adrien/ansible-role-k8s-traefik
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Fix lint errors
Some checks reported errors
continuous-integration/drone/push Build encountered an error
Details

Browse source
This commit is contained in:
Adrien Reslinger 2022-07-23 01:03:23 +02:00
parent daaed8df51
commit 44b97e681c
Signed by: adrien
GPG key ID: DA7B27055C66D6DE
4 changed files with 174 additions and 168 deletions
Download patch file Download diff file Expand all files Collapse all files

24
defaults/main.yml
View file

@ -3,23 +3,23 @@ traefik_version: "2.8.1"
cluster_domain: "local" cluster_domain: "local"
traefik_namespace: "traefik" traefik_namespace: "traefik"
traefik_service_type: LoadBalancer traefik_service_type: LoadBalancer
#ingress_whitelist: # ingress_whitelist:
# - 10.96.0.0/12 # - 10.96.0.0/12
# - 10.244.0.0/16 # - 10.244.0.0/16
# - 192.168.0.0/24 # - 192.168.0.0/24
#traefik_node_selector: # traefik_node_selector:
# - localhost # - localhost
traefik_cpu_limit: 500m traefik_cpu_limit: 500m
traefik_memory_limit: 300Mi traefik_memory_limit: 300Mi
traefik_entrypoints: [] traefik_entrypoints: []
# - { name: "http", port: 8000, proto: "TCP", hostport: 80 middlewares: ["{{ traefik_namespace }}-crowdsec-traefik-bouncer@kubernetescrd"] } # - { name: "http", port: 8000, proto: "TCP", hostport: 80 middlewares: ["{{ traefik_namespace }}-crowdsec-traefik-bouncer@kubernetescrd"] }
# - { name: "https", port: 4443, proto: "TCP", hostport: 443, tls: true middlewares: ["{{ traefik_namespace }}-crowdsec-traefik-bouncer@kubernetescrd"] } # - { name: "https", port: 4443, proto: "TCP", hostport: 443, tls: true middlewares: ["{{ traefik_namespace }}-crowdsec-traefik-bouncer@kubernetescrd"] }
# - { name: "traefik", port: 8080, proto: "TCP" } # - { name: "traefik", port: 8080, proto: "TCP" }
#traefik_external_ips: [] # traefik_external_ips: []
# - 1.2.3.4 # - 1.2.3.4
basic_auth: false basic_auth: false
#traefik_dashboard_certificate: wildcard-cluster # traefik_dashboard_certificate: wildcard-cluster
crowdsec_namespace: "crowdsec" crowdsec_namespace: "crowdsec"
crowdsec_traefik_bouncer_chart_version: "0.1.0" crowdsec_traefik_bouncer_chart_version: "0.1.0"

6
meta/main.yml
View file

@ -8,6 +8,6 @@ galaxy_info:
collections: collections:
- kubernetes.core - kubernetes.core
platforms: platforms:
- name: kubernetes - name: kubernetes
version: version:
- all - all

298
tasks/main.yml
View file

@ -1,161 +1,161 @@
- name: traefik setup - name: traefik setup
block: block:
- name: namespace - name: namespace
kubernetes.core.k8s: kubernetes.core.k8s:
state: present state: present
context: "{{ my_context }}" context: "{{ my_context }}"
merge_type: merge merge_type: merge
definition: definition:
api_version: v1 api_version: v1
kind: Namespace kind: Namespace
metadata: metadata:
name: '{{ traefik_namespace }}' name: '{{ traefik_namespace }}'
labels: labels:
namespace: '{{ traefik_namespace }}' namespace: '{{ traefik_namespace }}'
- name: Create a Secret object for basic authentification - name: Create a Secret object for basic authentification
kubernetes.core.k8s: kubernetes.core.k8s:
state: present state: present
context: "{{ my_context }}" context: "{{ my_context }}"
namespace: '{{ traefik_namespace }}' namespace: '{{ traefik_namespace }}'
definition: definition:
apiVersion: v1 apiVersion: v1
kind: Secret kind: Secret
metadata: metadata:
name: basic-auth name: basic-auth
type: Opaque type: Opaque
data: data:
basic_auth: "{{ basic_auth_data | b64encode }}" basic_auth: "{{ basic_auth_data | b64encode }}"
when: when:
- basic_auth|bool - basic_auth|bool
- name: Add host label for traefik deployment - name: Add host label for traefik deployment
kubernetes.core.k8s: kubernetes.core.k8s:
state: present state: present
context: "{{ my_context }}" context: "{{ my_context }}"
definition: definition:
apiVersion: v1 apiVersion: v1
kind: Node kind: Node
metadata: metadata:
name: "{{ item }}" name: "{{ item }}"
labels: labels:
entrypoint: traefik entrypoint: traefik
with_items: with_items:
- '{{ traefik_node_selector }}' - '{{ traefik_node_selector }}'
when: when:
- traefik_node_selector is defined - traefik_node_selector is defined
- name: Deploy latest version of CrowdSec Traefik bouncer - name: Deploy latest version of CrowdSec Traefik bouncer
kubernetes.core.helm: kubernetes.core.helm:
context: "{{ my_context }}" context: "{{ my_context }}"
name: crowdsec-traefik-bouncer name: crowdsec-traefik-bouncer
release_namespace: "{{ traefik_namespace }}" release_namespace: "{{ traefik_namespace }}"
create_namespace: true create_namespace: true
chart_ref: crowdsec/crowdsec-traefik-bouncer chart_ref: crowdsec/crowdsec-traefik-bouncer
chart_version: "{{ crowdsec_traefik_bouncer_chart_version }}" chart_version: "{{ crowdsec_traefik_bouncer_chart_version }}"
values: values:
bouncer: bouncer:
crowdsec_bouncer_api_key: "{{ traefik_crowdsec_bouncer_apikey }}" crowdsec_bouncer_api_key: "{{ traefik_crowdsec_bouncer_apikey }}"
crowdsec_agent_host: "crowdsec-service.{{ crowdsec_namespace }}.svc.cluster.local:8080" crowdsec_agent_host: "crowdsec-service.{{ crowdsec_namespace }}.svc.cluster.local:8080"
replicaCount: 1 replicaCount: 1
podSecurityContext: podSecurityContext:
fsGroup: 2000 fsGroup: 2000
securityContext: securityContext:
capabilities: capabilities:
drop: drop:
- ALL - ALL
readOnlyRootFilesystem: true readOnlyRootFilesystem: true
runAsNonRoot: true runAsNonRoot: true
runAsUser: 1000 runAsUser: 1000
when: when:
- traefik_crowdsec_bouncer_apikey is defined - traefik_crowdsec_bouncer_apikey is defined
# - name: Get Deployment information object # - name: Get Deployment information object
# kubernetes.core.k8s_info: # kubernetes.core.k8s_info:
# context: "{{ my_context }}" # context: "{{ my_context }}"
# api_version: v1 # api_version: v1
# kind: DaemonSet # kind: DaemonSet
# name: traefik # name: traefik
# namespace: '{{ traefik_namespace }}' # namespace: '{{ traefik_namespace }}'
# field_selectors: # field_selectors:
# - spec.template.spec.containers.image # - spec.template.spec.containers.image
# register: traefik_actual_resources # register: traefik_actual_resources
# #
# - name: Retreive actual traefik version # - name: Retreive actual traefik version
# shell: echo "{{ traefik_actual_resources.resources }}" | sed "s/.*traefik:\([0-9]\.[0-9]*\).*/\1/" | uniq # ansible.builtin.shell: echo "{{ traefik_actual_resources.resources }}" | sed "s/.*traefik:\([0-9]\.[0-9]*\).*/\1/" | uniq
# register: traefik_actual_version # register: traefik_actual_version
# #
# - name: Remove old traefik version {{ traefik_actual_version.stdout }} # - name: Remove old traefik version {{ traefik_actual_version.stdout }}
# kubernetes.core.k8s: # kubernetes.core.k8s:
# state: "absent" # state: "absent"
# context: "{{ my_context }}" # context: "{{ my_context }}"
# resource_definition: "{{ lookup('template', item) | from_yaml }}" # resource_definition: "{{ lookup('template', item) | from_yaml }}"
# with_items: # with_items:
# - "{{ lookup('vars', 'traefik_' + traefik_actual_version.stdout | regex_replace('[.]','_') + '_list') | reverse | list }}" # - "{{ lookup('vars', 'traefik_' + traefik_actual_version.stdout | regex_replace('[.]','_') + '_list') | reverse | list }}"
## - hostvars[inventory_hostname]['traefik_' + traefik_actual_version.stdout + '_list'] | reverse ## - hostvars[inventory_hostname]['traefik_' + traefik_actual_version.stdout + '_list'] | reverse
# when: # when:
# - not traefik_actual_version.stdout == "[]" # - not traefik_actual_version.stdout == "[]"
# - not traefik_version == traefik_actual_version.stdout # - not traefik_version == traefik_actual_version.stdout
# - traefik_actual_version.stdout is version(traefik_version, '>') # - traefik_actual_version.stdout is version(traefik_version, '>')
- name: Defined traefik repository - name: Defined traefik repository
kubernetes.core.helm_repository: kubernetes.core.helm_repository:
name: traefik name: traefik
repo_url: "https://helm.traefik.io/traefik" repo_url: "https://helm.traefik.io/traefik"
- name: Deploy latest version of Traefik - name: Deploy latest version of Traefik
kubernetes.core.helm: kubernetes.core.helm:
context: "{{ my_context }}" context: "{{ my_context }}"
name: traefik name: traefik
chart_ref: traefik/traefik chart_ref: traefik/traefik
release_namespace: "{{ traefik_namespace }}" release_namespace: "{{ traefik_namespace }}"
values: "{{ lookup('template', 'traefik-helm-value.yaml.j2') | from_yaml }}" values: "{{ lookup('template', 'traefik-helm-value.yaml.j2') | from_yaml }}"
- name: Install traefik configuration - name: Install traefik configuration
kubernetes.core.k8s: kubernetes.core.k8s:
state: "present" state: "present"
context: "{{ my_context }}" context: "{{ my_context }}"
namespace: '{{ traefik_namespace }}' namespace: '{{ traefik_namespace }}'
# merge_type: merge # merge_type: merge
apply: true apply: true
resource_definition: "{{ lookup('template', item) | from_yaml }}" resource_definition: "{{ lookup('template', item) | from_yaml }}"
with_items: with_items:
# - "{{ lookup('vars', 'traefik_' + traefik_version | regex_replace('[.]','_') + '_list') }}" # - "{{ lookup('vars', 'traefik_' + traefik_version | regex_replace('[.]','_') + '_list') }}"
- traefik-certificate.yml.j2 - traefik-certificate.yml.j2
- traefik-cm.yml.j2 - traefik-cm.yml.j2
- traefik-files.yml.j2 - traefik-files.yml.j2
# - traefik-sa.yml.j2 # - traefik-sa.yml.j2
- traefik-ingressroute.yml.j2 - traefik-ingressroute.yml.j2
# - traefik-svc.yml.j2 # - traefik-svc.yml.j2
# - traefik-defaultbackend.yml.j2 # - traefik-defaultbackend.yml.j2
- name: Install traefik plugin's - name: Install traefik plugin's
kubernetes.core.k8s: kubernetes.core.k8s:
state: "present" state: "present"
context: "{{ my_context }}" context: "{{ my_context }}"
namespace: '{{ traefik_namespace }}' namespace: '{{ traefik_namespace }}'
# merge_type: merge # merge_type: merge
apply: true apply: true
resource_definition: "{{ lookup('template', item) | from_yaml_all }}" resource_definition: "{{ lookup('template', item) | from_yaml_all }}"
with_items: with_items:
- traefik-ondemand-plugin.yml.j2 - traefik-ondemand-plugin.yml.j2
when: when:
- traefik_ondemand is defined - traefik_ondemand is defined
- name: Defined traefik-hub repository - name: Defined traefik-hub repository
kubernetes.core.helm_repository: kubernetes.core.helm_repository:
name: traefik-hub name: traefik-hub
repo_url: "https://helm.traefik.io/hub" repo_url: "https://helm.traefik.io/hub"
when: when:
- traefik_hub_token is defined - traefik_hub_token is defined
- name: Deploy latest version of Traefik-hub - name: Deploy latest version of Traefik-hub
kubernetes.core.helm: kubernetes.core.helm:
context: "{{ my_context }}" context: "{{ my_context }}"
name: hub-agent name: hub-agent
chart_ref: traefik-hub/hub-agent chart_ref: traefik-hub/hub-agent
release_namespace: "{{ traefik_namespace }}" release_namespace: "{{ traefik_namespace }}"
values: values:
token: "{{ traefik_hub_token }}" token: "{{ traefik_hub_token }}"
when: when:
- traefik_hub_token is defined - traefik_hub_token is defined
tags: traefik tags: traefik

14
templates/traefik-files.yml.j2
View file

@ -29,10 +29,10 @@ data:
burst: 50 burst: 50
security_headers: security_headers:
headers: headers:
# accessControlAllowMethods: ["GET", "OPTIONS", "PUT"] accessControlAllowMethods: ["GET", "OPTIONS", "PUT"]
# accessControlAllowOrigin: "origin-list-or-null" # accessControlAllowOrigin: "origin-list-or-null"
# accessControlMaxAge: 100 accessControlMaxAge: 100
# addVaryHeader: true addVaryHeader: true
browserXssFilter: true browserXssFilter: true
contentTypeNosniff: true contentTypeNosniff: true
forceSTSHeader: true forceSTSHeader: true
@ -42,11 +42,14 @@ data:
customFrameOptionsValue: "SAMEORIGIN" customFrameOptionsValue: "SAMEORIGIN"
referrerPolicy: "same-origin" referrerPolicy: "same-origin"
permissionsPolicy: "vibrate 'self'" permissionsPolicy: "vibrate 'self'"
permissionsPolicy: "camera 'none'; microphone 'none'; geolocation 'none'; payment 'none';"
stsSeconds: 315360000 stsSeconds: 315360000
contentSecurityPolicy: "default-src 'self' 'unsafe-inline'" # contentSecurityPolicy: "default-src 'self' 'unsafe-inline'"
# customResponseHeaders: # customResponseHeaders:
# X-Robots-Tag: "none,noarchive,nosnippet,notranslate,noimageindex," # X-Robots-Tag: "none,noarchive,nosnippet,notranslate,noimageindex,"
# server: "" # server: ""
hostsProxyHeaders:
- "X-Forwarded-Host"
{% if ingress_whitelist is defined %} {% if ingress_whitelist is defined %}
traefik-ipwhitelist: traefik-ipwhitelist:
ipWhiteList: ipWhiteList:
@ -99,6 +102,9 @@ data:
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
alpnProtocols:
- h2
- http/1.1
{% if false %} {% if false %}
stores: stores:
default: default: