Skip to content

Commit 78b3598

Browse files
vknabelvknabel
authored
Firewall controller manager (#9)
1 parent fd7e20b commit 78b3598

26 files changed

+689
-30
lines changed

‎capi-lab/deploy.yaml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,5 +14,8 @@
1414
- name: prometheus
1515
- name: firewall-controller-manager
1616
vars:
17-
firewall_controller_manager_namespace: cap-metal-stack
17+
firewall_controller_manager_namespace: capms-system
18+
firewall_controller_manager_ca: "{{ lookup('file', playbook_dir + '/fcm-certs/ca.pem') }}"
19+
firewall_controller_manager_cert: "{{ lookup('file', playbook_dir + '/fcm-certs/tls.crt') }}"
20+
firewall_controller_manager_cert_key: "{{ lookup('file', playbook_dir + '/fcm-certs/tls.key') }}"
1821
- name: cluster-api-provider-metal-stack

‎capi-lab/fcm-certs/ca-config.json‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"signing": {
3+
"default": {
4+
"expiry": "168h"
5+
},
6+
"profiles": {
7+
"client-server": {
8+
"expiry": "8760h",
9+
"usages": [
10+
"signing",
11+
"key encipherment",
12+
"server auth",
13+
"client auth"
14+
]
15+
}
16+
}
17+
}
18+
}

‎capi-lab/fcm-certs/ca-csr.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"CN": "ca",
3+
"key": {
4+
"algo": "ecdsa",
5+
"size": 256
6+
},
7+
"names": [
8+
{
9+
"C": "DE",
10+
"L": "Bavaria",
11+
"ST": "Munich"
12+
}
13+
]
14+
}

‎capi-lab/fcm-certs/ca-key.pem‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
-----BEGIN EC PRIVATE KEY-----
2+
MHcCAQEEIFUGS1Xbmf1C9NcitDjcU3yfM3JUSS8SAeIHAvkHgofhoAoGCCqGSM49
3+
AwEHoUQDQgAEYPaD8+nz3ffhuV3iq3958NFnO28pCIfXiZOCVLyQYsvlr88eFbrN
4+
vjEHXAmvxTp5X2hlY5dbVh/CPC6FJbBFCw==
5+
-----END EC PRIVATE KEY-----

‎capi-lab/fcm-certs/ca.pem‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIBvjCCAWSgAwIBAgIUQBnjRL2py37bbgxj2/pB9TYZdSMwCgYIKoZIzj0EAwIw
3+
PTELMAkGA1UEBhMCREUxDzANBgNVBAgTBk11bmljaDEQMA4GA1UEBxMHQmF2YXJp
4+
YTELMAkGA1UEAxMCY2EwHhcNMjQxMTIxMTIxMjAwWhcNMjkxMTIwMTIxMjAwWjA9
5+
MQswCQYDVQQGEwJERTEPMA0GA1UECBMGTXVuaWNoMRAwDgYDVQQHEwdCYXZhcmlh
6+
MQswCQYDVQQDEwJjYTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABGD2g/Pp8933
7+
4bld4qt/efDRZztvKQiH14mTglS8kGLL5a/PHhW6zb4xB1wJr8U6eV9oZWOXW1Yf
8+
wjwuhSWwRQujQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0G
9+
A1UdDgQWBBT0JWN2t5PTJEOyBBbfGqjUdrsMXTAKBggqhkjOPQQDAgNIADBFAiEA
10+
ojnyHUbtmkx1xnuon+VFZKjccZxyoMaU/0u2Sz0MhWwCICrpHbQTNLoL8Q48UfJK
11+
33EilS1z6lxn/nM6+ql8WVfO
12+
-----END CERTIFICATE-----

‎capi-lab/fcm-certs/roll.sh‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#!/usr/bin/env bash
2+
set -eo pipefail
3+
4+
echo "generating example certs"
5+
cfssl genkey -initca ca-csr.json | cfssljson -bare ca
6+
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=client-server tls.json | cfssljson -bare tls
7+
rm *.csr
8+
mv tls.pem tls.crt
9+
mv tls-key.pem tls.key

‎capi-lab/fcm-certs/tls.crt‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIChjCCAiugAwIBAgIUfIGP//S9eEv3UtQ/ZlfTc579jdowCgYIKoZIzj0EAwIw
3+
PTELMAkGA1UEBhMCREUxDzANBgNVBAgTBk11bmljaDEQMA4GA1UEBxMHQmF2YXJp
4+
YTELMAkGA1UEAxMCY2EwHhcNMjQxMTIxMTIxMjAwWhcNMjUxMTIxMTIxMjAwWjBE
5+
MQswCQYDVQQGEwJERTEPMA0GA1UECBMGTXVuaWNoMRAwDgYDVQQHEwdCYXZhcmlh
6+
MRIwEAYDVQQDEwlsb2NhbGhvc3QwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQJ
7+
MoYtsmZB2s53fzS+LXf/rFSI6sHiKJ4kbenK04agoarAsIGniCPgRb4MUj2LvhC5
8+
1xJJncCC21QVUZCXZb+lo4IBADCB/TAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYw
9+
FAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFNDY
10+
PWHrOS2a1CtLw91V3cKk+Y6NMB8GA1UdIwQYMBaAFPQlY3a3k9MkQ7IEFt8aqNR2
11+
uwxdMH4GA1UdEQR3MHWCCWxvY2FsaG9zdIIsZmlyZXdhbGwtY29udHJvbGxlci1t
12+
YW5hZ2VyLmNhcG1zLXN5c3RlbS5zdmOCOmZpcmV3YWxsLWNvbnRyb2xsZXItbWFu
13+
YWdlci5jYXBtcy1zeXN0ZW0uc3ZjLmNsdXN0ZXIubG9jYWwwCgYIKoZIzj0EAwID
14+
SQAwRgIhAKlzsenMaiXH+IqONSjxL/Bk5Xk7HM+sWfbTyVoOHXnhAiEA0nd2f04Z
15+
R36a+jGSXPxMgR2OOmScjfOUk3xnDDInMQE=
16+
-----END CERTIFICATE-----

‎capi-lab/fcm-certs/tls.json‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"CN": "localhost",
3+
"hosts": [
4+
"localhost",
5+
"firewall-controller-manager.capms-system.svc",
6+
"firewall-controller-manager.capms-system.svc.cluster.local"
7+
],
8+
"key": {
9+
"algo": "ecdsa",
10+
"size": 256
11+
},
12+
"names": [
13+
{
14+
"C": "DE",
15+
"L": "Bavaria",
16+
"ST": "Munich"
17+
}
18+
]
19+
}

‎capi-lab/fcm-certs/tls.key‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
-----BEGIN EC PRIVATE KEY-----
2+
MHcCAQEEICCR8PczdJo8Tjpum62cO2hrlS0irQRVAgYhzcAr9raXoAoGCCqGSM49
3+
AwEHoUQDQgAECTKGLbJmQdrOd380vi13/6xUiOrB4iieJG3pytOGoKGqwLCBp4gj
4+
4EW+DFI9i74QudcSSZ3AgttUFVGQl2W/pQ==
5+
-----END EC PRIVATE KEY-----

‎capi-lab/roles/firewall-controller-manager/defaults/main.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,29 @@
11
---
22
firewall_controller_manager_namespace: "firewall-controller-manager"
3+
4+
firewall_controller_manager_image_pull_policy: Always
5+
firewall_controller_manager_replicas: 1
6+
# firewall_controller_manager_pod_annotations:
7+
8+
firewall_controller_manager_seed_api_url: https://kubernetes
9+
firewall_controller_manager_shoot_api_url:
10+
firewall_controller_manager_cluster_id:
11+
12+
firewall_controller_manager_metalapi_url: http://metal-api.metal-control-plane.svc.cluster.local:8080
13+
firewall_controller_manager_metalapi_hmac: metal-admin
14+
15+
firewall_controller_manager_generic_token_kubeconfig_secret_name:
16+
firewall_controller_manager_ssh_key_secret_name:
17+
18+
firewall_controller_manager_shoot_access_token_secret: "shoot-access-firewall-controller-manager"
19+
20+
firewall_controller_manager_ca:
21+
firewall_controller_manager_cert:
22+
firewall_controller_manager_cert_key:
23+
24+
firewall_controller_manager_pod_annotations: {}
25+
26+
firewall_controller_manager_crd_fetch_base_url: "https://raw.githubusercontent.com/metal-stack/firewall-controller-manager/refs/heads/"
27+
# TODO:
28+
# firewall_controller_manager_crd_fetch_base_url: "https://raw.githubusercontent.com/metal-stack/firewall-controller-manager/refs/tags/"
29+
firewall_controller_manager_image_tag: initial-firewall-ruleset

0 commit comments

Comments
 (0)