jakman85andClaude Opus 4.8
0437871807
Add Crafty Controller 4 (registry.gitlab.com/crafty-controller/crafty-4:4.10.8) as a platform component: a web panel that runs Java + Bedrock Minecraft servers as subprocesses in one pod + a 20Gi Longhorn PVC (mounted 5x by subPath). Auth = Option B (per-app oauth2-proxy reverse-proxy sidecar), since Cilium 1.16.5 cannot do ext_authz on the shared Gateway: - oauth2-proxy v7.8.1 sidecar (:4180) reverse-proxies to Crafty's self-signed HTTPS UI (127.0.0.1:8443), gated to Keycloak homelab realm group platform-admins. - Confidential `crafty` client provisioned live via kcadm + captured in the realm import; client secret + cookie secret via SOPS/age (mirrored in realm-clients). - Web UI: HTTPRoute crafty.home.keithjackson.dev -> Service :80 -> sidecar :4180. - Game ports: Cilium L2 LoadBalancer on VIP 192.168.1.55 (next free after .53/.54), starter set TCP 25565-25567 (Java) + UDP 19132-19134 (Bedrock), NOT auth-gated. - fsGroup:0 / runAsGroup:0 / runAsUser:1000 for the image's crafty:root identity on the root:root Longhorn PVC (the seerr fsGroup lesson). - Own non-gating Flux tier clusters/base/crafty.yaml (dependsOn platform-config, wait:false) + sops-decryption patch in clusters/dev — a leaf UI must never gate the platform. - Explicit default-deny NetworkPolicy + CiliumNetworkPolicies (platform namespace, not app-namespace, so Kyverno does not auto-generate the baseline). make -C ci gate green; kustomize build of platform/crafty, clusters/base, clusters/dev clean. Co-Authored-By: Claude Opus 4.8 <[email protected]>
99 lines
3.7 KiB
YAML
99 lines
3.7 KiB
YAML
---
|
|
# Default-deny baseline (R-NET-01): deny all ingress + egress, allow only DNS. `crafty` is a PLATFORM
|
|
# namespace so Kyverno does NOT auto-generate this (its policies match app-namespace=true) — we ship it
|
|
# explicitly (defense in depth), same shape as the Kyverno-generated app baseline and as
|
|
# headlamp/homepage. Cilium enforces the UNION of this NetworkPolicy and the CiliumNetworkPolicies
|
|
# below (allow if ANY policy allows), so those add the Gateway/game/world paths on top of deny-all.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: default-deny
|
|
namespace: crafty
|
|
labels:
|
|
homelab.keithjackson.dev/baseline: default-deny
|
|
spec:
|
|
podSelector: {}
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
ingress: []
|
|
egress:
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
ports:
|
|
- protocol: UDP
|
|
port: 53
|
|
- protocol: TCP
|
|
port: 53
|
|
---
|
|
# INGRESS allows. The crafty pod runs BOTH containers (oauth2-proxy sidecar :4180 + Crafty :8443 + the
|
|
# MC game-port subprocesses), all selected by app.kubernetes.io/name=crafty.
|
|
# - Gateway (Cilium `ingress` entity) -> oauth2-proxy sidecar :4180 ONLY. The Gateway can reach the
|
|
# GATE, never Crafty's :8443 directly (there is no Service for :8443 either).
|
|
# - LAN players + admins (`world` = off-cluster to Cilium) -> the raw game ports. NOT auth-gated:
|
|
# Minecraft protocols authenticate the player. `host`/`cluster` cover node-local health probes and
|
|
# any in-cluster caller.
|
|
# - `host` (the kubelet) -> :8443 and :4180 for the liveness/readiness probes.
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: crafty-allow-ingress
|
|
namespace: crafty
|
|
labels:
|
|
app.kubernetes.io/name: crafty
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: crafty
|
|
ingress:
|
|
# Gateway -> the oauth2-proxy gate. Kubelet (host) probes the gate too.
|
|
- fromEntities:
|
|
- ingress
|
|
- host
|
|
toPorts:
|
|
- ports:
|
|
- { port: "4180", protocol: TCP }
|
|
# LAN/world players -> raw game ports (starter set). Add ports here when new servers are created.
|
|
- fromEntities:
|
|
- world
|
|
- cluster
|
|
- host
|
|
toPorts:
|
|
- ports:
|
|
- { port: "25565", protocol: TCP } # Java slot 0
|
|
- { port: "25566", protocol: TCP } # Java slot 1
|
|
- { port: "25567", protocol: TCP } # Java slot 2
|
|
- { port: "19132", protocol: UDP } # Bedrock slot 0
|
|
- { port: "19133", protocol: UDP } # Bedrock slot 1
|
|
- { port: "19134", protocol: UDP } # Bedrock slot 2
|
|
# Kubelet (host) -> Crafty's HTTPS UI port for its TCP health probe.
|
|
- fromEntities:
|
|
- host
|
|
toPorts:
|
|
- ports:
|
|
- { port: "8443", protocol: TCP }
|
|
---
|
|
# EGRESS allows (DNS already permitted by the default-deny baseline above).
|
|
# - Crafty must reach the INTERNET to download Minecraft server jars (Mojang/PaperMC/Purpur/Fabric,
|
|
# Bedrock binaries) when the operator creates/updates a server.
|
|
# - The oauth2-proxy sidecar must reach Keycloak at keycloak.home.keithjackson.dev, which coredns
|
|
# split-horizon resolves to the Gateway VIP (an L2-announced LoadBalancer IP Cilium classifies as
|
|
# `world`) — so `world` egress covers both the jar downloads AND the OIDC path (same as headlamp).
|
|
# - The sidecar -> Crafty hop is pod-local (127.0.0.1:8443) and is NOT subject to network policy.
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: crafty-allow-egress
|
|
namespace: crafty
|
|
labels:
|
|
app.kubernetes.io/name: crafty
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: crafty
|
|
egress:
|
|
- toEntities:
|
|
- world
|