mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 11:36:50 +00:00
Scooby HuskyandClaude Opus 4.6
af573c647f
bitnami/kubectl has removed all version tags from Docker Hub, leaving only :latest which is blocked by Kyverno disallow-latest-tag policy. Switch to alpine/k8s:1.32.13 which has kubectl, bash, jq, and uses proper version tags. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
56 lines
3.1 KiB
YAML
56 lines
3.1 KiB
YAML
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: istio-mesh-app-enrollment
|
|
namespace: istio-system
|
|
annotations:
|
|
argocd.argoproj.io/hook: PostSync
|
|
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
|
|
argocd.argoproj.io/sync-wave: "1"
|
|
spec:
|
|
backoffLimit: 3
|
|
ttlSecondsAfterFinished: 300
|
|
template:
|
|
spec:
|
|
serviceAccountName: argocd-hook-sa
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: enroll
|
|
image: alpine/k8s:1.32.13
|
|
command:
|
|
- /bin/bash
|
|
- -c
|
|
- |
|
|
set -euo pipefail
|
|
echo "=== Enrolling app namespaces in Istio ambient mesh ==="
|
|
|
|
# Enroll app namespaces in ambient mesh
|
|
APP_NAMESPACES=(argocd gitlab n8n nextcloud teslamate home-assistant frigate guacamole nessus cattle-system)
|
|
for ns in "${APP_NAMESPACES[@]}"; do
|
|
echo "Enrolling $ns in ambient mesh..."
|
|
kubectl label namespace "$ns" istio.io/dataplane-mode=ambient --overwrite 2>/dev/null || true
|
|
kubectl label namespace "$ns" istio-injection- 2>/dev/null || true
|
|
done
|
|
|
|
# Attach waypoint proxies for L7 policy enforcement
|
|
echo "Attaching waypoint proxies to app namespaces..."
|
|
WAYPOINT_APP_NAMESPACES=(argocd gitlab n8n nextcloud teslamate home-assistant frigate guacamole nessus)
|
|
for ns in "${WAYPOINT_APP_NAMESPACES[@]}"; do
|
|
kubectl label namespace "$ns" istio.io/use-waypoint=waypoint --overwrite 2>/dev/null || true
|
|
done
|
|
|
|
# Annotate services for NetBird VPN resource auto-discovery
|
|
echo "Annotating services for NetBird VPN resource discovery..."
|
|
kubectl annotate svc -n gitlab gitlab-webservice-default netbird.io/resource="true" --overwrite 2>/dev/null || true
|
|
kubectl annotate svc -n grafana grafana netbird.io/resource="true" --overwrite 2>/dev/null || true
|
|
kubectl annotate svc -n home-assistant home-assistant netbird.io/resource="true" --overwrite 2>/dev/null || true
|
|
kubectl annotate svc -n guacamole guacamole netbird.io/resource="true" --overwrite 2>/dev/null || true
|
|
kubectl annotate svc -n nextcloud nextcloud netbird.io/resource="true" --overwrite 2>/dev/null || true
|
|
kubectl annotate svc -n argocd argocd-server netbird.io/resource="true" --overwrite 2>/dev/null || true
|
|
kubectl annotate svc -n frigate frigate netbird.io/resource="true" --overwrite 2>/dev/null || true
|
|
kubectl annotate svc -n teslamate teslamate netbird.io/resource="true" --overwrite 2>/dev/null || true
|
|
kubectl annotate svc -n home-assistant esphome netbird.io/resource="true" --overwrite 2>/dev/null || true
|
|
kubectl annotate svc -n prometheus kube-prometheus-stack-prometheus netbird.io/resource="true" --overwrite 2>/dev/null || true
|
|
kubectl annotate svc -n vault vault netbird.io/resource="true" --overwrite 2>/dev/null || true
|
|
echo "App namespace enrollment and NetBird annotations complete"
|