feat: crowdsec lapi helm

.gitignore

@@ -105,3 +105,4 @@ temp/*
 !*/k8s/*secret*.example
 traefik/k8s/local-tls.yaml
 convertx/k8s/config.yaml
+traefik/k8s/crowdsec-middleware.yaml

traefik/k8s/crowdsec-middleware.yaml.example

@@ -0,0 +1,14 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: crowdsec-bouncer
+  namespace: crowdsec
+spec:
+  plugin:
+    crowdsec-bouncer:
+      enabled: true
+      LogLevel: INFO
+      CrowdsecMode: live
+      CrowdsecLapiScheme: http
+      CrowdsecLapiHost: crowdsec-service.crowdsec.svc.cluster.local:8080
+      CrowdsecLapiKey: "TOKEN"

traefik/k8s/crowdsec-values.yaml

@@ -0,0 +1,29 @@
+container_runtime: containerd
+agent:
+  env:
+    - name: COLLECTIONS
+      value: "crowdsecurity/traefik crowdsecurity/base-http-scenarios LePresidente/adguardhome-bf"
+  acquisition:
+    - namespace: traefik
+      podName: "*traefik*"
+      program: traefik
+      poll_without_inotify: true
+  resources:
+    requests:
+      cpu: 50m
+      memory: 100Mi
+    limits:
+      cpu: 200m
+      memory: 500Mi
+
+lapi:
+  env:
+    - name: COLLECTIONS
+      value: "crowdsecurity/traefik crowdsecurity/base-http-scenarios LePresidente/adguardhome-bf"
+  resources:
+    requests:
+      cpu: 50m
+      memory: 150Mi
+    limits:
+      cpu: 200m
+      memory: 500Mi

traefik/k8s/traefik-values.yaml

@@ -13,6 +13,8 @@ service:
   type: LoadBalancer
   annotations:
     metallb.io/loadBalancerIPs: "192.168.80.2"
+  spec:
+    externalTrafficPolicy: Local
 api:
   dashboard: true
   insecure: true
@@ -115,10 +117,19 @@ volumes:
 additionalArguments:
   - "--providers.file.directory=/etc/traefik/dynamic"
   - "--providers.file.watch=true"
+  - "--providers.kubernetesCRD.allowCrossNamespace=true"
+  - "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22,192.168.1.1,192.168.1.0/24,192.168.88.0/24,192.168.88.1"
+  - "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22,192.168.1.1,192.168.1.0/24,192.168.88.0/24,192.168.88.1"
 
 logs:
   general:
     level: INFO
-    format: json
   access:
     enabled: true
+    format: common
+
+experimental:
+  plugins:
+    crowdsec-bouncer:
+      moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
+      version: v1.3.3