feat(hubble): Enabling and exposing Hubble

infra/argocd/kustomization.yaml

@@ -12,7 +12,9 @@ resources:
 
 patchesStrategicMerge:
   # Kustomize --enable-helm plugin for Helm charts
-  - config/argocd-cm-kustomize-helm-patch.yaml
+  - patches/argocd-cm-kustomize-helm-patch.yaml
+  # Ignore CiliumIdentity CRDs
+  - patches/argocd-cm-resource-exclusion-cilium-identity-patch.yaml
   # Let Traefik manage TLS-termination
-  - config/argocd-cmd-params-cm-server-insecrure-patch.yaml
+  - patches/argocd-cmd-params-cm-server-insecrure-patch.yaml
 

infra/argocd/patches/argocd-cm-kustomize-helm-patch.yaml

@@ -8,10 +8,3 @@ data:
       generate:
         command: [ "sh", "-c" ]
         args: [ "kustomize build --enable-helm" ]
-  resource.exclusions: |
-    - apiGroups:
-        - cilium.io
-      kinds:
-        - CiliumIdentity
-      clusters:
-        - "*"

infra/argocd/patches/argocd-cm-resource-exclusion-cilium-identity-patch.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cm
+data:
+  resource.exclusions: |
+    - apiGroups:
+        - cilium.io
+      kinds:
+        - CiliumIdentity
+      clusters:
+        - "*"

infra/cilium/ingress-route.yaml

@@ -0,0 +1,25 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: hubble
+  namespace: kube-system
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`auth-hubble.stonegarden.dev`)
+      kind: Rule
+      services:
+        - name: traefik-forward-auth
+          port: 4181
+      middlewares:
+        - name: traefik-forward-auth
+    - match: Host(`hubble.stonegarden.dev`)
+      kind: Rule
+      services:
+        - name: hubble-ui
+          port: 80
+      middlewares:
+        - name: traefik-forward-auth
+  tls:
+    certResolver: letsencrypt

infra/cilium/kustomization.yaml

@@ -2,6 +2,14 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: kube-system
 
+resources:
+  - traefik-forward-auth
+  - ingress-route.yaml
+
+patchesStrategicMerge:
+  # peer-service: "hubble-peer.default.svc.cluster.local:443"
+  - patches/hubble-relay-config-peer-service-patch.yaml
+
 helmCharts:
   - name: cilium
     repo: https://helm.cilium.io

infra/cilium/patches/hubble-relay-config-peer-service-patch.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: hubble-relay-config
+data:
+  # default set to 'default' ns which is wrong
+  config.yaml: |
+    cluster-name: kubernetes
+    peer-service: "hubble-peer.kube-system.svc.cluster.local:443"
+    listen-address: :4245
+    dial-timeout:
+    retry-timeout:
+    sort-buffer-len-max:
+    sort-buffer-drain-timeout:
+    tls-client-cert-file: /var/lib/hubble-relay/tls/client.crt
+    tls-client-key-file: /var/lib/hubble-relay/tls/client.key
+    tls-hubble-server-ca-files: /var/lib/hubble-relay/tls/hubble-server-ca.crt
+    disable-server-tls: true
+

infra/cilium/traefik-forward-auth/configs/traefik-forward-auth.ini

@@ -0,0 +1,5 @@
+cookie-name = "_hubble_auth"
+log-level = "error"
+cookie-domain = "stonegarden.dev"
+auth-host = "auth-hubble.stonegarden.dev"
+whitelist = "[email protected]"

infra/cilium/traefik-forward-auth/deployment.yaml

@@ -0,0 +1,54 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: traefik-forward-auth
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: traefik-forward-auth
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: traefik-forward-auth
+    spec:
+      terminationGracePeriodSeconds: 60
+      containers:
+        - image: thomseddon/traefik-forward-auth:2
+          imagePullPolicy: Always
+          name: traefik-forward-auth
+          ports:
+            - containerPort: 4181
+              protocol: TCP
+          env:
+            - name: CONFIG
+              value: "/config"
+            - name: PROVIDERS_GOOGLE_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: traefik-forward-auth-secrets
+                  key: google-client-id
+            - name: PROVIDERS_GOOGLE_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: traefik-forward-auth-secrets
+                  key: google-client-secret
+            - name: SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: traefik-forward-auth-secrets
+                  key: secret
+          volumeMounts:
+            - name: configs
+              mountPath: /config
+              subPath: traefik-forward-auth.ini
+
+      volumes:
+        - name: configs
+          configMap:
+            name: configs
+        - name: traefik-forward-auth-secrets
+          secret:
+            secretName: traefik-forward-auth-secrets

infra/cilium/traefik-forward-auth/kustomization.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+commonLabels:
+  app: traefik-forward-auth
+
+resources:
+  - service.yaml
+  - deployment.yaml
+  - middleware.yaml
+
+configMapGenerator:
+  - name: configs
+    files:
+      - configs/traefik-forward-auth.ini

infra/cilium/traefik-forward-auth/middleware.yaml

@@ -0,0 +1,10 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: traefik-forward-auth
+spec:
+  forwardAuth:
+    address: http://traefik-forward-auth.kube-system.svc.cluster.local:4181
+    authResponseHeaders:
+      - X-Forwarded-User
+    trustForwardHeader: true

infra/cilium/traefik-forward-auth/service.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: traefik-forward-auth
+spec:
+  type: ClusterIP
+  selector:
+    app: traefik-forward-auth
+  ports:
+    - name: auth-http
+      port: 4181

infra/cilium/values.yaml

@@ -2,6 +2,9 @@ cluster:
   id: 0
   name: kubernetes
 
+debug:
+  enabled: true
+
 encryption:
   nodeEncryption: false
 
@@ -10,6 +13,14 @@ k8sServicePort: 6443
 
 kubeProxyReplacement: strict
 
+# -- Roll out cilium agent pods automatically when configmap is updated.
+rollOutCiliumPods: false
+
+containerRuntime:
+  integration: containerd
+
+enableCiliumEndpointSlice: true
+
 operator:
   replicas: 1
 
@@ -19,4 +30,27 @@ serviceAccounts:
   operator:
     name: cilium-operator
 
-tunnel: vxlan
+tunnel: vxlan
+
+
+
+hubble:
+  enabled: true
+  peerService:
+    enabled: true
+    clusterDomain: cluster.local
+  relay:
+    enabled: true
+    rollOutPods: true
+  ui:
+    enabled: true
+    rollOutPods: true
+    frontend:
+      server:
+        ipv6:
+          enabled: false
+  tls:
+    auto:
+      enabled: true
+      method: helm
+      certValidityDuration: 1095

secrets/kustomization.yaml

@@ -4,5 +4,6 @@ kind: Kustomization
 resources:
   - arr.yaml
   - dashboard.yaml
+  - hubble.yaml
   - traefik-system.yaml
   - whoami.yaml