cd-service account role revision (removed access to networking.k8s.io and policy), helm values reviewed to run on cicd pipeline and ingress moved to infra

deploy/infra/cd-serviceaccount.yaml

@@ -24,7 +24,7 @@ metadata:
   name: continuous-deploy
 rules:
 - apiGroups: [""]
-  resources: ["pods", "services", "secrets", "configmaps", "persistentvolumeclaims", "endpoints", "serviceaccounts"]
+  resources: ["pods", "services", "secrets", "configmaps", "persistentvolumeclaims"]
   verbs: ["get", "watch", "list", "create", "update", "patch", "delete"]
 
 - apiGroups: ["apps"]
@@ -35,15 +35,6 @@ rules:
   resources: ["cronjobs", "jobs"]
   verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
 
-- apiGroups: ["networking.k8s.io"]
-  resources: ["networkpolicies", "ingresses"]
-  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-
-- apiGroups: ["policy"]
-  resources: ["poddisruptionbudgets"]
-  verbs: ["get", "list", "watch", "update", "patch"]
-
-
 ---
 
 apiVersion: rbac.authorization.k8s.io/v1

deploy/infra/ingress.yaml

@@ -0,0 +1,27 @@
+
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: git-limbosolutions-com
+  namespace: git-limbosolutions-com
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    kubernetes.io/ingress.class: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure, public-https
+spec: 
+  ingressClassName: traefik
+  rules:
+    - host: git.limbosolutions.com
+      http:
+        paths:
+        - backend:
+            service:
+              name: gitea-http
+              port:
+                number: 3000
+          path: /
+          pathType: Prefix
+  tls:
+    - secretName: limbosolutions-com-tls
+      hosts:
+        - "git.limbosolutions.com"

deploy/infra/kustomization.yaml

@@ -2,7 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - namespace.yaml
-  - continuous-deploy-account.yaml
+  - cd-serviceaccount.yaml
+  - ingress.yaml
   - network-policies/egress.yaml
   - network-policies/egress-local-services.yaml
   - network-policies/ingress.yaml