jakman85andClaude Opus 4.8
0437871807
Add Crafty Controller 4 (registry.gitlab.com/crafty-controller/crafty-4:4.10.8) as a platform component: a web panel that runs Java + Bedrock Minecraft servers as subprocesses in one pod + a 20Gi Longhorn PVC (mounted 5x by subPath). Auth = Option B (per-app oauth2-proxy reverse-proxy sidecar), since Cilium 1.16.5 cannot do ext_authz on the shared Gateway: - oauth2-proxy v7.8.1 sidecar (:4180) reverse-proxies to Crafty's self-signed HTTPS UI (127.0.0.1:8443), gated to Keycloak homelab realm group platform-admins. - Confidential `crafty` client provisioned live via kcadm + captured in the realm import; client secret + cookie secret via SOPS/age (mirrored in realm-clients). - Web UI: HTTPRoute crafty.home.keithjackson.dev -> Service :80 -> sidecar :4180. - Game ports: Cilium L2 LoadBalancer on VIP 192.168.1.55 (next free after .53/.54), starter set TCP 25565-25567 (Java) + UDP 19132-19134 (Bedrock), NOT auth-gated. - fsGroup:0 / runAsGroup:0 / runAsUser:1000 for the image's crafty:root identity on the root:root Longhorn PVC (the seerr fsGroup lesson). - Own non-gating Flux tier clusters/base/crafty.yaml (dependsOn platform-config, wait:false) + sops-decryption patch in clusters/dev — a leaf UI must never gate the platform. - Explicit default-deny NetworkPolicy + CiliumNetworkPolicies (platform namespace, not app-namespace, so Kyverno does not auto-generate the baseline). make -C ci gate green; kustomize build of platform/crafty, clusters/base, clusters/dev clean. Co-Authored-By: Claude Opus 4.8 <[email protected]>
37 lines
1.4 KiB
YAML
37 lines
1.4 KiB
YAML
---
|
|
# North-south ingress for the Crafty web UI at crafty.home.keithjackson.dev. Attaches to the shared
|
|
# Gateway (docs/09); TLS terminated at the Gateway by the *.home.keithjackson.dev wildcard cert (this
|
|
# host is covered). Same-namespace backend, so no ReferenceGrant; the parentRef is permitted because
|
|
# the crafty namespace carries gateway-access=shared. CR of the Gateway API CRDs — the CRDs are
|
|
# registered by `platform`, which is Ready before this tier's platform-config dependency completes.
|
|
#
|
|
# auth-mode annotation records that this route is gated by a per-app oauth2-proxy REVERSE-PROXY sidecar
|
|
# (Option B), NOT by Gateway ext_authz forward-auth (impossible on Cilium 1.16.5) and NOT native OIDC
|
|
# (Crafty has none). The backendRef is the `crafty` Service, which fronts the sidecar (:4180) — so the
|
|
# gate is IN the data path; the route needs no ext_authz filter of its own.
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: crafty
|
|
namespace: crafty
|
|
labels:
|
|
app.kubernetes.io/name: crafty
|
|
annotations:
|
|
homelab.keithjackson.dev/auth-mode: oauth2-proxy
|
|
homelab.keithjackson.dev/auth-groups: platform-admins
|
|
spec:
|
|
parentRefs:
|
|
- name: shared
|
|
namespace: gateway
|
|
sectionName: https
|
|
hostnames:
|
|
- crafty.home.keithjackson.dev
|
|
rules:
|
|
- matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|
|
backendRefs:
|
|
- name: crafty
|
|
port: 80
|