fe51c8c1bc
Adds a self-contained minikube environment for local development and
testing alongside the existing production env.
env: minikube
- cluster.domain: minikube (browser DNS routes *.minikube → minikube ip)
- tls issuer: mkcert (CA-signed via cert-manager mkcert ClusterIssuer)
- storageClass: standard (minikube hostpath provisioner)
- backups disabled; storagebox disabled
- excludes argocd, forgejo, hcloud-csi (manual kubectl apply for testing)
prototypes/garage:
- hand-rolled S3-compatible object store (single Deployment + PVC)
- mittwald-generated rpc_secret + admin_token (hex)
- PostSync init Job: assigns cluster layout, ensures bucket and access
key, writes ocis-s3-credentials cross-namespace into ocis ns
- idempotent: skips if k8s secret already populated; otherwise rotates
the garage key (admin API only returns secretAccessKey on create)
- cross-ns RBAC re-pinned via zz-cross-ns-rbac-fix overlay (ns.ytt.yaml
clobbers explicit namespace fields)
ocis:
- new admin-user-id init Job ensures secret.user-id is a valid UUID v4
(mittwald can't generate UUIDs; ocis-settings rejects non-UUID ids)
- mittwald no longer manages user-id; existing prod UUIDs preserved
- insecure flag (oidcIdpInsecure / ocisHttpApiInsecure / ocmInsecure)
parameterized; defaults to false; minikube sets true for self-signed
OIDC issuer URL trust
other prototypes:
- victoria-metrics-single helm values ytt-ified (storageClassName)
- grafana admin secret now generated by mittwald (was hand-created in
prod; manifest is no-op there since mittwald only fills empty fields)
flake.nix: minikube + docker + postgresql added to dev shell.
192 lines
8 KiB
YAML
192 lines
8 KiB
YAML
apiVersion: apiextensions.k8s.io/v1
|
|
kind: CustomResourceDefinition
|
|
metadata:
|
|
annotations:
|
|
a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
|
|
api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
|
|
gateway.networking.k8s.io/bundle-version: v1.4.0
|
|
gateway.networking.k8s.io/channel: standard
|
|
name: referencegrants.gateway.networking.k8s.io
|
|
namespace: traefik
|
|
spec:
|
|
group: gateway.networking.k8s.io
|
|
names:
|
|
categories:
|
|
- gateway-api
|
|
kind: ReferenceGrant
|
|
listKind: ReferenceGrantList
|
|
plural: referencegrants
|
|
shortNames:
|
|
- refgrant
|
|
singular: referencegrant
|
|
scope: Namespaced
|
|
versions:
|
|
- additionalPrinterColumns:
|
|
- jsonPath: .metadata.creationTimestamp
|
|
name: Age
|
|
type: date
|
|
name: v1beta1
|
|
schema:
|
|
openAPIV3Schema:
|
|
description: |-
|
|
ReferenceGrant identifies kinds of resources in other namespaces that are
|
|
trusted to reference the specified kinds of resources in the same namespace
|
|
as the policy.
|
|
|
|
Each ReferenceGrant can be used to represent a unique trust relationship.
|
|
Additional Reference Grants can be used to add to the set of trusted
|
|
sources of inbound references for the namespace they are defined within.
|
|
|
|
All cross-namespace references in Gateway API (with the exception of cross-namespace
|
|
Gateway-route attachment) require a ReferenceGrant.
|
|
|
|
ReferenceGrant is a form of runtime verification allowing users to assert
|
|
which cross-namespace object references are permitted. Implementations that
|
|
support ReferenceGrant MUST NOT permit cross-namespace references which have
|
|
no grant, and MUST respond to the removal of a grant by revoking the access
|
|
that the grant allowed.
|
|
properties:
|
|
apiVersion:
|
|
description: |-
|
|
APIVersion defines the versioned schema of this representation of an object.
|
|
Servers should convert recognized schemas to the latest internal value, and
|
|
may reject unrecognized values.
|
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
|
type: string
|
|
kind:
|
|
description: |-
|
|
Kind is a string value representing the REST resource this object represents.
|
|
Servers may infer this from the endpoint the client submits requests to.
|
|
Cannot be updated.
|
|
In CamelCase.
|
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
|
type: string
|
|
metadata:
|
|
type: object
|
|
spec:
|
|
description: Spec defines the desired state of ReferenceGrant.
|
|
properties:
|
|
from:
|
|
description: |-
|
|
From describes the trusted namespaces and kinds that can reference the
|
|
resources described in "To". Each entry in this list MUST be considered
|
|
to be an additional place that references can be valid from, or to put
|
|
this another way, entries MUST be combined using OR.
|
|
|
|
Support: Core
|
|
items:
|
|
description: ReferenceGrantFrom describes trusted namespaces and kinds.
|
|
properties:
|
|
group:
|
|
description: |-
|
|
Group is the group of the referent.
|
|
When empty, the Kubernetes core API group is inferred.
|
|
|
|
Support: Core
|
|
maxLength: 253
|
|
pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
|
type: string
|
|
kind:
|
|
description: |-
|
|
Kind is the kind of the referent. Although implementations may support
|
|
additional resources, the following types are part of the "Core"
|
|
support level for this field.
|
|
|
|
When used to permit a SecretObjectReference:
|
|
|
|
* Gateway
|
|
|
|
When used to permit a BackendObjectReference:
|
|
|
|
* GRPCRoute
|
|
* HTTPRoute
|
|
* TCPRoute
|
|
* TLSRoute
|
|
* UDPRoute
|
|
maxLength: 63
|
|
minLength: 1
|
|
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
|
|
type: string
|
|
namespace:
|
|
description: |-
|
|
Namespace is the namespace of the referent.
|
|
|
|
Support: Core
|
|
maxLength: 63
|
|
minLength: 1
|
|
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
|
type: string
|
|
required:
|
|
- group
|
|
- kind
|
|
- namespace
|
|
type: object
|
|
maxItems: 16
|
|
minItems: 1
|
|
type: array
|
|
x-kubernetes-list-type: atomic
|
|
to:
|
|
description: |-
|
|
To describes the resources that may be referenced by the resources
|
|
described in "From". Each entry in this list MUST be considered to be an
|
|
additional place that references can be valid to, or to put this another
|
|
way, entries MUST be combined using OR.
|
|
|
|
Support: Core
|
|
items:
|
|
description: |-
|
|
ReferenceGrantTo describes what Kinds are allowed as targets of the
|
|
references.
|
|
properties:
|
|
group:
|
|
description: |-
|
|
Group is the group of the referent.
|
|
When empty, the Kubernetes core API group is inferred.
|
|
|
|
Support: Core
|
|
maxLength: 253
|
|
pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
|
type: string
|
|
kind:
|
|
description: |-
|
|
Kind is the kind of the referent. Although implementations may support
|
|
additional resources, the following types are part of the "Core"
|
|
support level for this field:
|
|
|
|
* Secret when used to permit a SecretObjectReference
|
|
* Service when used to permit a BackendObjectReference
|
|
maxLength: 63
|
|
minLength: 1
|
|
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
|
|
type: string
|
|
name:
|
|
description: |-
|
|
Name is the name of the referent. When unspecified, this policy
|
|
refers to all resources of the specified Group and Kind in the local
|
|
namespace.
|
|
maxLength: 253
|
|
minLength: 1
|
|
type: string
|
|
required:
|
|
- group
|
|
- kind
|
|
type: object
|
|
maxItems: 16
|
|
minItems: 1
|
|
type: array
|
|
x-kubernetes-list-type: atomic
|
|
required:
|
|
- from
|
|
- to
|
|
type: object
|
|
type: object
|
|
served: true
|
|
storage: true
|
|
subresources: {}
|
|
status:
|
|
acceptedNames:
|
|
kind: ""
|
|
plural: ""
|
|
conditions: null
|
|
storedVersions: null
|