68b6aa8313
Full migration off Scaleway Container Registry to internal GitLab registry backed by MinIO S3. All 4 images (ci-builder, ci-builder-cpu, foxhunt-runtime, foxhunt-training-runtime) rebuilt in internal registry. Registry & images: - All image refs → gitlab-registry.foxhunt.svc.cluster.local:5000/root/foxhunt/ - imagePullSecrets: scw-registry → gitlab-registry - Kaniko build template: two-step DAG (git-clone → kaniko-build) with shared PVC - Kaniko layer cache enabled at root/foxhunt/cache - AWS_ACCESS_KEY_ID: $SCW_ACCESS_KEY → $MINIO_ACCESS_KEY in .gitlab-ci.yml Network policies: - ci-pipeline: add HTTP/80, registry/5000, webservice/8181 egress rules DNS & Tailscale proxy cleanup: - Remove ci, prometheus, monitor DNS records (no longer exposed) - Rename s3 → minio DNS record - Remove Argo UI, Prometheus, monitor nginx server blocks - Remove argo-htpasswd volume mount - Tailscale proxy nodeSelector: infra → platform Terraform cleanup: - Delete infra/modules/registry/ (SCW CR namespace) - Delete infra/modules/object-storage/ (SCW S3 buckets) - Delete infra/modules/secrets/ (SCW secrets) - Delete corresponding live configs - TF state backend: S3 → GitLab HTTP Argo workflows: - Add events/ (GitLab push eventsource + ci-pipeline sensor) - ci-pipeline + training templates: SCW → internal registry - Delete obsolete compile-training-template.yaml Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
170 lines
4.0 KiB
YAML
170 lines
4.0 KiB
YAML
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: argo-training-workflow
|
|
namespace: foxhunt
|
|
labels:
|
|
app.kubernetes.io/part-of: foxhunt
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/component: training-workflow
|
|
policyTypes:
|
|
- Egress
|
|
egress:
|
|
# Kubernetes API — Argo executor reports task results
|
|
- ports:
|
|
- port: 443
|
|
protocol: TCP
|
|
- port: 6443
|
|
protocol: TCP
|
|
to:
|
|
- ipBlock:
|
|
cidr: 10.32.0.0/16
|
|
- ipBlock:
|
|
cidr: 172.16.0.4/32
|
|
# MinIO — binary fetch + result upload
|
|
- ports:
|
|
- port: 9000
|
|
protocol: TCP
|
|
to:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: minio
|
|
# Tempo — OTLP traces
|
|
- ports:
|
|
- port: 4317
|
|
protocol: TCP
|
|
to:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: tempo
|
|
---
|
|
# Compile workflow pods: need GitLab SSH, MinIO, k8s API, external HTTPS (cargo deps)
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: argo-compile-workflow
|
|
namespace: foxhunt
|
|
labels:
|
|
app.kubernetes.io/part-of: foxhunt
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/component: compile
|
|
policyTypes:
|
|
- Egress
|
|
egress:
|
|
# DNS — resolve external hostnames (crates.io, github.com)
|
|
- ports:
|
|
- port: 53
|
|
protocol: UDP
|
|
- port: 53
|
|
protocol: TCP
|
|
# Kubernetes API — Argo executor
|
|
- ports:
|
|
- port: 443
|
|
protocol: TCP
|
|
- port: 6443
|
|
protocol: TCP
|
|
to:
|
|
- ipBlock:
|
|
cidr: 10.32.0.0/16
|
|
- ipBlock:
|
|
cidr: 172.16.0.4/32
|
|
# External HTTPS — cargo fetches crates.io, github.com (candle git dep)
|
|
- ports:
|
|
- port: 443
|
|
protocol: TCP
|
|
# GitLab SSH — git clone (Tailscale IP + cluster service)
|
|
- ports:
|
|
- port: 2222
|
|
protocol: TCP
|
|
to:
|
|
- ipBlock:
|
|
cidr: 100.90.76.85/32
|
|
- podSelector:
|
|
matchLabels:
|
|
app: gitlab-shell
|
|
# MinIO — binary upload
|
|
- ports:
|
|
- port: 9000
|
|
protocol: TCP
|
|
to:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: minio
|
|
---
|
|
# CI pipeline pods (detect-changes + compile-service inline templates)
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: argo-ci-pipeline
|
|
namespace: foxhunt
|
|
labels:
|
|
app.kubernetes.io/part-of: foxhunt
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/component: ci-pipeline
|
|
policyTypes:
|
|
- Egress
|
|
egress:
|
|
# DNS — resolve external hostnames
|
|
- ports:
|
|
- port: 53
|
|
protocol: UDP
|
|
- port: 53
|
|
protocol: TCP
|
|
# Kubernetes API — Argo executor
|
|
- ports:
|
|
- port: 443
|
|
protocol: TCP
|
|
- port: 6443
|
|
protocol: TCP
|
|
to:
|
|
- ipBlock:
|
|
cidr: 10.32.0.0/16
|
|
- ipBlock:
|
|
cidr: 172.16.0.4/32
|
|
# External HTTP/HTTPS — Kaniko base image pulls, apt-get, cargo fetches
|
|
- ports:
|
|
- port: 80
|
|
protocol: TCP
|
|
- port: 443
|
|
protocol: TCP
|
|
# GitLab SSH — git clone (compile-service uses ssh://git@git.fxhnt.ai)
|
|
- ports:
|
|
- port: 2222
|
|
protocol: TCP
|
|
to:
|
|
- ipBlock:
|
|
cidr: 100.90.76.85/32
|
|
- podSelector:
|
|
matchLabels:
|
|
app: gitlab-shell
|
|
# MinIO — binary upload from compile-service
|
|
- ports:
|
|
- port: 9000
|
|
protocol: TCP
|
|
to:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: minio
|
|
# GitLab registry — Kaniko image push
|
|
- ports:
|
|
- port: 5000
|
|
protocol: TCP
|
|
to:
|
|
- podSelector:
|
|
matchLabels:
|
|
app: registry
|
|
# GitLab webservice — JWT auth for registry tokens
|
|
- ports:
|
|
- port: 8181
|
|
protocol: TCP
|
|
to:
|
|
- podSelector:
|
|
matchLabels:
|
|
app: webservice
|