jakman85andClaude Opus 4.8
0437871807
Add Crafty Controller 4 (registry.gitlab.com/crafty-controller/crafty-4:4.10.8) as a platform component: a web panel that runs Java + Bedrock Minecraft servers as subprocesses in one pod + a 20Gi Longhorn PVC (mounted 5x by subPath). Auth = Option B (per-app oauth2-proxy reverse-proxy sidecar), since Cilium 1.16.5 cannot do ext_authz on the shared Gateway: - oauth2-proxy v7.8.1 sidecar (:4180) reverse-proxies to Crafty's self-signed HTTPS UI (127.0.0.1:8443), gated to Keycloak homelab realm group platform-admins. - Confidential `crafty` client provisioned live via kcadm + captured in the realm import; client secret + cookie secret via SOPS/age (mirrored in realm-clients). - Web UI: HTTPRoute crafty.home.keithjackson.dev -> Service :80 -> sidecar :4180. - Game ports: Cilium L2 LoadBalancer on VIP 192.168.1.55 (next free after .53/.54), starter set TCP 25565-25567 (Java) + UDP 19132-19134 (Bedrock), NOT auth-gated. - fsGroup:0 / runAsGroup:0 / runAsUser:1000 for the image's crafty:root identity on the root:root Longhorn PVC (the seerr fsGroup lesson). - Own non-gating Flux tier clusters/base/crafty.yaml (dependsOn platform-config, wait:false) + sops-decryption patch in clusters/dev — a leaf UI must never gate the platform. - Explicit default-deny NetworkPolicy + CiliumNetworkPolicies (platform namespace, not app-namespace, so Kyverno does not auto-generate the baseline). make -C ci gate green; kustomize build of platform/crafty, clusters/base, clusters/dev clean. Co-Authored-By: Claude Opus 4.8 <[email protected]>
31 lines
1.7 KiB
YAML
31 lines
1.7 KiB
YAML
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: crafty-oauth2-proxy
|
|
namespace: crafty
|
|
type: Opaque
|
|
stringData:
|
|
client-id: ENC[AES256_GCM,data:86ALvhXE,iv:S+guxBop+DkVX+SxxXObtzt5MYKVXo4NRksGPqwfUhA=,tag:Gllc0vKia1X1PFBF663apw==,type:str]
|
|
client-secret: ENC[AES256_GCM,data:0g/6FjJGHc8ndxkb9fJGvAmDWRVb7DhkC7hYubbQuncXjmo/9F33E/qMw4Zie/XOWL0hrb+OpdXETa4xH3XQeA==,iv:Wa2TPUfwBlxIntVz0cHbarGdK7SpL2KL24i1N1YYeWQ=,tag:AMEu0YI3O+4hWSJm4hsHaA==,type:str]
|
|
cookie-secret: ENC[AES256_GCM,data:FXHwQtpz1dGTV9gkzgx92Dh8yl3MbYZB/Q5Txfd9q7dbxDyKcmsOlxhAGuk=,iv:wVwcgbLEayUpDzMbTwMkT+jg3jVb/ztoqbXaKL41cVA=,tag:Q1Yl8PrkNBFg3x7OjYmCCQ==,type:str]
|
|
sops:
|
|
kms: []
|
|
gcp_kms: []
|
|
azure_kv: []
|
|
hc_vault: []
|
|
age:
|
|
- recipient: age175l8mdpdfu7hq0aml3exs3gykarwjmuvr23sq56s3wjejnyk44wsp4mfzg
|
|
enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPa2I3ZU9zQUs3bnQ0dmJx
|
|
U3o0YXoyRWdaWmRrK2tBL0JRZjU1QTNCczA4CkI5RVZJRWFrWkJyL2ZJNU9EZWRP
|
|
ZjloR3VkUjFEeE93c2lsKzJSaTVTMFkKLS0tIGhyREVqWVZSanNnOHBLak9IdTQv
|
|
S0l3WFdPMFNzT1VoaVc2QnBIQXJDVGcKkjpqUkJa7TPYfSrjOxBB3lsffEHy5Thm
|
|
KuIMdXH5oiaCwORyjyPsFg/h3NOCSgzc0dolbQzoSynYb3vztlwmdQ==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
lastmodified: "2026-08-28T20:36:54Z"
|
|
mac: ENC[AES256_GCM,data:zfv1JaZrz2eyQF6SKrTi6YfmGXpKK8miRa5RHiTsq0FPFfFP6Xc7n47RH1tZj5CRgf86wKZB3H7m6jlxZ3mdpshqK3B41sONHC3TGLdJUJt8bw/a5GbyVg+xs41aLcldylq4zrDGXq/aj9c1/lfbtd1xxIpWaNiuvvSK6y21Tmc=,iv:hF5nskThNA/uY0tvYFMwtWrPhDSUqoVX8Y10TgdIDJA=,tag:IxoUv7kbrouxXLY23cElDg==,type:str]
|
|
pgp: []
|
|
encrypted_regex: ^(data|stringData)$
|
|
version: 3.9.4
|