From 19edb0a1b0b80b7c7fb7c2aa796c5ddf2246ca74 Mon Sep 17 00:00:00 2001 From: Jean-Francois Roy Date: Wed, 14 Aug 2024 23:30:43 -0700 Subject: [PATCH] feat(sabnzbd): run gluetun as sidecar --- .../apps/default/sabnzbd/app/helmrelease.yaml | 69 ++++++++++++++++++- .../default/sabnzbd/app/kustomization.yaml | 3 +- .../sabnzbd/app/networkpolicy.sops.yaml | 26 +++++++ .../default/sabnzbd/app/networkpolicy.yaml | 14 ---- .../apps/default/sabnzbd/app/secret.sops.yaml | 16 +++++ kubernetes/apps/default/sabnzbd/ks.yaml | 1 - 6 files changed, 111 insertions(+), 18 deletions(-) create mode 100644 kubernetes/apps/default/sabnzbd/app/networkpolicy.sops.yaml delete mode 100644 kubernetes/apps/default/sabnzbd/app/networkpolicy.yaml create mode 100644 kubernetes/apps/default/sabnzbd/app/secret.sops.yaml diff --git a/kubernetes/apps/default/sabnzbd/app/helmrelease.yaml b/kubernetes/apps/default/sabnzbd/app/helmrelease.yaml index 780eee8ba..9a114ac60 100644 --- a/kubernetes/apps/default/sabnzbd/app/helmrelease.yaml +++ b/kubernetes/apps/default/sabnzbd/app/helmrelease.yaml @@ -61,7 +61,7 @@ spec: timeoutSeconds: 1 failureThreshold: 3 readiness: *probes - securityContext: + securityContext: &securityContext allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: { drop: ["ALL"] } @@ -72,6 +72,58 @@ spec: limits: cpu: 4 memory: 50Gi + initContainers: + gluetun: + image: + repository: ghcr.io/qdm12/gluetun + tag: v3.39.0@sha256:2f011a9aca767af62008d879eefcbc80a8645bd4fd4466ab312cc941cb658ad1 + env: + BLOCK_MALICIOUS: "off" # save 300MB of RAM; https://github.com/qdm12/gluetun/issues/2054 + DOT_IPV6: "on" + FIREWALL_DEBUG: on + FIREWALL_INPUT_PORTS: "80,9999" + HEALTH_SERVER_ADDRESS: ":9999" + HEALTH_VPN_DURATION_INITIAL: 60s + LOG_LEVEL: debug + VPN_INTERFACE: wg0 + VPN_TYPE: wireguard + TZ: America/Los_Angeles + envFrom: + - secretRef: + name: sabnzbd-gluetun-secret + probes: + liveness: + enabled: true + custom: true + spec: + httpGet: + path: / + port: 9999 + initialDelaySeconds: 0 + periodSeconds: 10 + failureThreshold: 3 + startup: + enabled: true + custom: true + spec: + httpGet: + path: / + port: 9999 + initialDelaySeconds: 10 + periodSeconds: 10 + failureThreshold: 5 + resources: + requests: + memory: 48Mi + limits: + memory: 96Mi + restartPolicy: Always + securityContext: + <<: *securityContext + readOnlyRootFilesystem: false + runAsNonRoot: false + runAsUser: 0 + capabilities: { add: ["NET_ADMIN"] } pod: labels: stealth-gateway: "true" @@ -108,6 +160,14 @@ spec: persistence: config: existingClaim: sabnzbd + empty: + type: emptyDir + sizeLimit: 20Mi + globalMounts: + - path: /gluetun + subPath: gluetun + - path: /tmp + subPath: tmp media: type: nfs server: kaidame.flat @@ -119,5 +179,10 @@ spec: type: emptyDir globalMounts: - path: /config/logs - tmp: + run: type: emptyDir + medium: Memory + sizeLimit: 10Mi + globalMounts: + - path: /run + - path: /var/run diff --git a/kubernetes/apps/default/sabnzbd/app/kustomization.yaml b/kubernetes/apps/default/sabnzbd/app/kustomization.yaml index 9ded3bbab..6b74121c6 100644 --- a/kubernetes/apps/default/sabnzbd/app/kustomization.yaml +++ b/kubernetes/apps/default/sabnzbd/app/kustomization.yaml @@ -5,6 +5,7 @@ kind: Kustomization resources: - ./externalsecret.yaml - ./helmrelease.yaml - - ./networkpolicy.yaml + - ./networkpolicy.sops.yaml + - ./secret.sops.yaml - ../../../../templates/gatus/guarded - ../../../../templates/volsync diff --git a/kubernetes/apps/default/sabnzbd/app/networkpolicy.sops.yaml b/kubernetes/apps/default/sabnzbd/app/networkpolicy.sops.yaml new file mode 100644 index 000000000..b840fd06a --- /dev/null +++ b/kubernetes/apps/default/sabnzbd/app/networkpolicy.sops.yaml @@ -0,0 +1,26 @@ +apiVersion: cilium.io/v2 +kind: CiliumNetworkPolicy +metadata: + name: sabnzbd-allow-gluetun + annotations: + future-me-why: allow ingress and egress to gluetun endpoints; also puts pod in deny-by-default mode for egress +spec: + endpointSelector: + matchLabels: + app.kubernetes.io/instance: sabnzbd + egress: + - toCIDR: + - 37.120.132.82/32 + - 37.120.132.90/32 + - 217.138.217.106/32 + - 2a0d:5600:4f:8000:e97d:9761:c3d1:c92f/128 + - 2a0d:5600:8:3d:bf35:b49d:b2c1:8537/128 + - 2a0d:5600:8:3e:b389:fbfa:508a:1eca/128 + ingress: + - fromCIDR: + - 37.120.132.82/32 + - 37.120.132.90/32 + - 217.138.217.106/32 + - 2a0d:5600:4f:8000:e97d:9761:c3d1:c92f/128 + - 2a0d:5600:8:3d:bf35:b49d:b2c1:8537/128 + - 2a0d:5600:8:3e:b389:fbfa:508a:1eca/128 diff --git a/kubernetes/apps/default/sabnzbd/app/networkpolicy.yaml b/kubernetes/apps/default/sabnzbd/app/networkpolicy.yaml deleted file mode 100644 index 82e67e907..000000000 --- a/kubernetes/apps/default/sabnzbd/app/networkpolicy.yaml +++ /dev/null @@ -1,14 +0,0 @@ ---- -apiVersion: "cilium.io/v2" -kind: CiliumNetworkPolicy -metadata: - name: "sabnzbd-allow-egress-cluster" - annotations: - future-me-why: "allow egress to cluster for all endpoints, which also puts pod in deny-by-default mode for egress; must use stealth-gateway" -spec: - endpointSelector: - matchLabels: - app.kubernetes.io/instance: sabnzbd - egress: - - toEntities: - - "cluster" diff --git a/kubernetes/apps/default/sabnzbd/app/secret.sops.yaml b/kubernetes/apps/default/sabnzbd/app/secret.sops.yaml new file mode 100644 index 000000000..03da7de6c --- /dev/null +++ b/kubernetes/apps/default/sabnzbd/app/secret.sops.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Secret +metadata: + name: sabnzbd-gluetun-secret +type: Opaque +stringData: + SERVER_CITIES: Los Angeles + SERVER_COUNTRIES: United States + VPN_SERVICE_PROVIDER: airvpn + WIREGUARD_ADDRESSES: 10.179.45.218/32,fd7d:76ee:e68f:a993:2e72:6388:a4b3:8103/128 + WIREGUARD_DNS: 10.128.0.1 + WIREGUARD_MTU: "1320" + WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL: 15s + WIREGUARD_PRESHARED_KEY: 7eDa23NIyjXF1INH3Hwvc6kWINj57Q5LPcJqQuJHptI= + WIREGUARD_PRIVATE_KEY: kMTK2v13xv/El1YGK49W5bPm78iGoC+vBGuta9ZtfEY= + WIREGUARD_PUBLIC_KEY: PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk= diff --git a/kubernetes/apps/default/sabnzbd/ks.yaml b/kubernetes/apps/default/sabnzbd/ks.yaml index 5dd297d51..5cf3cf013 100644 --- a/kubernetes/apps/default/sabnzbd/ks.yaml +++ b/kubernetes/apps/default/sabnzbd/ks.yaml @@ -12,7 +12,6 @@ spec: app.kubernetes.io/name: *app dependsOn: - name: external-secrets-stores - - name: stealth-gateway - name: volsync path: ./kubernetes/apps/default/sabnzbd/app prune: true