feat(apps): Enable network policies for redoost

apps/garage-ui/anubis-key-sealedsecret.yaml

@@ -1,12 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: anubis-key
-  namespace: garage
-spec:
-  encryptedData:
-    ED25519_PRIVATE_KEY_HEX: AgCviDZEvLfdKldhAtWubXmCxvCym6nEFBERMBDbfMftsCQdRdWFwAZ3IkQF5PqyBCjZ8jirQMttmXqL1GNKvJfEDkK4rwwYGkLpRM56IpRtkGhGHgYQOIYTa9RHzJm5OjPKnVppCRpb4Qe2MKczg8Uhp7Z3hW1HMDzK85Rzn2k41qcGqMRwEgDdmFVJxB9gviM76jcrgjnyNJvoIMinNwqRdTHmXnY451xDkBofEzkTXZC7plW42/3Vz/66bdqtHCmM68hZJkluki86ubHJqPIMuA55BJM7CRJTgKhk5va4Ex3j4RlTSF7ai+EGmF+jq6ls8Dn1QU12Osak97MulOEyCBHBQg3nnu5TZoFJKWT/Bgg0M9r1RuFyr6mrphVu6yMIIiROcyl95E3LjtMVC4o7+tWgkYmIOjYafQdpf7p6I2QPG4P6o/6qkEUWL1tqqYjk9RZ+OuOuBWe399in4OnRgfV+ZOJcCKXIsgbW1uVAiQL3lGMGI9/sDLxKtimpybGOX5F9f3O7mqFZ7FzkdvhgUtWkY+PUJIZHFNUSlF+ttmrj3wtq4JOpFdPYZqcnTCFFtwk+yDos8YWWjF0TX1RhM8Yq/+VBOVVaJnlhaolIKHiMds5JBGypsPjEBmP9fJ1ip4TjCyCP3p1/YscksgqjUWOCeASO9b50ce0OJzL9yHMGurffianLWR768q/1Zi5WQv6B9vJxCICa9TCCYgLOz0LUu0iiMd5hlPX0/i4gWi9KykIcSYHJ/RuE9+4jaqkYsTyhOipKPpkpjsqou9y1
-  template:
-    metadata:
-      name: anubis-key
-      namespace: garage

apps/garage-ui/anubis-proxy.yaml

@@ -1,44 +0,0 @@
-apiVersion: anubis.techaro.dev/v1alpha1
-kind: AnubisProxy
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  name: anubis
-  namespace: garage
-spec:
-  anubis:
-    envExtra:
-      - name: DIFFICULTY
-        value: "5"
-      - name: SERVE_ROBOTS_TXT
-        value: "true"
-      - name: COOKIE_DOMAIN
-        value: garage.whyredfire.dev
-      - name: REDIRECT_DOMAINS
-        value: garage.whyredfire.dev
-      - name: COOKIE_PARTITIONED
-        value: "true"
-      - name: COOKIE_HTTP_ONLY
-        value: "true"
-      - name: COOKIE_SAME_SITE
-        value: Lax
-      - name: DIFFICULTY_IN_JWT
-        value: "true"
-    image:
-      tag: v1.26.2
-    keys:
-      existingSecret: anubis-key
-    metrics:
-      enabled: false
-    persistence:
-      enabled: false
-    resources:
-      limits:
-        memory: 128Mi
-      requests:
-        cpu: 50m
-        memory: 64Mi
-  target:
-    service:
-      name: garage-ui
-      port: 80

apps/garage-ui/httproute.yaml

@@ -15,8 +15,22 @@ spec:
       sectionName: websecure
   rules:
     - backendRefs:
-        - name: anubis
+        - name: authentik-server
+          namespace: authentik
           port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /outpost.goauthentik.io
+    - backendRefs:
+        - name: garage-ui
+          port: 80
+      filters:
+        - extensionRef:
+            group: traefik.io
+            kind: Middleware
+            name: authentik
+          type: ExtensionRef
       matches:
         - path:
             type: PathPrefix

apps/garage-ui/kustomization.yaml

@@ -2,6 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - sealed-secret.yaml
-  - anubis-key-sealedsecret.yaml
+  - middleware.yaml
-  - anubis-proxy.yaml
   - httproute.yaml

apps/garage-ui/middleware.yaml

@@ -0,0 +1,17 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: authentik
+  namespace: garage
+spec:
+  forwardAuth:
+    address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+    trustForwardHeader: true

apps/redoost/anubis-key-sealedsecret.yaml

@@ -1,12 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: anubis-key
-  namespace: redoost
-spec:
-  encryptedData:
-    ED25519_PRIVATE_KEY_HEX: AgBM3dp5L0MgvKQxGM0ljAHXqhTDcebV8emcKAeWbIdWn/749Dz4W5n0e3JuFEm7cHwl5nSomY6iccM1aX2h77u8ip8PBB4SWvnj0ymDEDPii3p4Z50tz9qkWU+IzqJiXcOX75NdVVaTsbzRARW/0+V8Df0/1T6C2xTIXITqlWoxsLlXwREdTdwBiSosuMUYDbXAAiNOVZ6B8yQgT/J9kjS9quUD3T9/nYet8iinJ+4AuCD3Ib/M0KQY+/pMQbhOfsBP8MdP2vDUoh05sh5G3N+sRju0ROHLK53KrqNkn0ROxPIW5zs+WmBaG92HALjojJbWQbvlDjs+IpeUDnBRz8hZ7jmz60X1+nqSm/nMUKvTh3IS9+gQwxtt+ModWETj69yKcx0DXi4Q/hMi+LvFBULcmU0VDvu0uOvnbR3J873Bj/1PlF0VSWGdOL7J18GXWwMLVoo2rrRU/sbntasiScbxs9HPqGmkdWGOObbgb9eSdrlN9AK1EmeGOkYcwx9WMML/40TfhxjObkK9Cp5yJ+z8F/zeIEYW51PEeqGWvwgKomLSeOy3BDFaqI09VUa3+6jp/+QB3CSdWLZlEGdKVu1OKLS7W8aOLH6MDIpPQ33JJcbW1SoZvm6MbKlSCdpOvNg7zZb6o7qtrfi9RmAiO5lv+4AQ5o/RSpfL5EElXULOjef/XajT5yhIiIJ6ZaRT5f6kVZcQZx2dkhp1cfrIfzGEdQX0Lnc+2Uq06+oUrplO/wwM+2qTD3XI6qGecnC10zBwq8A3rD2QXOi4vWXPL1K3
-  template:
-    metadata:
-      name: anubis-key
-      namespace: redoost

apps/redoost/anubis-proxy-api.yaml

@@ -1,44 +0,0 @@
-apiVersion: anubis.techaro.dev/v1alpha1
-kind: AnubisProxy
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  name: anubis-api
-  namespace: redoost
-spec:
-  anubis:
-    envExtra:
-      - name: DIFFICULTY
-        value: "5"
-      - name: SERVE_ROBOTS_TXT
-        value: "true"
-      - name: COOKIE_DOMAIN
-        value: redoost.whyredfire.dev
-      - name: REDIRECT_DOMAINS
-        value: redoost.whyredfire.dev
-      - name: COOKIE_PARTITIONED
-        value: "true"
-      - name: COOKIE_HTTP_ONLY
-        value: "true"
-      - name: COOKIE_SAME_SITE
-        value: Lax
-      - name: DIFFICULTY_IN_JWT
-        value: "true"
-    image:
-      tag: v1.26.2
-    keys:
-      existingSecret: anubis-key
-    metrics:
-      enabled: false
-    persistence:
-      enabled: false
-    resources:
-      limits:
-        memory: 128Mi
-      requests:
-        cpu: 50m
-        memory: 64Mi
-  target:
-    service:
-      name: redoost-api
-      port: 8000

apps/redoost/anubis-proxy-frontend.yaml

@@ -1,46 +0,0 @@
-apiVersion: anubis.techaro.dev/v1alpha1
-kind: AnubisProxy
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  name: anubis-frontend
-  namespace: redoost
-spec:
-  anubis:
-    envExtra:
-      - name: DIFFICULTY
-        value: "5"
-      - name: SERVE_ROBOTS_TXT
-        value: "true"
-      - name: COOKIE_DOMAIN
-        value: redoost.whyredfire.dev
-      - name: REDIRECT_DOMAINS
-        value: redoost.whyredfire.dev
-      - name: COOKIE_PARTITIONED
-        value: "true"
-      - name: COOKIE_HTTP_ONLY
-        value: "true"
-      - name: COOKIE_SAME_SITE
-        value: Lax
-      - name: DIFFICULTY_IN_JWT
-        value: "true"
-      - name: OG_PASSTHROUGH
-        value: "true"
-    image:
-      tag: v1.26.2
-    keys:
-      existingSecret: anubis-key
-    metrics:
-      enabled: false
-    persistence:
-      enabled: false
-    resources:
-      limits:
-        memory: 128Mi
-      requests:
-        cpu: 50m
-        memory: 64Mi
-  target:
-    service:
-      name: redoost-frontend
-      port: 8080

apps/redoost/kustomization.yaml

@@ -2,6 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - sealed-secret.yaml
-  - anubis-key-sealedsecret.yaml
-  - anubis-proxy-api.yaml
-  - anubis-proxy-frontend.yaml

argocd-apps/add-ons/anubis-operator.yaml

@@ -3,6 +3,8 @@ kind: Application
 metadata:
   annotations:
     argocd.argoproj.io/sync-wave: "1"
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
   name: anubis-operator
   namespace: argocd
 spec:

argocd-apps/add-ons/kustomization.yaml

@@ -1,7 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - anubis-operator.yaml
   - argocd-dashboard.yaml
   - argocd-repos.yaml
   - authentik.yaml

argocd-apps/services/garage-ui.yaml

@@ -27,9 +27,7 @@ spec:
                 name: garage-ui-secrets
             auth:
               admin:
-                enabled: true
+                enabled: false
-                existingSecret:
-                  name: garage-ui-secrets
               jwt_private_key_secret:
                 name: garage-ui-secrets
             cors:

argocd-apps/services/redoost.yaml

@@ -27,12 +27,6 @@ spec:
                   name: traefik-gateway
                   namespace: traefik
                   sectionName: websecure
-              apiBackendRef:
-                name: anubis-api
-                port: 80
-              frontendBackendRef:
-                name: anubis-frontend
-                port: 80
             sites:
               parentRefs:
                 - kind: Gateway
@@ -45,6 +39,19 @@ spec:
             websiteUpstream: garage.garage.svc.cluster.local:3902
             bucket: redoost-sites
             existingSecret: redoost-s3
+          networkPolicy:
+            enabled: true
+            gateway:
+              - namespaceSelector:
+                  matchLabels:
+                    kubernetes.io/metadata.name: traefik
+            s3:
+              - namespaceSelector:
+                  matchLabels:
+                    kubernetes.io/metadata.name: garage
+                podSelector:
+                  matchLabels:
+                    app.kubernetes.io/name: garage
     - path: apps/redoost
       repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
       targetRevision: main

bootstrap/argocd-cm-admin-disabled-patch.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cm
+data:
+  admin.enabled: "false"

bootstrap/argocd-cm-oidc-patch.yaml

@@ -8,6 +8,7 @@ data:
     issuer: https://auth.whyredfire.dev/application/o/argocd/
     clientID: argocd
     clientSecret: $argocd-oidc:clientSecret
+    enablePKCEAuthentication: true
     requestedScopes:
       - openid
       - profile

bootstrap/kustomization.yaml

@@ -21,6 +21,10 @@ patches:
       kind: ConfigMap
       name: argocd-cm
     path: argocd-cm-oidc-patch.yaml
+  - target:
+      kind: ConfigMap
+      name: argocd-cm
+    path: argocd-cm-admin-disabled-patch.yaml
   - target:
       kind: ConfigMap
       name: argocd-rbac-cm

infra/argocd-dashboard/anubis-key-sealedsecret.yaml

@@ -1,12 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: anubis-key
-  namespace: argocd
-spec:
-  encryptedData:
-    ED25519_PRIVATE_KEY_HEX: AgCR+UcOTNv+hAcK3jE3fb0AE5lQBuxl0Y7Yqt3Lg/Bhh89aPH2dRs0o2n/1MuCXNGOtBAXdyKtW6W3VtenD1uKsoz8da2UjO3+qvknLmrZzUqjcilmiJCS7POoECHhciCMJu1RrLkSQChjg+Kl6fZUbDSTK5GTh75yy7o1uRtXqbgXFtdVDYA8fwXLoAG4nWlSgRgGTUnTKTKooyx+ADEJOQWrFCP0zFkZJKUcGc60d6+5PyYGODDNjh1qed30O7xWyZcCVVUzeSkH5QCpBvALRzKLGBRjNTHAS4IGVelemPqsN5ti4w6fYGtkqi4OPuAuaC47kdEnLUvZeDB+Qxnwx6Qe7MEI4u8H2N6mP8jMH9MjQv4gzCTtPy90Vqikf7hJ0KFsI5CGXONbQkkyM1B3MNbyqkgmtZJchVbmeN9MZhZOS7JYUuexYosdiqRvyIOAWr1/rSN9LzwesXNAPojq8IZPDjIPcbFCBv1ROjsS/kXKawlLBMX+XEsQZUWUfTh9Cfn3N9muo4Sz+nQ11smXthSkVRaniJLIsd+MPXg/lHayP6MYWncPhj8ZZQHKwBNxsCHljh1cFsjfm/IrIDmre6eaREnsBrxh7QKtsoiWWclqgF4ziA4BVWHwkfpb1LjIQNDIkD+i66ijOmwpQoiCD8tWRKrvcGWy6bTDPMO0ErA5QVzDx8YMFmSC5Ii0iSWIR2ci+qlKgUHFedVnp2kOw4FyOxWsDnfJDBmwyPvXrfrbDcvSfKMTLn6VohWC4Zais5bIuhD0uAmCdfJzyRe+H
-  template:
-    metadata:
-      name: anubis-key
-      namespace: argocd

infra/argocd-dashboard/anubis-proxy.yaml

@@ -1,44 +0,0 @@
-apiVersion: anubis.techaro.dev/v1alpha1
-kind: AnubisProxy
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  name: anubis
-  namespace: argocd
-spec:
-  anubis:
-    envExtra:
-      - name: DIFFICULTY
-        value: "5"
-      - name: SERVE_ROBOTS_TXT
-        value: "true"
-      - name: COOKIE_DOMAIN
-        value: argo.whyredfire.dev
-      - name: REDIRECT_DOMAINS
-        value: argo.whyredfire.dev
-      - name: COOKIE_PARTITIONED
-        value: "true"
-      - name: COOKIE_HTTP_ONLY
-        value: "true"
-      - name: COOKIE_SAME_SITE
-        value: Lax
-      - name: DIFFICULTY_IN_JWT
-        value: "true"
-    image:
-      tag: v1.26.2
-    keys:
-      existingSecret: anubis-key
-    metrics:
-      enabled: false
-    persistence:
-      enabled: false
-    resources:
-      limits:
-        memory: 128Mi
-      requests:
-        cpu: 50m
-        memory: 64Mi
-  target:
-    service:
-      name: argocd-server
-      port: 80

infra/argocd-dashboard/httproute.yaml

@@ -15,7 +15,7 @@ spec:
       sectionName: websecure
   rules:
     - backendRefs:
-        - name: anubis
+        - name: argocd-server
           port: 80
       matches:
         - path:

infra/argocd-dashboard/kustomization.yaml

@@ -1,7 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - anubis-key-sealedsecret.yaml
-  - anubis-proxy.yaml
   - httproute.yaml
   - oidc-sealedsecret.yaml

infra/authentik/blueprints.yaml

@@ -4,18 +4,11 @@ metadata:
   name: authentik-blueprints
   namespace: authentik
 data:
-  # Google is the only way in: its source has no enrollment flow, so a Google
-  # account can only log in when a user with the same email already exists.
   google-login.yaml: |
     version: 1
     metadata:
       name: Google login
     entries:
-      - model: authentik_blueprints.metaapplyblueprint
-        attrs:
-          identifiers:
-            path: default/flow-default-authentication-flow.yaml
-          required: true
       - model: authentik_blueprints.metaapplyblueprint
         attrs:
           identifiers:
@@ -48,8 +41,29 @@ data:
           provider_type: google
           user_matching_mode: email_link
       - model: authentik_stages_identification.identificationstage
+        id: google-identification
         identifiers:
-          name: default-authentication-identification
+          name: google-identification
         attrs:
           sources:
             - !KeyOf google
+          user_fields: []
+      - model: authentik_flows.flow
+        id: google-flow
+        identifiers:
+          slug: google-login
+        attrs:
+          authentication: require_unauthenticated
+          designation: authentication
+          name: Google login
+          title: Welcome!
+      - model: authentik_flows.flowstagebinding
+        identifiers:
+          order: 10
+          stage: !KeyOf google-identification
+          target: !KeyOf google-flow
+      - model: authentik_brands.brand
+        identifiers:
+          domain: authentik-default
+        attrs:
+          flow_authentication: !KeyOf google-flow

infra/authentik/httproute.yaml

@@ -14,6 +14,20 @@ spec:
       namespace: traefik
       sectionName: websecure
   rules:
+    # The ArgoCD Android app posts to the token endpoint without its trailing slash
+    - backendRefs:
+        - name: authentik-server
+          port: 80
+      filters:
+        - type: URLRewrite
+          urlRewrite:
+            path:
+              replaceFullPath: /application/o/token/
+              type: ReplaceFullPath
+      matches:
+        - path:
+            type: Exact
+            value: /application/o/token
     - backendRefs:
         - name: authentik-server
           port: 80

infra/authentik/kustomization.yaml

@@ -4,3 +4,4 @@ resources:
   - sealed-secret.yaml
   - blueprints.yaml
   - httproute.yaml
+  - referencegrant.yaml

infra/authentik/referencegrant.yaml

@@ -0,0 +1,17 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: outpost
+  namespace: authentik
+spec:
+  from:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: garage
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: qbit
+  to:
+    - group: ""
+      kind: Service
+      name: authentik-server