mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 11:36:50 +00:00
Scooby HuskyandClaude Opus 4.6
af573c647f
bitnami/kubectl has removed all version tags from Docker Hub, leaving only :latest which is blocked by Kyverno disallow-latest-tag policy. Switch to alpine/k8s:1.32.13 which has kubectl, bash, jq, and uses proper version tags. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
54 lines
2.2 KiB
YAML
54 lines
2.2 KiB
YAML
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: crowdsec-postsync
|
|
namespace: crowdsec
|
|
annotations:
|
|
argocd.argoproj.io/hook: PostSync
|
|
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
|
|
spec:
|
|
backoffLimit: 3
|
|
template:
|
|
spec:
|
|
serviceAccountName: argocd-hook-sa
|
|
containers:
|
|
- name: postsync
|
|
image: alpine/k8s:1.32.13
|
|
command:
|
|
- /bin/bash
|
|
- -c
|
|
- |
|
|
set -euo pipefail
|
|
echo "=== CrowdSec PostSync ==="
|
|
|
|
# Wait for CrowdSec LAPI
|
|
echo "Waiting for CrowdSec LAPI..."
|
|
kubectl -n crowdsec rollout status deploy/crowdsec-lapi --timeout=180s 2>/dev/null || \
|
|
echo "CrowdSec LAPI not ready yet"
|
|
|
|
# Register firewall bouncer and store key in Vault
|
|
LAPI_POD=$(kubectl -n crowdsec get pod -l app.kubernetes.io/name=crowdsec,app.kubernetes.io/component=lapi -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "")
|
|
if [ -n "$LAPI_POD" ]; then
|
|
ROOT_TOKEN=$(kubectl -n vault get secret vault-init-keys -o jsonpath='{.data.VAULT_ROOT_TOKEN}' 2>/dev/null | base64 -d)
|
|
EXISTING_KEY=""
|
|
if [ -n "$ROOT_TOKEN" ]; then
|
|
EXISTING_KEY=$(kubectl exec -n vault vault-0 -- env "VAULT_TOKEN=${ROOT_TOKEN}" \
|
|
vault kv get -field=api-key secret/crowdsec-bouncer 2>/dev/null || echo "")
|
|
fi
|
|
|
|
if [ -z "$EXISTING_KEY" ]; then
|
|
echo "Registering firewall bouncer..."
|
|
BOUNCER_KEY=$(kubectl -n crowdsec exec "$LAPI_POD" -- cscli bouncers add firewall-bouncer -o raw 2>/dev/null || echo "")
|
|
if [ -n "$BOUNCER_KEY" ] && [ -n "$ROOT_TOKEN" ]; then
|
|
kubectl exec -n vault vault-0 -- env "VAULT_TOKEN=${ROOT_TOKEN}" \
|
|
vault kv put secret/crowdsec-bouncer api-key="$BOUNCER_KEY" 2>/dev/null && \
|
|
echo " Bouncer API key stored in Vault"
|
|
fi
|
|
else
|
|
echo " Firewall bouncer key already in Vault"
|
|
fi
|
|
fi
|
|
|
|
echo "=== CrowdSec PostSync Complete ==="
|
|
restartPolicy: Never
|