrendt	7af22f9de4	correctly create the secret All checks were successful Validate / validate-node-lables (push) Successful in 13s Details Validate / validate-traefik (push) Successful in 11s Details Validate / validate-crowdsec (push) Successful in 16s Details Validate / validate-coredns (push) Successful in 24s Details	2026-01-25 17:16:51 +01:00
Timo Behrendt	e4b6c1cfe2	feat: add docker hub registry token All checks were successful Validate / validate-coredns (push) Successful in 7s Details Validate / validate-crowdsec (push) Successful in 13s Details Validate / validate-node-lables (push) Successful in 30s Details Validate / validate-traefik (push) Successful in 28s Details	2026-01-25 17:10:03 +01:00
Timo Behrendt	7c0aedeecd	ci: remove helmfile action overrides (#39 ) All checks were successful Deploy / check-changes (push) Successful in 5s Details Deploy / deploy-node-labels (push) Has been skipped Details Deploy / deploy-coredns (push) Has been skipped Details Deploy / deploy-traefik (push) Has been skipped Details Deploy / deploy-crowdsec (push) Has been skipped Details Reviewed-on: #39 Co-authored-by: Timo Behrendt <t.behrendt@t00n.de> Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>	2026-01-25 17:09:48 +01:00
Renovate Bot	bf0e58ea5c	chore(deps): update actions/checkout action to v6 (#17 ) All checks were successful Deploy / check-changes (push) Successful in 20s Details Deploy / deploy-node-labels (push) Has been skipped Details Deploy / deploy-coredns (push) Has been skipped Details Deploy / deploy-traefik (push) Has been skipped Details Deploy / deploy-crowdsec (push) Has been skipped Details This PR contains the following updates: \| Package \| Type \| Update \| Change \| \|---\|---\|---\|---\| \| [actions/checkout](https://github.com/actions/checkout) \| action \| major \| `v5` → `v6` \| --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v6`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602) [Compare Source](https://github.com/actions/checkout/compare/v5...v6) - Fix tag handling: preserve annotations and explicit fetch-tags by [@ericsciple](https://github.com/ericsciple) in [#2356](https://github.com/actions/checkout/pull/2356) </details> --- ### Configuration 📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi42NC4xIiwidXBkYXRlZEluVmVyIjoiNDIuNzQuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYWN0aW9uIiwiZGVwcyJdfQ==--> Reviewed-on: #17 Reviewed-by: t.behrendt <t.behrendt@noreply.localhost> Co-authored-by: Renovate Bot <renovate@t00n.de> Co-committed-by: Renovate Bot <renovate@t00n.de>	2026-01-25 17:07:02 +01:00