jakman85andClaude Opus 4.8
0437871807
Add Crafty Controller 4 (registry.gitlab.com/crafty-controller/crafty-4:4.10.8) as a platform component: a web panel that runs Java + Bedrock Minecraft servers as subprocesses in one pod + a 20Gi Longhorn PVC (mounted 5x by subPath). Auth = Option B (per-app oauth2-proxy reverse-proxy sidecar), since Cilium 1.16.5 cannot do ext_authz on the shared Gateway: - oauth2-proxy v7.8.1 sidecar (:4180) reverse-proxies to Crafty's self-signed HTTPS UI (127.0.0.1:8443), gated to Keycloak homelab realm group platform-admins. - Confidential `crafty` client provisioned live via kcadm + captured in the realm import; client secret + cookie secret via SOPS/age (mirrored in realm-clients). - Web UI: HTTPRoute crafty.home.keithjackson.dev -> Service :80 -> sidecar :4180. - Game ports: Cilium L2 LoadBalancer on VIP 192.168.1.55 (next free after .53/.54), starter set TCP 25565-25567 (Java) + UDP 19132-19134 (Bedrock), NOT auth-gated. - fsGroup:0 / runAsGroup:0 / runAsUser:1000 for the image's crafty:root identity on the root:root Longhorn PVC (the seerr fsGroup lesson). - Own non-gating Flux tier clusters/base/crafty.yaml (dependsOn platform-config, wait:false) + sops-decryption patch in clusters/dev — a leaf UI must never gate the platform. - Explicit default-deny NetworkPolicy + CiliumNetworkPolicies (platform namespace, not app-namespace, so Kyverno does not auto-generate the baseline). make -C ci gate green; kustomize build of platform/crafty, clusters/base, clusters/dev clean. Co-Authored-By: Claude Opus 4.8 <[email protected]>
26 lines
1.4 KiB
YAML
26 lines
1.4 KiB
YAML
---
|
|
# Crafty Controller — Minecraft management panel, web UI Keycloak-gated by a per-pod oauth2-proxy
|
|
# reverse-proxy sidecar (Option B). Rendered by its OWN post-platform Flux Kustomization
|
|
# (clusters/base/crafty.yaml, dependsOn platform-config, wait:false) — NOT by the gating `platform`
|
|
# tier: a leaf UI whose pod can be legitimately unhealthy must never gate the platform chain
|
|
# (DECISIONS-LOG: "Headlamp gating stall"). Same non-gating pattern as headlamp/homepage/oauth2-proxy.
|
|
#
|
|
# The Gateway API CRs (httproute) + LoadBalancer Services travel WITH the component here: the CRDs they
|
|
# need (gateway.networking.k8s.io, cilium.io) are registered by `platform`, and `platform` is Ready
|
|
# before this tier's platform-config dependency completes, so ordering holds.
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- namespace.yaml
|
|
- pvc.yaml
|
|
- deployment.yaml
|
|
- service.yaml
|
|
# oauth2-proxy sidecar client + cookie secrets — SOPS-encrypted, decrypted per-env by the crafty
|
|
# Kustomization (clusters/dev patches it by name). Referenced by name only (R-IDP-04).
|
|
- crafty-oauth2-proxy-credentials.sops.yaml
|
|
# default-deny baseline + Cilium ingress(gateway/game)/egress(world) allows.
|
|
- networkpolicy.yaml
|
|
# web-UI ingress (crafty.home -> oauth2-proxy sidecar) + game-port L4 LoadBalancer (VIP .55).
|
|
- httproute.yaml
|
|
- service-l4.yaml
|