Initial commit

infrastructure/crowdsec/manifests/presync-job.yaml

@@ -0,0 +1,40 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: crowdsec-presync
+  namespace: crowdsec
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+spec:
+  backoffLimit: 3
+  template:
+    spec:
+      serviceAccountName: argocd-hook-sa
+      containers:
+        - name: presync
+          image: bitnami/kubectl:1.31
+          command:
+            - /bin/bash
+            - -c
+            - |
+              set -euo pipefail
+              echo "=== CrowdSec PreSync ==="
+
+              # Set PodSecurity to privileged (firewall bouncer needs host access)
+              kubectl label namespace crowdsec pod-security.kubernetes.io/enforce=privileged --overwrite 2>/dev/null || true
+
+              # Wait for CNPG cluster
+              echo "Waiting for CrowdSec PostgreSQL cluster..."
+              for i in $(seq 1 60); do
+                PHASE=$(kubectl -n crowdsec get clusters.postgresql.cnpg.io pg-crowdsec -o jsonpath='{.status.phase}' 2>/dev/null || echo "")
+                if [ "$PHASE" = "Cluster in healthy state" ] || [ "$PHASE" = "Healthy" ]; then
+                  echo "  CrowdSec PostgreSQL cluster ready"
+                  break
+                fi
+                echo "  waiting for pg-crowdsec... (attempt $i/60, phase=$PHASE)"
+                sleep 5
+              done
+
+              echo "=== CrowdSec PreSync Complete ==="
+      restartPolicy: Never