From d5f5e23bf26626bfb6edf1f6923ca068325b3aa9 Mon Sep 17 00:00:00 2001 From: Vegard Hagen Date: Thu, 26 Jan 2023 21:09:40 +0100 Subject: [PATCH] feat(hubble): Enabling and exposing Hubble --- infra/argocd/kustomization.yaml | 6 ++- .../argocd-cm-kustomize-helm-patch.yaml | 7 --- ...ource-exclusion-cilium-identity-patch.yaml | 12 +++++ ...-cmd-params-cm-server-insecrure-patch.yaml | 0 infra/cilium/ingress-route.yaml | 25 +++++++++ infra/cilium/kustomization.yaml | 8 +++ ...ubble-relay-config-peer-service-patch.yaml | 19 +++++++ .../configs/traefik-forward-auth.ini | 5 ++ .../traefik-forward-auth/deployment.yaml | 54 +++++++++++++++++++ .../traefik-forward-auth/kustomization.yaml | 14 +++++ .../traefik-forward-auth/middleware.yaml | 10 ++++ .../cilium/traefik-forward-auth/service.yaml | 11 ++++ infra/cilium/values.yaml | 36 ++++++++++++- secrets/kustomization.yaml | 1 + 14 files changed, 198 insertions(+), 10 deletions(-) rename infra/argocd/{config => patches}/argocd-cm-kustomize-helm-patch.yaml (63%) create mode 100644 infra/argocd/patches/argocd-cm-resource-exclusion-cilium-identity-patch.yaml rename infra/argocd/{config => patches}/argocd-cmd-params-cm-server-insecrure-patch.yaml (100%) create mode 100644 infra/cilium/ingress-route.yaml create mode 100644 infra/cilium/patches/hubble-relay-config-peer-service-patch.yaml create mode 100644 infra/cilium/traefik-forward-auth/configs/traefik-forward-auth.ini create mode 100644 infra/cilium/traefik-forward-auth/deployment.yaml create mode 100644 infra/cilium/traefik-forward-auth/kustomization.yaml create mode 100644 infra/cilium/traefik-forward-auth/middleware.yaml create mode 100644 infra/cilium/traefik-forward-auth/service.yaml diff --git a/infra/argocd/kustomization.yaml b/infra/argocd/kustomization.yaml index 95f5505..afeb71e 100644 --- a/infra/argocd/kustomization.yaml +++ b/infra/argocd/kustomization.yaml @@ -12,7 +12,9 @@ resources: patchesStrategicMerge: # Kustomize --enable-helm plugin for Helm charts - - config/argocd-cm-kustomize-helm-patch.yaml + - patches/argocd-cm-kustomize-helm-patch.yaml + # Ignore CiliumIdentity CRDs + - patches/argocd-cm-resource-exclusion-cilium-identity-patch.yaml # Let Traefik manage TLS-termination - - config/argocd-cmd-params-cm-server-insecrure-patch.yaml + - patches/argocd-cmd-params-cm-server-insecrure-patch.yaml diff --git a/infra/argocd/config/argocd-cm-kustomize-helm-patch.yaml b/infra/argocd/patches/argocd-cm-kustomize-helm-patch.yaml similarity index 63% rename from infra/argocd/config/argocd-cm-kustomize-helm-patch.yaml rename to infra/argocd/patches/argocd-cm-kustomize-helm-patch.yaml index 0891482..cea1be9 100644 --- a/infra/argocd/config/argocd-cm-kustomize-helm-patch.yaml +++ b/infra/argocd/patches/argocd-cm-kustomize-helm-patch.yaml @@ -8,10 +8,3 @@ data: generate: command: [ "sh", "-c" ] args: [ "kustomize build --enable-helm" ] - resource.exclusions: | - - apiGroups: - - cilium.io - kinds: - - CiliumIdentity - clusters: - - "*" diff --git a/infra/argocd/patches/argocd-cm-resource-exclusion-cilium-identity-patch.yaml b/infra/argocd/patches/argocd-cm-resource-exclusion-cilium-identity-patch.yaml new file mode 100644 index 0000000..6c68ada --- /dev/null +++ b/infra/argocd/patches/argocd-cm-resource-exclusion-cilium-identity-patch.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: argocd-cm +data: + resource.exclusions: | + - apiGroups: + - cilium.io + kinds: + - CiliumIdentity + clusters: + - "*" diff --git a/infra/argocd/config/argocd-cmd-params-cm-server-insecrure-patch.yaml b/infra/argocd/patches/argocd-cmd-params-cm-server-insecrure-patch.yaml similarity index 100% rename from infra/argocd/config/argocd-cmd-params-cm-server-insecrure-patch.yaml rename to infra/argocd/patches/argocd-cmd-params-cm-server-insecrure-patch.yaml diff --git a/infra/cilium/ingress-route.yaml b/infra/cilium/ingress-route.yaml new file mode 100644 index 0000000..a18af41 --- /dev/null +++ b/infra/cilium/ingress-route.yaml @@ -0,0 +1,25 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: hubble + namespace: kube-system +spec: + entryPoints: + - websecure + routes: + - match: Host(`auth-hubble.stonegarden.dev`) + kind: Rule + services: + - name: traefik-forward-auth + port: 4181 + middlewares: + - name: traefik-forward-auth + - match: Host(`hubble.stonegarden.dev`) + kind: Rule + services: + - name: hubble-ui + port: 80 + middlewares: + - name: traefik-forward-auth + tls: + certResolver: letsencrypt diff --git a/infra/cilium/kustomization.yaml b/infra/cilium/kustomization.yaml index 0155ae5..21ea687 100644 --- a/infra/cilium/kustomization.yaml +++ b/infra/cilium/kustomization.yaml @@ -2,6 +2,14 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: kube-system +resources: + - traefik-forward-auth + - ingress-route.yaml + +patchesStrategicMerge: + # peer-service: "hubble-peer.default.svc.cluster.local:443" + - patches/hubble-relay-config-peer-service-patch.yaml + helmCharts: - name: cilium repo: https://helm.cilium.io diff --git a/infra/cilium/patches/hubble-relay-config-peer-service-patch.yaml b/infra/cilium/patches/hubble-relay-config-peer-service-patch.yaml new file mode 100644 index 0000000..cdff13e --- /dev/null +++ b/infra/cilium/patches/hubble-relay-config-peer-service-patch.yaml @@ -0,0 +1,19 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: hubble-relay-config +data: + # default set to 'default' ns which is wrong + config.yaml: | + cluster-name: kubernetes + peer-service: "hubble-peer.kube-system.svc.cluster.local:443" + listen-address: :4245 + dial-timeout: + retry-timeout: + sort-buffer-len-max: + sort-buffer-drain-timeout: + tls-client-cert-file: /var/lib/hubble-relay/tls/client.crt + tls-client-key-file: /var/lib/hubble-relay/tls/client.key + tls-hubble-server-ca-files: /var/lib/hubble-relay/tls/hubble-server-ca.crt + disable-server-tls: true + diff --git a/infra/cilium/traefik-forward-auth/configs/traefik-forward-auth.ini b/infra/cilium/traefik-forward-auth/configs/traefik-forward-auth.ini new file mode 100644 index 0000000..463fbb5 --- /dev/null +++ b/infra/cilium/traefik-forward-auth/configs/traefik-forward-auth.ini @@ -0,0 +1,5 @@ +cookie-name = "_hubble_auth" +log-level = "error" +cookie-domain = "stonegarden.dev" +auth-host = "auth-hubble.stonegarden.dev" +whitelist = "veghag@gmail.com" diff --git a/infra/cilium/traefik-forward-auth/deployment.yaml b/infra/cilium/traefik-forward-auth/deployment.yaml new file mode 100644 index 0000000..217f012 --- /dev/null +++ b/infra/cilium/traefik-forward-auth/deployment.yaml @@ -0,0 +1,54 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: traefik-forward-auth +spec: + replicas: 1 + selector: + matchLabels: + app: traefik-forward-auth + strategy: + type: Recreate + template: + metadata: + labels: + app: traefik-forward-auth + spec: + terminationGracePeriodSeconds: 60 + containers: + - image: thomseddon/traefik-forward-auth:2 + imagePullPolicy: Always + name: traefik-forward-auth + ports: + - containerPort: 4181 + protocol: TCP + env: + - name: CONFIG + value: "/config" + - name: PROVIDERS_GOOGLE_CLIENT_ID + valueFrom: + secretKeyRef: + name: traefik-forward-auth-secrets + key: google-client-id + - name: PROVIDERS_GOOGLE_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: traefik-forward-auth-secrets + key: google-client-secret + - name: SECRET + valueFrom: + secretKeyRef: + name: traefik-forward-auth-secrets + key: secret + volumeMounts: + - name: configs + mountPath: /config + subPath: traefik-forward-auth.ini + + volumes: + - name: configs + configMap: + name: configs + - name: traefik-forward-auth-secrets + secret: + secretName: traefik-forward-auth-secrets \ No newline at end of file diff --git a/infra/cilium/traefik-forward-auth/kustomization.yaml b/infra/cilium/traefik-forward-auth/kustomization.yaml new file mode 100644 index 0000000..01e7632 --- /dev/null +++ b/infra/cilium/traefik-forward-auth/kustomization.yaml @@ -0,0 +1,14 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +commonLabels: + app: traefik-forward-auth + +resources: + - service.yaml + - deployment.yaml + - middleware.yaml + +configMapGenerator: + - name: configs + files: + - configs/traefik-forward-auth.ini \ No newline at end of file diff --git a/infra/cilium/traefik-forward-auth/middleware.yaml b/infra/cilium/traefik-forward-auth/middleware.yaml new file mode 100644 index 0000000..446237f --- /dev/null +++ b/infra/cilium/traefik-forward-auth/middleware.yaml @@ -0,0 +1,10 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: traefik-forward-auth +spec: + forwardAuth: + address: http://traefik-forward-auth.kube-system.svc.cluster.local:4181 + authResponseHeaders: + - X-Forwarded-User + trustForwardHeader: true \ No newline at end of file diff --git a/infra/cilium/traefik-forward-auth/service.yaml b/infra/cilium/traefik-forward-auth/service.yaml new file mode 100644 index 0000000..569ceff --- /dev/null +++ b/infra/cilium/traefik-forward-auth/service.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: Service +metadata: + name: traefik-forward-auth +spec: + type: ClusterIP + selector: + app: traefik-forward-auth + ports: + - name: auth-http + port: 4181 diff --git a/infra/cilium/values.yaml b/infra/cilium/values.yaml index 1755eac..b6bb199 100644 --- a/infra/cilium/values.yaml +++ b/infra/cilium/values.yaml @@ -2,6 +2,9 @@ cluster: id: 0 name: kubernetes +debug: + enabled: true + encryption: nodeEncryption: false @@ -10,6 +13,14 @@ k8sServicePort: 6443 kubeProxyReplacement: strict +# -- Roll out cilium agent pods automatically when configmap is updated. +rollOutCiliumPods: false + +containerRuntime: + integration: containerd + +enableCiliumEndpointSlice: true + operator: replicas: 1 @@ -19,4 +30,27 @@ serviceAccounts: operator: name: cilium-operator -tunnel: vxlan \ No newline at end of file +tunnel: vxlan + + + +hubble: + enabled: true + peerService: + enabled: true + clusterDomain: cluster.local + relay: + enabled: true + rollOutPods: true + ui: + enabled: true + rollOutPods: true + frontend: + server: + ipv6: + enabled: false + tls: + auto: + enabled: true + method: helm + certValidityDuration: 1095 \ No newline at end of file diff --git a/secrets/kustomization.yaml b/secrets/kustomization.yaml index 7e9f248..6fb787e 100644 --- a/secrets/kustomization.yaml +++ b/secrets/kustomization.yaml @@ -4,5 +4,6 @@ kind: Kustomization resources: - arr.yaml - dashboard.yaml + - hubble.yaml - traefik-system.yaml - whoami.yaml \ No newline at end of file