Initial commit

2026-08-20 23:16:49 +00:00 · 2026-03-09 20:21:35 -05:00
commit aacb8eebbe
314 changed files with 21766 additions and 0 deletions
@@ -0,0 +1,55 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: istio-mesh-app-enrollment
+  namespace: istio-system
+  annotations:
+    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  backoffLimit: 3
+  ttlSecondsAfterFinished: 300
+  template:
+    spec:
+      serviceAccountName: argocd-hook-sa
+      restartPolicy: Never
+      containers:
+        - name: enroll
+          image: bitnami/kubectl:1.29
+          command:
+            - /bin/bash
+            - -c
+            - |
+              set -euo pipefail
+              echo "=== Enrolling app namespaces in Istio ambient mesh ==="
+
+              # Enroll app namespaces in ambient mesh
+              APP_NAMESPACES=(argocd gitlab n8n nextcloud teslamate home-assistant frigate guacamole nessus cattle-system)
+              for ns in "${APP_NAMESPACES[@]}"; do
+                echo "Enrolling $ns in ambient mesh..."
+                kubectl label namespace "$ns" istio.io/dataplane-mode=ambient --overwrite 2>/dev/null || true
+                kubectl label namespace "$ns" istio-injection- 2>/dev/null || true
+              done
+
+              # Attach waypoint proxies for L7 policy enforcement
+              echo "Attaching waypoint proxies to app namespaces..."
+              WAYPOINT_APP_NAMESPACES=(argocd gitlab n8n nextcloud teslamate home-assistant frigate guacamole nessus)
+              for ns in "${WAYPOINT_APP_NAMESPACES[@]}"; do
+                kubectl label namespace "$ns" istio.io/use-waypoint=waypoint --overwrite 2>/dev/null || true
+              done
+
+              # Annotate services for NetBird VPN resource auto-discovery
+              echo "Annotating services for NetBird VPN resource discovery..."
+              kubectl annotate svc -n gitlab gitlab-webservice-default netbird.io/resource="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n grafana grafana netbird.io/resource="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n home-assistant home-assistant netbird.io/resource="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n guacamole guacamole netbird.io/resource="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n nextcloud nextcloud netbird.io/resource="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n argocd argocd-server netbird.io/resource="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n frigate frigate netbird.io/resource="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n teslamate teslamate netbird.io/resource="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n home-assistant esphome netbird.io/resource="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n prometheus kube-prometheus-stack-prometheus netbird.io/resource="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n vault vault netbird.io/resource="true" --overwrite 2>/dev/null || true
+              echo "App namespace enrollment and NetBird annotations complete"