Initialisation depot

arti-api/traefik-ingressroute.yaml

@@ -0,0 +1,330 @@
+# Traefik v2 IngressRoute Configuration for Artifactory Services
+# Allows internal network (192.168.100.0/24) full access
+# Restricts external access to health endpoints only
+
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: arti-api-ingressroute
+  namespace: artifactory
+spec:
+  entryPoints:
+    - web
+    - websecure
+  routes:
+  # Route for health endpoints (accessible externally)
+  - match: Host(`api.artifactory.local`) && (Path(`/`) || Path(`/health`))
+    kind: Rule
+    services:
+    - name: arti-api-service
+      port: 8000
+    middlewares:
+    - name: api-health-headers
+
+  # Route for all other endpoints (internal network only)
+  - match: Host(`api.artifactory.local`) && !ClientIP(`192.168.100.0/24`)
+    kind: Rule
+    services:
+    - name: arti-api-service
+      port: 8000
+    middlewares:
+    - name: block-external-management
+
+  # Route for internal network (full access)
+  - match: Host(`api.artifactory.local`) && ClientIP(`192.168.100.0/24`)
+    kind: Rule
+    services:
+    - name: arti-api-service
+      port: 8000
+    middlewares:
+    - name: internal-access-headers
+
+  tls:
+    secretName: artifactory-tls
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: docker-registry-ingressroute
+  namespace: artifactory
+spec:
+  entryPoints:
+    - web
+    - websecure
+  routes:
+  # Route for health endpoint (accessible externally)
+  - match: Host(`registry.artifactory.local`) && Path(`/v2/`)
+    kind: Rule
+    services:
+    - name: docker-registry-service
+      port: 5000
+    middlewares:
+    - name: registry-health-headers
+
+  # Block external access to push/pull operations
+  - match: Host(`registry.artifactory.local`) && (PathPrefix(`/v2/`) && !Path(`/v2/`)) && !ClientIP(`192.168.100.0/24`)
+    kind: Rule
+    services:
+    - name: docker-registry-service
+      port: 5000
+    middlewares:
+    - name: block-external-registry-ops
+
+  # Route for internal network (full access)
+  - match: Host(`registry.artifactory.local`) && ClientIP(`192.168.100.0/24`)
+    kind: Rule
+    services:
+    - name: docker-registry-service
+      port: 5000
+    middlewares:
+    - name: internal-access-headers
+
+  tls:
+    secretName: artifactory-tls
+---
+# Middleware to add security headers for health endpoints
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: api-health-headers
+  namespace: artifactory
+spec:
+  headers:
+    customRequestHeaders:
+      X-Access-Type: "external-health"
+    customResponseHeaders:
+      X-Allowed-Endpoints: "health-only"
+      X-Access-Level: "limited"
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: charts-health-headers
+  namespace: artifactory
+spec:
+  headers:
+    customRequestHeaders:
+      X-Access-Type: "external-health"
+    customResponseHeaders:
+      X-Allowed-Endpoints: "health-only"
+      X-Access-Level: "limited"
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: registry-health-headers
+  namespace: artifactory
+spec:
+  headers:
+    customRequestHeaders:
+      X-Access-Type: "external-health"
+    customResponseHeaders:
+      X-Allowed-Endpoints: "health-only"
+      X-Access-Level: "limited"
+---
+# Middleware to block external access to management endpoints
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: block-external-management
+  namespace: artifactory
+spec:
+  errors:
+    status:
+      - "403"
+    service:
+      name: error-service
+      port: 80
+    query: "/403.html"
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: block-external-charts-api
+  namespace: artifactory
+spec:
+  errors:
+    status:
+      - "403"
+    service:
+      name: error-service
+      port: 80
+    query: "/403.html"
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: block-external-registry-ops
+  namespace: artifactory
+spec:
+  errors:
+    status:
+      - "403"
+    service:
+      name: error-service
+      port: 80
+    query: "/403.html"
+---
+# Middleware for internal network access
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: internal-access-headers
+  namespace: artifactory
+spec:
+  headers:
+    customRequestHeaders:
+      X-Access-Type: "internal"
+    customResponseHeaders:
+      X-Access-Level: "full"
+      X-Network: "internal"
+---
+# Middleware for external Chart Museum access (limited)
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: charts-external-access
+  namespace: artifactory
+spec:
+  headers:
+    customRequestHeaders:
+      X-Access-Type: "external-limited"
+    customResponseHeaders:
+      X-Access-Level: "read-only"
+      X-Blocked-Paths: "/api/*"
+---
+# Error service for displaying 403 pages
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: error-service
+  namespace: artifactory
+  labels:
+    app: error-service
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: error-service
+  template:
+    metadata:
+      labels:
+        app: error-service
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:alpine
+        ports:
+        - containerPort: 80
+        volumeMounts:
+        - name: error-pages
+          mountPath: /usr/share/nginx/html
+        resources:
+          requests:
+            memory: "32Mi"
+            cpu: "50m"
+          limits:
+            memory: "64Mi"
+            cpu: "100m"
+      volumes:
+      - name: error-pages
+        configMap:
+          name: error-pages-config
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: error-service
+  namespace: artifactory
+  labels:
+    app: error-service
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: 80
+    protocol: TCP
+  selector:
+    app: error-service
+---
+# ConfigMap with custom error pages
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: error-pages-config
+  namespace: artifactory
+data:
+  403.html: |
+    <!DOCTYPE html>
+    <html>
+    <head>
+        <title>Access Denied - Artifactory</title>
+        <style>
+            body { 
+                font-family: Arial, sans-serif; 
+                text-align: center; 
+                padding: 50px;
+                background-color: #f8f9fa;
+            }
+            .container {
+                max-width: 600px;
+                margin: 0 auto;
+                background: white;
+                padding: 40px;
+                border-radius: 8px;
+                box-shadow: 0 2px 10px rgba(0,0,0,0.1);
+            }
+            .error-code {
+                font-size: 4em;
+                color: #dc3545;
+                margin-bottom: 20px;
+            }
+            .error-message {
+                font-size: 1.5em;
+                color: #333;
+                margin-bottom: 20px;
+            }
+            .error-description {
+                color: #666;
+                margin-bottom: 30px;
+            }
+            .access-info {
+                background: #e3f2fd;
+                padding: 20px;
+                border-radius: 4px;
+                border-left: 4px solid #2196f3;
+            }
+        </style>
+    </head>
+    <body>
+        <div class="container">
+            <div class="error-code">403</div>
+            <div class="error-message">Access Denied</div>
+            <div class="error-description">
+                This endpoint is restricted to internal network access only.
+            </div>
+            <div class="access-info">
+                <strong>For Internal Network Users (192.168.100.0/24):</strong><br>
+                You have full access to all management endpoints.<br><br>
+                <strong>For External Users:</strong><br>
+                Only health check endpoints are available:
+                <ul style="text-align: left; display: inline-block;">
+                    <li>API Health: <code>/health</code></li>
+                    <li>Chart Museum: <code>/health</code></li>
+                    <li>Docker Registry: <code>/v2/</code></li>
+                </ul>
+            </div>
+        </div>
+    </body>
+    </html>
+  index.html: |
+    <!DOCTYPE html>
+    <html>
+    <head>
+        <title>Artifactory Error Service</title>
+    </head>
+    <body>
+        <h1>Artifactory Error Service</h1>
+        <p>This service provides custom error pages for the Artifactory platform.</p>
+    </body>
+    </html>