Initial commit

2026-08-21 05:26:49 +00:00 · 2026-03-09 20:21:35 -05:00
commit aacb8eebbe
314 changed files with 21766 additions and 0 deletions
@@ -0,0 +1,53 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: crowdsec-postsync
+  namespace: crowdsec
+  annotations:
+    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+spec:
+  backoffLimit: 3
+  template:
+    spec:
+      serviceAccountName: argocd-hook-sa
+      containers:
+        - name: postsync
+          image: bitnami/kubectl:1.31
+          command:
+            - /bin/bash
+            - -c
+            - |
+              set -euo pipefail
+              echo "=== CrowdSec PostSync ==="
+
+              # Wait for CrowdSec LAPI
+              echo "Waiting for CrowdSec LAPI..."
+              kubectl -n crowdsec rollout status deploy/crowdsec-lapi --timeout=180s 2>/dev/null || \
+                echo "CrowdSec LAPI not ready yet"
+
+              # Register firewall bouncer and store key in Vault
+              LAPI_POD=$(kubectl -n crowdsec get pod -l app.kubernetes.io/name=crowdsec,app.kubernetes.io/component=lapi -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "")
+              if [ -n "$LAPI_POD" ]; then
+                ROOT_TOKEN=$(kubectl -n vault get secret vault-init-keys -o jsonpath='{.data.VAULT_ROOT_TOKEN}' 2>/dev/null | base64 -d)
+                EXISTING_KEY=""
+                if [ -n "$ROOT_TOKEN" ]; then
+                  EXISTING_KEY=$(kubectl exec -n vault vault-0 -- env "VAULT_TOKEN=${ROOT_TOKEN}" \
+                    vault kv get -field=api-key secret/crowdsec-bouncer 2>/dev/null || echo "")
+                fi
+
+                if [ -z "$EXISTING_KEY" ]; then
+                  echo "Registering firewall bouncer..."
+                  BOUNCER_KEY=$(kubectl -n crowdsec exec "$LAPI_POD" -- cscli bouncers add firewall-bouncer -o raw 2>/dev/null || echo "")
+                  if [ -n "$BOUNCER_KEY" ] && [ -n "$ROOT_TOKEN" ]; then
+                    kubectl exec -n vault vault-0 -- env "VAULT_TOKEN=${ROOT_TOKEN}" \
+                      vault kv put secret/crowdsec-bouncer api-key="$BOUNCER_KEY" 2>/dev/null && \
+                      echo "  Bouncer API key stored in Vault"
+                  fi
+                else
+                  echo "  Firewall bouncer key already in Vault"
+                fi
+              fi
+
+              echo "=== CrowdSec PostSync Complete ==="
+      restartPolicy: Never