jakman85
e843db2601
First app onboarded through catalog/render.py -> apps/. Added --no-image-automation so apps deploy before the Flux image controllers exist (L1 goldens keep the default, unchanged). KNOWN GAP surfaced: exposed apps get default-deny (ingress: []) with no gateway-ingress allow, so the HTTPRoute path is blocked — renderer/WS-NET follow-up to allow Cilium gateway ingress to services with an exposure/HTTPRoute.
175 lines
3.6 KiB
YAML
175 lines
3.6 KiB
YAML
---
|
|
# Namespace (trust zone; default-deny + policies apply)
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: pihole
|
|
labels:
|
|
homelab.keithjackson.dev/app-namespace: 'true'
|
|
gateway-access: shared
|
|
annotations:
|
|
homelab.keithjackson.dev/backup-policy: daily-offcluster
|
|
---
|
|
# Default-deny baseline (R-NET-01): deny all, allow only DNS
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: default-deny
|
|
namespace: pihole
|
|
labels:
|
|
homelab.keithjackson.dev/baseline: default-deny
|
|
spec:
|
|
podSelector: {}
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
ingress: []
|
|
egress:
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
ports:
|
|
- protocol: UDP
|
|
port: 53
|
|
- protocol: TCP
|
|
port: 53
|
|
---
|
|
# PVC pihole-config (R-STATE)
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: pihole-config
|
|
namespace: pihole
|
|
labels:
|
|
app.kubernetes.io/name: pihole
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
storageClassName: longhorn
|
|
resources:
|
|
requests:
|
|
storage: 2Gi
|
|
---
|
|
# Deployment (R-PLAT-02)
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: pihole
|
|
namespace: pihole
|
|
labels:
|
|
app.kubernetes.io/name: pihole
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: pihole
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: pihole
|
|
homelab.keithjackson.dev/egress-class: internet
|
|
homelab.keithjackson.dev/auth-mode: forward-auth
|
|
annotations:
|
|
homelab.keithjackson.dev/auth-mode: forward-auth
|
|
homelab.keithjackson.dev/auth-groups: platform-admins
|
|
spec:
|
|
containers:
|
|
- name: pihole
|
|
image: pihole/pihole
|
|
ports:
|
|
- containerPort: 80
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /data/config
|
|
volumes:
|
|
- name: config
|
|
persistentVolumeClaim:
|
|
claimName: pihole-config
|
|
---
|
|
# Service
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: pihole
|
|
namespace: pihole
|
|
labels:
|
|
app.kubernetes.io/name: pihole
|
|
spec:
|
|
selector:
|
|
app.kubernetes.io/name: pihole
|
|
ports:
|
|
- name: port-80
|
|
port: 80
|
|
targetPort: 80
|
|
---
|
|
# HTTPRoute pihole-80 (R-TLS/R-DNS)
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: pihole-80
|
|
namespace: pihole
|
|
labels:
|
|
app.kubernetes.io/name: pihole
|
|
annotations:
|
|
homelab.keithjackson.dev/auth-mode: forward-auth
|
|
homelab.keithjackson.dev/auth-groups: platform-admins
|
|
spec:
|
|
parentRefs:
|
|
- name: shared
|
|
namespace: gateway
|
|
sectionName: https
|
|
hostnames:
|
|
- pihole.home.keithjackson.dev
|
|
rules:
|
|
- matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|
|
backendRefs:
|
|
- name: pihole
|
|
port: 80
|
|
---
|
|
# ServiceMonitor (R-OBS-01)
|
|
apiVersion: monitoring.coreos.com/v1
|
|
kind: ServiceMonitor
|
|
metadata:
|
|
name: pihole
|
|
namespace: pihole
|
|
labels:
|
|
release: kube-prometheus-stack
|
|
app.kubernetes.io/name: pihole
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: pihole
|
|
namespaceSelector:
|
|
matchNames:
|
|
- pihole
|
|
endpoints:
|
|
- port: metrics
|
|
interval: 30s
|
|
---
|
|
# PrometheusRule SLI alerts (R-OBS-01)
|
|
apiVersion: monitoring.coreos.com/v1
|
|
kind: PrometheusRule
|
|
metadata:
|
|
name: pihole-slis
|
|
namespace: pihole
|
|
labels:
|
|
release: kube-prometheus-stack
|
|
app.kubernetes.io/name: pihole
|
|
spec:
|
|
groups:
|
|
- name: pihole.slis
|
|
rules:
|
|
- alert: pihole-down
|
|
expr: up{job="pihole"} == 0
|
|
for: 5m
|
|
labels:
|
|
severity: critical
|
|
service: pihole
|
|
annotations:
|
|
summary: pihole is down
|
|
description: 'pihole has been unreachable for 5m (SLI: up).'
|