mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Scooby HuskyandClaude Opus 4.6
af573c647f
bitnami/kubectl has removed all version tags from Docker Hub, leaving only :latest which is blocked by Kyverno disallow-latest-tag policy. Switch to alpine/k8s:1.32.13 which has kubectl, bash, jq, and uses proper version tags. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
50 lines
2.1 KiB
YAML
50 lines
2.1 KiB
YAML
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: istio-mesh-infra-enrollment
|
|
namespace: istio-system
|
|
annotations:
|
|
argocd.argoproj.io/hook: PostSync
|
|
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
|
|
argocd.argoproj.io/sync-wave: "1"
|
|
spec:
|
|
backoffLimit: 3
|
|
ttlSecondsAfterFinished: 300
|
|
template:
|
|
spec:
|
|
serviceAccountName: argocd-hook-sa
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: enroll
|
|
image: alpine/k8s:1.32.13
|
|
command:
|
|
- /bin/bash
|
|
- -c
|
|
- |
|
|
set -euo pipefail
|
|
echo "=== Enrolling infrastructure namespaces in Istio ambient mesh ==="
|
|
|
|
# Enroll infrastructure namespaces
|
|
# Excluded: vault (Shamir seal requires manual unseal after restart)
|
|
# Excluded: kube-system, istio-system, cert-manager, kyverno (system namespaces)
|
|
INFRA_NAMESPACES=(authentik cnpg-system redis-operator mariadb-system prometheus external-dns grafana mqtt unpoller netbird default gateway scylla-manager crowdsec)
|
|
for ns in "${INFRA_NAMESPACES[@]}"; do
|
|
echo "Enrolling $ns in ambient mesh..."
|
|
kubectl label namespace "$ns" istio.io/dataplane-mode=ambient --overwrite 2>/dev/null || true
|
|
kubectl label namespace "$ns" istio-injection- 2>/dev/null || true
|
|
done
|
|
|
|
# Attach waypoint proxies for L7 policy enforcement
|
|
echo "Attaching waypoint proxies to infrastructure namespaces..."
|
|
WAYPOINT_NAMESPACES=(authentik external-dns grafana mqtt unpoller netbird prometheus scylla-manager crowdsec)
|
|
for ns in "${WAYPOINT_NAMESPACES[@]}"; do
|
|
kubectl label namespace "$ns" istio.io/use-waypoint=waypoint --overwrite 2>/dev/null || true
|
|
done
|
|
|
|
# Deploy ext_authz Host-rewriting proxy for Authentik
|
|
if [ -f /tmp/ext-authz-proxy.yaml ]; then
|
|
kubectl apply -f /tmp/ext-authz-proxy.yaml
|
|
fi
|
|
|
|
echo "Infrastructure namespace enrollment complete"
|