feat(cloudflared): Configuring tunnel locally/declaratively instead of ClickOps through Dashboard

infra/net-aux/config/cloudflared/config.yaml

@@ -1,2 +1,24 @@
+tunnel: gauss-k8s
+credentials-file: /etc/cloudflared/creds/credentials.json
 metrics: 0.0.0.0:2000
 no-autoupdate: true
+
+warp-routing:
+  enabled: true
+
+ingress:
+  - hostname: hello.stonegarden.dev
+    service: hello_world
+  - hostname: hei.stonegarden.dev
+    service: hello_world
+    originRequest:
+      access:
+        required: true
+        teamName: stonegarden
+  - hostname: ssh.stonegarden.dev
+    service: ssh://192.168.1.12:22
+  - hostname: stonegarden.dev
+    service: https://stonegarden.dev
+  - hostname: "*.stonegarden.dev"
+    service: https://stonegarden.dev
+  - service: http_status:404

infra/net-aux/deployment.yaml

@@ -126,16 +126,13 @@ spec:
             initialDelaySeconds: 60
             failureThreshold: 5
             periodSeconds: 10
-          env:
-            - name: TUNNEL_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  key: tunnel-token
-                  name: tunnel-token
           volumeMounts:
             - name: cloudflared-config
               mountPath: /etc/cloudflared/config/config.yaml
               subPath: config.yaml
+            - name: tunnel-credentials
+              mountPath: /etc/cloudflared/creds
+              readOnly: true
       restartPolicy: Always
       volumes:
         - name: unbound-config
@@ -159,6 +156,6 @@ spec:
         - name: cloudflared-config
           configMap:
             name: cloudflared-config
-        - name: tunnel-token
+        - name: tunnel-credentials
           secret:
-            secretName: tunnel-token
+            secretName: tunnel-credentials

infra/net-aux/kustomization.yaml

@@ -32,7 +32,7 @@ resources:
   - pv-pi-hole.yaml
   - pvc-pi-hole.yaml
   - auth-secret.yaml
-  - tunnel-token.yaml
+  - tunnel-credentials.yaml
   - ingress-route.yaml
   - service.yaml
   - deployment.yaml

infra/net-aux/tunnel-credentials.yaml

@@ -0,0 +1,13 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: tunnel-credentials
+  namespace: net-aux
+spec:
+  encryptedData:
+    credentials.json: AgDR65D32Doss7Umwl5EEZBKJ2ZrUpNVtvZS2XINGDiZfHs9Znn2IQKAKyYmGqdchXRyGcvxuRSH1aXordrg212bx0Yo6ndtUPoH2ivxe9z4DvAO2GCgR1TFDaiXI32k3zNR5j5lQl6ry4eASYrUhn3J6JvHXm5gk2hv2cHTNojt1LlDKu3KgIT67Og37rEGMaEz56p2zKddCc1x/lkmvYJE3BMM/O70w6TBVndJXJO4ZkV7kGhblLvez42lwzLyMMtA6d/X8thykUwP3QNpjSJrvDzxF+4enfNmWPveH6GPhdzDZH0b84l3dZfj239q95/sTbUQAygbyeD0kFyjuquGCofr6G/jCpRB+wYNGmRd2j83wrh6+MSq6PmehS/+EfzYde3a4jr/gWXZpd5viaZvadCaUCFgVBkFNlfdxO0CTWWdVuvHre11es1FNWOUx1WJ0GOEknn1XrEXBKGEm2z+6tw5XEZwZrNmBpxjgFvVD+L+oln/DF7ALKkYLvni6m5l2UOddE4gIENOedjWdYw0VN0AYIqwxMlrEzVcjPcH7hzS+7cu5btNpYZp/3pjB661yzbiUM6RKwVLgCOY2dttL9d1eH7QK+l9NR/ZxbjD7yqpDZ9agOUApvkbbK73dk6c5vXQrw4ynYvsNm3eB3asPCngWfiJF1TULKnkNrfojOEenpg7MmIL3xk5mSfClX6nWgdpDbKAVpKypP1bLJdj6J0tq16z+BKBpDT5hCHMdiAvyPKpbdSeze/tW9WOWon7Ql/0YZcVgxa3kKMfYHnSwr6dFUMMPrFsTSYdYc/vPrXf33RXTGWrsf3ALBHuLWvtZDhQo7cU+HduGc0bPuZTO9gp/8YmiNmE9vAZXi3r/h5gvvMrmV5Vlf9ZxI4Qy8Bt6ewl5F0YPZiOZRaN+XJgkg==
+  template:
+    metadata:
+      name: tunnel-credentials
+      namespace: net-aux
+

infra/net-aux/tunnel-token.yaml

@@ -1,14 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: tunnel-token
-  namespace: net-aux
-spec:
-  encryptedData:
-    tunnel-token: AgDp++v1aHWzqI52J7DI1xdt7h0l2aOvYSDxMuJdx1jPHSFtGFYEGwU6H5a9wJZ5A374ob4UFrrM68g6KMNImn61Vp8HDsYh33b2BdqA7JdmqE3I+HvB0I5Y85m1btIOrhcCs/+dABTv0bZD0lue2GZYWL9T8GbyUBLsD3PMrI5MXYnMFlKhpWUGweFRuDDLYTNPgaLx9tPNRYaXR3aX4gm6wdhv++u065tDhhyHgy0tMoviYmFjpLQrhnm4dHg6uzWRhbX5Z296S/kIygmf4ydh+petIeAGf87PuI/t0o94MM1uC+rx+ldvvzi+oRVXSyQ/K9JXOqqt/4cfqcIigZiT1w/DO2O8uKJZGkoKGoUhf9cCqE609iqf/tjTqa2uWl6fO/SlQWfeVz9KjRq0NWDYzYfgyMrzN4kWoAi7jYLpccGEq5YgVFNNVYbvyVjqN4lkqjPGnw7fKa4+pxbjwHwdk09KEVjVwYe/GRz6By62QKqzndZA020paJbfB99t3UcufiSW9V6/x5Jp1ekYtijeVx7BhYrzJPtyhWu2yYoB4DS674LE0oanjxfIAar6cThT4Iqxl5UPYq9hoQo1Ojcg7ALYNhgX5pHijr491e6kBAyfdq3CgCRDX9ImdYLDdAHGnd9au2cKQRbKHVylnRh37Otb1GcTMMw3pZBLcf//PAzDSbgtG7MgGQhPJrDRXA5vCcnPPACpVLeRqccAflr3NzYXzEZ8AAkgkQSu0+Ek5Gw1v+nPI3IUGvW41G2eEiddfu3nN60cxn1FoM/ctMez9gXZgEDhn7feAMYcERsmuIllD/mAqIGl04sofnBWN600s49D1+cH38simPv6tV39MFnUj1oQNr1bcEx7MzlDOyBd45DFMrNrtQIwEqU1fXWvKz6ipJKUHklaujQBCKj7a/WcqTKPBkX9Dvax4i6t6IxLhJO53AZe
-  template:
-    metadata:
-      name: tunnel-token
-      namespace: net-aux
-    type: Opaque
-