Initial commit

2026-08-20 23:16:49 +00:00 · 2026-03-09 20:21:35 -05:00
commit aacb8eebbe
314 changed files with 21766 additions and 0 deletions
@@ -0,0 +1,49 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: istio-mesh-infra-enrollment
+  namespace: istio-system
+  annotations:
+    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  backoffLimit: 3
+  ttlSecondsAfterFinished: 300
+  template:
+    spec:
+      serviceAccountName: argocd-hook-sa
+      restartPolicy: Never
+      containers:
+        - name: enroll
+          image: bitnami/kubectl:1.29
+          command:
+            - /bin/bash
+            - -c
+            - |
+              set -euo pipefail
+              echo "=== Enrolling infrastructure namespaces in Istio ambient mesh ==="
+
+              # Enroll infrastructure namespaces
+              # Excluded: vault (Shamir seal requires manual unseal after restart)
+              # Excluded: kube-system, istio-system, cert-manager, kyverno (system namespaces)
+              INFRA_NAMESPACES=(authentik cnpg-system redis-operator mariadb-system prometheus external-dns grafana mqtt unpoller netbird default gateway scylla-manager crowdsec)
+              for ns in "${INFRA_NAMESPACES[@]}"; do
+                echo "Enrolling $ns in ambient mesh..."
+                kubectl label namespace "$ns" istio.io/dataplane-mode=ambient --overwrite 2>/dev/null || true
+                kubectl label namespace "$ns" istio-injection- 2>/dev/null || true
+              done
+
+              # Attach waypoint proxies for L7 policy enforcement
+              echo "Attaching waypoint proxies to infrastructure namespaces..."
+              WAYPOINT_NAMESPACES=(authentik external-dns grafana mqtt unpoller netbird prometheus scylla-manager crowdsec)
+              for ns in "${WAYPOINT_NAMESPACES[@]}"; do
+                kubectl label namespace "$ns" istio.io/use-waypoint=waypoint --overwrite 2>/dev/null || true
+              done
+
+              # Deploy ext_authz Host-rewriting proxy for Authentik
+              if [ -f /tmp/ext-authz-proxy.yaml ]; then
+                kubectl apply -f /tmp/ext-authz-proxy.yaml
+              fi
+
+              echo "Infrastructure namespace enrollment complete"