chore(apps): Add network policies to standalone apps

add-ons/postgres/cluster.yaml

@@ -40,6 +40,7 @@ spec:
       - host all all all reject
   resources:
     limits:
+      cpu: 1000m
       memory: 1Gi
     requests:
       cpu: 100m

apps/bentopdf/kustomization.yaml

@@ -4,3 +4,4 @@ resources:
   - deployment.yaml
   - service.yaml
   - httproute.yaml
+  - networkpolicy.yaml

apps/bentopdf/networkpolicy.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: bentopdf
+  namespace: bentopdf
+spec:
+  egress: []
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+      ports:
+        - port: 8080
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: bentopdf
+  policyTypes:
+    - Ingress
+    - Egress

apps/garage-ui/kustomization.yaml

@@ -4,3 +4,4 @@ resources:
   - sealed-secret.yaml
   - middleware.yaml
   - httproute.yaml
+  - networkpolicy.yaml

apps/garage-ui/networkpolicy.yaml

@@ -0,0 +1,40 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: garage-ui
+  namespace: garage
+spec:
+  egress:
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+    - ports:
+        - port: 3903
+          protocol: TCP
+      to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: garage
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+      ports:
+        - port: 8080
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: garage-ui
+  policyTypes:
+    - Ingress
+    - Egress

apps/qbit/deployment.yaml

@@ -38,6 +38,13 @@ spec:
           ports:
             - containerPort: 8080
               name: http
+          resources:
+            limits:
+              cpu: 1000m
+              memory: 2Gi
+            requests:
+              cpu: 50m
+              memory: 128Mi
           volumeMounts:
             - mountPath: /config
               name: config
@@ -104,6 +111,13 @@ spec:
             periodSeconds: 30
             timeoutSeconds: 10
           name: gluetun
+          resources:
+            limits:
+              cpu: 500m
+              memory: 256Mi
+            requests:
+              cpu: 10m
+              memory: 96Mi
           restartPolicy: Always
           securityContext:
             capabilities:

apps/qbit/kustomization.yaml

@@ -7,3 +7,4 @@ resources:
   - service.yaml
   - middleware.yaml
   - httproute.yaml
+  - networkpolicy.yaml

apps/qbit/networkpolicy.yaml

@@ -0,0 +1,28 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: qbittorrent
+  namespace: qbit
+spec:
+  egress:
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+      ports:
+        - port: 8080
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: qbittorrent
+  policyTypes:
+    - Ingress
+    - Egress

apps/rustbin/kustomization.yaml

@@ -5,3 +5,4 @@ resources:
   - deployment.yaml
   - service.yaml
   - httproute.yaml
+  - networkpolicy.yaml

apps/rustbin/networkpolicy.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: rustbin
+  namespace: rustbin
+spec:
+  egress: []
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+      ports:
+        - port: 3000
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: rustbin
+  policyTypes:
+    - Ingress
+    - Egress

apps/wireguard/deployment.yaml

@@ -71,6 +71,13 @@ spec:
               protocol: UDP
             - containerPort: 51821
               name: http
+          resources:
+            limits:
+              cpu: 500m
+              memory: 512Mi
+            requests:
+              cpu: 10m
+              memory: 192Mi
           securityContext:
             capabilities:
               add:

apps/wireguard/kustomization.yaml

@@ -7,3 +7,4 @@ resources:
   - service.yaml
   - service-admin.yaml
   - httproute.yaml
+  - networkpolicy.yaml

apps/wireguard/networkpolicy.yaml

@@ -0,0 +1,48 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: wireguard
+  namespace: wireguard
+spec:
+  egress:
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+    - to:
+        - ipBlock:
+            cidr: 192.168.2.0/24
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+  ingress:
+    - from:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+      ports:
+        - port: 27299
+          protocol: UDP
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+      ports:
+        - port: 51821
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: wireguard
+  policyTypes:
+    - Ingress
+    - Egress

argocd-apps/add-ons/authentik.yaml

@@ -39,6 +39,7 @@ spec:
           server:
             resources:
               limits:
+                cpu: 1000m
                 memory: 1Gi
               requests:
                 cpu: 100m
@@ -46,6 +47,7 @@ spec:
           worker:
             resources:
               limits:
+                cpu: 1000m
                 memory: 1Gi
               requests:
                 cpu: 50m

argocd-apps/add-ons/cert-manager.yaml

@@ -22,6 +22,29 @@ spec:
             kind: ControllerConfiguration
             featureGates:
               ExperimentalGatewayAPISupport: true
+          resources:
+            limits:
+              cpu: 200m
+              memory: 256Mi
+            requests:
+              cpu: 10m
+              memory: 64Mi
+          cainjector:
+            resources:
+              limits:
+                cpu: 200m
+                memory: 256Mi
+              requests:
+                cpu: 10m
+                memory: 64Mi
+          webhook:
+            resources:
+              limits:
+                cpu: 200m
+                memory: 128Mi
+              requests:
+                cpu: 10m
+                memory: 32Mi
       repoURL: https://charts.jetstack.io
       targetRevision: v1.21.2
     - path: add-ons/cert-manager

argocd-apps/add-ons/cnpg.yaml

@@ -18,6 +18,13 @@ spec:
         replicaCount: 1
         config:
           clusterWide: true
+        resources:
+          limits:
+            cpu: 500m
+            memory: 256Mi
+          requests:
+            cpu: 10m
+            memory: 64Mi
     repoURL: https://cloudnative-pg.github.io/charts
     targetRevision: 0.29.1
   syncPolicy:

argocd-apps/add-ons/kube-prometheus-stack.yaml

@@ -170,7 +170,7 @@ spec:
             resources:
               limits:
                 cpu: 500m
-                memory: 512Mi
+                memory: 768Mi
               requests:
                 cpu: 50m
                 memory: 256Mi

argocd-apps/add-ons/sealed-secrets.yaml

@@ -16,6 +16,13 @@ spec:
     helm:
       values: |
         keyrenewperiod: "0"
+        resources:
+          limits:
+            cpu: 200m
+            memory: 128Mi
+          requests:
+            cpu: 10m
+            memory: 32Mi
     repoURL: https://bitnami.github.io/sealed-secrets
     targetRevision: 2.20.0
   syncPolicy:

argocd-apps/add-ons/traefik.yaml

@@ -61,6 +61,13 @@ spec:
                   - kind: Secret
                     name: wildcard-whyredfire-dpdns-org
                     group: ""
+          resources:
+            limits:
+              cpu: 1000m
+              memory: 256Mi
+            requests:
+              cpu: 50m
+              memory: 64Mi
       repoURL: https://traefik.github.io/charts
       targetRevision: 41.7.1
     - path: add-ons/traefik

argocd-apps/apps/garage.yaml

@@ -78,6 +78,7 @@ spec:
               cpu: 100m
               memory: 256Mi
             limits:
+              cpu: 1000m
               memory: 1Gi
     - path: apps/garage
       repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git

argocd-apps/apps/jellyfin.yaml

@@ -30,6 +30,35 @@ spec:
               enabled: true
               type: hostPath
               hostPath: /srv/media
+          # Metadata, artwork, and subtitles come from the internet; the
+          # cluster and the LAN stay off limits
+          networkPolicy:
+            enabled: true
+            ingress:
+              allowExternal: false
+              namespaceSelector:
+                matchLabels:
+                  kubernetes.io/metadata.name: traefik
+            egress:
+              allowAllEgress: false
+              restrictedEgress:
+                allowMetadata: false
+                allowInCluster: false
+              customRules:
+                - to:
+                    - ipBlock:
+                        cidr: 0.0.0.0/0
+                        except:
+                          - 10.0.0.0/8
+                          - 172.16.0.0/12
+                          - 192.168.0.0/16
+          resources:
+            limits:
+              cpu: 3000m
+              memory: 2Gi
+            requests:
+              cpu: 50m
+              memory: 512Mi
       repoURL: https://jellyfin.github.io/jellyfin-helm
       targetRevision: 3.2.0
     - path: apps/jellyfin

bootstrap/argocd-resources-patch.yaml

@@ -0,0 +1,120 @@
+# Sized from about five days of usage: requests near the average, limits
+# with headroom over the peak
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: argocd-application-controller
+spec:
+  template:
+    spec:
+      containers:
+        - name: argocd-application-controller
+          resources:
+            limits:
+              cpu: 1000m
+              memory: 1Gi
+            requests:
+              cpu: 50m
+              memory: 384Mi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-applicationset-controller
+spec:
+  template:
+    spec:
+      containers:
+        - name: argocd-applicationset-controller
+          resources:
+            limits:
+              cpu: 200m
+              memory: 128Mi
+            requests:
+              cpu: 10m
+              memory: 32Mi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-dex-server
+spec:
+  template:
+    spec:
+      containers:
+        - name: dex
+          resources:
+            limits:
+              cpu: 200m
+              memory: 128Mi
+            requests:
+              cpu: 10m
+              memory: 32Mi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-notifications-controller
+spec:
+  template:
+    spec:
+      containers:
+        - name: argocd-notifications-controller
+          resources:
+            limits:
+              cpu: 200m
+              memory: 128Mi
+            requests:
+              cpu: 10m
+              memory: 32Mi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-redis
+spec:
+  template:
+    spec:
+      containers:
+        - name: redis
+          resources:
+            limits:
+              cpu: 200m
+              memory: 128Mi
+            requests:
+              cpu: 10m
+              memory: 16Mi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-repo-server
+spec:
+  template:
+    spec:
+      containers:
+        - name: argocd-repo-server
+          resources:
+            limits:
+              cpu: 1000m
+              memory: 512Mi
+            requests:
+              cpu: 10m
+              memory: 128Mi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-server
+spec:
+  template:
+    spec:
+      containers:
+        - name: argocd-server
+          resources:
+            limits:
+              cpu: 500m
+              memory: 256Mi
+            requests:
+              cpu: 10m
+              memory: 64Mi

bootstrap/kustomization.yaml

@@ -37,3 +37,4 @@ patches:
       kind: ConfigMap
       name: argocd-cmd-params-cm
     path: argocd-cmd-params-cm-server-insecure-patch.yaml
+  - path: argocd-resources-patch.yaml