jakman85andClaude Opus 4.8
0437871807
Add Crafty Controller 4 (registry.gitlab.com/crafty-controller/crafty-4:4.10.8) as a platform component: a web panel that runs Java + Bedrock Minecraft servers as subprocesses in one pod + a 20Gi Longhorn PVC (mounted 5x by subPath). Auth = Option B (per-app oauth2-proxy reverse-proxy sidecar), since Cilium 1.16.5 cannot do ext_authz on the shared Gateway: - oauth2-proxy v7.8.1 sidecar (:4180) reverse-proxies to Crafty's self-signed HTTPS UI (127.0.0.1:8443), gated to Keycloak homelab realm group platform-admins. - Confidential `crafty` client provisioned live via kcadm + captured in the realm import; client secret + cookie secret via SOPS/age (mirrored in realm-clients). - Web UI: HTTPRoute crafty.home.keithjackson.dev -> Service :80 -> sidecar :4180. - Game ports: Cilium L2 LoadBalancer on VIP 192.168.1.55 (next free after .53/.54), starter set TCP 25565-25567 (Java) + UDP 19132-19134 (Bedrock), NOT auth-gated. - fsGroup:0 / runAsGroup:0 / runAsUser:1000 for the image's crafty:root identity on the root:root Longhorn PVC (the seerr fsGroup lesson). - Own non-gating Flux tier clusters/base/crafty.yaml (dependsOn platform-config, wait:false) + sops-decryption patch in clusters/dev — a leaf UI must never gate the platform. - Explicit default-deny NetworkPolicy + CiliumNetworkPolicies (platform namespace, not app-namespace, so Kyverno does not auto-generate the baseline). make -C ci gate green; kustomize build of platform/crafty, clusters/base, clusters/dev clean. Co-Authored-By: Claude Opus 4.8 <[email protected]>
38 lines
2.0 KiB
Plaintext
38 lines
2.0 KiB
Plaintext
# =============================================================================
|
|
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize and never
|
|
# auto-encrypted by SOPS). Reference scaffold + OPERATOR HAND-OFF.
|
|
#
|
|
# WHAT THIS IS: the OIDC client + cookie secrets for the per-app oauth2-proxy SIDECAR that gates the
|
|
# Crafty web UI (deployment.yaml, container `oauth2-proxy`). The sidecar reads these three keys as
|
|
# OAUTH2_PROXY_CLIENT_ID / OAUTH2_PROXY_CLIENT_SECRET / OAUTH2_PROXY_COOKIE_SECRET (env, by name only;
|
|
# R-IDP-04). SOPS-encrypted; keys stay cleartext for reviewable diffs.
|
|
#
|
|
# The `client-secret` value MUST equal the `crafty-client-secret` placed in
|
|
# platform/keycloak/keycloak-realm-clients.sops.yaml (which the realm import injects into the Keycloak
|
|
# `crafty` client) — same cross-namespace mirror pattern as grafana/gitea/headlamp (a Secret cannot be
|
|
# shared across namespaces, so the one value is stored in two encrypted files).
|
|
#
|
|
# HAND-OFF STEPS (operator):
|
|
# (a) client-id is fixed: `crafty` (matches the Keycloak client).
|
|
# (b) client-secret: use the SAME value generated for keycloak-realm-clients crafty-client-secret
|
|
# openssl rand -hex 32
|
|
# (c) cookie-secret: a fresh random 32-byte value, url-safe base64:
|
|
# openssl rand -base64 32 | tr -- '+/' '-_'
|
|
# (d) Copy to: platform/crafty/crafty-oauth2-proxy-credentials.sops.yaml
|
|
# (e) Fill values; encrypt:
|
|
# sops -e -i platform/crafty/crafty-oauth2-proxy-credentials.sops.yaml
|
|
# (f) It is already listed under `resources:` in platform/crafty/kustomization.yaml.
|
|
# =============================================================================
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: crafty-oauth2-proxy
|
|
namespace: crafty
|
|
type: Opaque
|
|
stringData:
|
|
client-id: crafty
|
|
# MUST match keycloak-realm-clients crafty-client-secret.
|
|
client-secret: REPLACE-ME
|
|
# Random 32-byte url-safe-base64 cookie signing secret (oauth2-proxy).
|
|
cookie-secret: REPLACE-ME
|