new mtls approach 2

.woodpecker/predeploy.yml

@@ -33,7 +33,6 @@ steps:
         --namespace=$NAMESPACE 
         --dry-run=client -o yaml | kubectl apply -f - 
       - kubectl apply -f deployment/configmap.yaml -n $NAMESPACE
-      - kubectl apply -f deployment/mtls-config.yaml -n $NAMESPACE
     when:
       event: [tag]
 

deployment/api-deployment.yaml

@@ -100,28 +100,3 @@ spec:
     targetPort: 8001
     name: http
   type: ClusterIP
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: api-ingress
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production-http
-    traefik.ingress.kubernetes.io/router.middlewares: homea2-mtls-auth@kubernetescrd,homea2-security-headers@kubernetescrd
-    traefik.ingress.kubernetes.io/router.tls.options: homea2-mtls@kubernetescrd
-spec:
-  tls:
-    - hosts:
-        - homea2-api.hottis.de
-      secretName: homea2-api-cert
-  rules:
-    - host: homea2-api.hottis.de
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: api
-                port:
-                  number: 80

deployment/api-deployment.yaml.bak

@@ -1,130 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: api
-  namespace: homea2
-  labels:
-    app: api
-    component: home-automation
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: api
-  template:
-    metadata:
-      annotations:
-        reloader.stakater.com/auto: "true"
-        configmap.reloader.stakater.com/reload: "home-automation-environment,home-automation-config"
-      labels:
-        app: api
-        component: home-automation
-    spec:
-      containers:
-      - name: api
-        image: %IMAGE%
-        ports:
-        - containerPort: 8001
-          name: http
-        env:
-        - name: MQTT_BROKER
-          valueFrom:
-            configMapKeyRef:
-              name: home-automation-environment
-              key: SHARED_MQTT_BROKER
-        - name: MQTT_PORT
-          valueFrom:
-            configMapKeyRef:
-              name: home-automation-environment
-              key: SHARED_MQTT_PORT
-        - name: REDIS_HOST
-          valueFrom:
-            configMapKeyRef:
-              name: home-automation-environment
-              key: SHARED_REDIS_HOST
-        - name: REDIS_PORT
-          valueFrom:
-            configMapKeyRef:
-              name: home-automation-environment
-              key: SHARED_REDIS_PORT
-        - name: REDIS_DB
-          valueFrom:
-            configMapKeyRef:
-              name: home-automation-environment
-              key: SHARED_REDIS_DB
-        - name: REDIS_CHANNEL
-          valueFrom:
-            configMapKeyRef:
-              name: home-automation-environment
-              key: API_REDIS_CHANNEL
-        volumeMounts:
-        - name: config-volume
-          mountPath: /app/config
-          readOnly: true
-        livenessProbe:
-          httpGet:
-            path: /health
-            port: 8001
-          initialDelaySeconds: 30
-          periodSeconds: 10
-        readinessProbe:
-          httpGet:
-            path: /health
-            port: 8001
-          initialDelaySeconds: 5
-          periodSeconds: 5
-        resources:
-          limits:
-            cpu: 1000m
-            memory: 1Gi
-          requests:
-            cpu: 200m
-            memory: 256Mi
-      volumes:
-      - name: config-volume
-        configMap:
-          name: home-automation-config
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: api
-  labels:
-    app: api
-    component: home-automation
-spec:
-  selector:
-    app: api
-  ports:
-  - port: 80
-    targetPort: 8001
-    name: http
-  type: ClusterIP
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: api-ingress
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production-http
-    traefik.ingress.kubernetes.io/router.middlewares: homea2-mtls-auth@kubernetescrd,homea2-security-headers@kubernetescrd
-    traefik.ingress.kubernetes.io/router.tls.options: homea2-homea2-mtls@kubernetescrd
-    # Traefik 2 mTLS Configuration
-    traefik.ingress.kubernetes.io/router.tls.options: homea2-mtls@kubernetescrd
-    traefik.ingress.kubernetes.io/router.middlewares: homea2-mtls-auth@kubernetescrd
-spec:
-  tls:
-    - hosts:
-        - homea2-api.hottis.de
-      secretName: homea2-api-cert
-  rules:
-    - host: homea2-api.hottis.de
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: api
-                port:
-                  number: 80

deployment/ingress.yaml

@@ -0,0 +1,43 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: homea2-cert
+spec:
+  secretName: homea2-cert
+  issuerRef:
+    name: letsencrypt-production-http
+    kind: ClusterIssuer
+  commonName: homea2.hottis.de
+  dnsNames:
+    - homea2.hottis.de
+    - homea2-api.hottis.de
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: TLSOptions
+metadata:
+  name: mtls-required
+spec:
+  clientAuth:
+    clientAuthType: RequireAndVerifyClientCert
+    secretNames:
+      - mtls-ca-cert
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: ui
+spec:
+  entryPoints:
+    - websecure
+  tls:
+    secretName: homea2-cert
+    options:
+      name: mtls-required
+      namespace: default
+  routes:
+    - match: Host(`homea2.hottis.de`)
+      kind: Rule
+      services:
+        - name: ui
+          port: 80
+

deployment/mtls-config.yaml

@@ -1,45 +0,0 @@
-apiVersion: traefik.containo.us/v1alpha1
-kind: TLSOption
-metadata:
-  name: homea2-mtls
-spec:
-  clientAuth:
-    secretNames:
-      - mtls-ca-cert
-    clientAuthType: RequireAndVerifyClientCert
-  minVersion: "VersionTLS12"
-  cipherSuites:
-    - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
-    - "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"
-    - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
-    - "TLS_RSA_WITH_AES_256_GCM_SHA384"
-    - "TLS_RSA_WITH_AES_128_GCM_SHA256"
----
-apiVersion: traefik.containo.us/v1alpha1
-kind: Middleware
-metadata:
-  name: mtls-auth
-spec:
-  headers:
-    customRequestHeaders:
-      X-Client-Cert: ""
-    customResponseHeaders:
-      X-mTLS-Verified: "true"
-  # Optional: Add IP whitelist for additional security
-  # ipWhiteList:
-  #   sourceRange:
-  #     - "10.0.0.0/8"
-  #     - "192.168.0.0/16"
----
-apiVersion: traefik.containo.us/v1alpha1
-kind: Middleware
-metadata:
-  name: security-headers
-spec:
-  headers:
-    customResponseHeaders:
-      X-Frame-Options: "SAMEORIGIN"
-      X-Content-Type-Options: "nosniff"
-      X-XSS-Protection: "1; mode=block"
-      Strict-Transport-Security: "max-age=31536000; includeSubDomains; preload"
-    contentSecurityPolicy: "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'"

deployment/ui-deployment.yaml

@@ -77,28 +77,3 @@ spec:
     targetPort: 8002
     name: http
   type: ClusterIP
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: ui-ingress
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production-http
-    traefik.ingress.kubernetes.io/router.middlewares: homea2-mtls-auth@kubernetescrd,homea2-security-headers@kubernetescrd
-    traefik.ingress.kubernetes.io/router.tls.options: homea2-mtls@kubernetescrd
-spec:
-  tls:
-    - hosts:
-        - homea2.hottis.de
-      secretName: homea2-ui-cert
-  rules:
-    - host: homea2.hottis.de
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: ui
-                port:
-                  number: 80

deployment/ui-deployment.yaml.bak

@@ -1,104 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: ui
-  namespace: homea2
-  labels:
-    app: ui
-    component: home-automation
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: ui
-  template:
-    metadata:
-      annotations:
-        reloader.stakater.com/auto: "true"
-        configmap.reloader.stakater.com/reload: "home-automation-environment"
-      labels:
-        app: ui
-        component: home-automation
-    spec:
-      containers:
-      - name: ui
-        image: %IMAGE%
-        ports:
-        - containerPort: 8002
-          name: http
-        env:
-        - name: UI_PORT
-          valueFrom:
-            configMapKeyRef:
-              name: home-automation-environment
-              key: UI_UI_PORT
-        - name: API_BASE
-          valueFrom:
-            configMapKeyRef:
-              name: home-automation-environment
-              key: UI_API_BASE
-        - name: BASE_PATH
-          valueFrom:
-            configMapKeyRef:
-              name: home-automation-environment
-              key: UI_BASE_PATH
-        livenessProbe:
-          httpGet:
-            path: /
-            port: 8002
-          initialDelaySeconds: 30
-          periodSeconds: 10
-        readinessProbe:
-          httpGet:
-            path: /
-            port: 8002
-          initialDelaySeconds: 5
-          periodSeconds: 5
-        resources:
-          limits:
-            cpu: 500m
-            memory: 512Mi
-          requests:
-            cpu: 100m
-            memory: 128Mi
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: ui
-  labels:
-    app: ui
-    component: home-automation
-spec:
-  selector:
-    app: ui
-  ports:
-  - port: 80
-    targetPort: 8002
-    name: http
-  type: ClusterIP
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: ui-ingress
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production-http
-    traefik.ingress.kubernetes.io/router.middlewares: homea2-mtls-auth@kubernetescrd,homea2-security-headers@kubernetescrd
-    traefik.ingress.kubernetes.io/router.tls.options: homea2-homea2-mtls@kubernetescrd
-spec:
-  tls:
-    - hosts:
-        - homea2.hottis.de
-      secretName: homea2-ui-cert
-  rules:
-    - host: homea2.hottis.de
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: ui
-                port:
-                  number: 80