Kubernetes Bunny CDN ACL Manager - Automate Bunny CDN IP management in Kubernetes effortlessly.

Kubernetes Bunny CDN ACL Manager

Automate Bunny CDN IP management in Kubernetes effortlessly.

Pitch

Kubernetes Bunny CDN ACL Manager simplifies the management of Bunny CDN edge server IP addresses within Kubernetes. It features automated daily updates, secure RBAC permissions, and support for both IPv4 and IPv6. This tool streamlines the configuration of trusted proxies, ensuring effective and secure integration with applications like Mastodon.

Description

Kubernetes Bunny CDN ACL Manager provides an automated solution for managing Bunny CDN edge server IP addresses within Kubernetes environments. This tool enhances trusted proxy configurations by allowing seamless retrieval and management of IP addresses for both IPv4 and IPv6 protocols.

Key Features

Automated Daily Updates: Scheduled CronJob that runs daily at 2 AM UTC ensures that the list of trusted IPs is always current.
Secure Role-Based Access Control (RBAC): Implements least privilege access using namespace-scoped permissions to enhance security.
IPv4 and IPv6 Support: Effortlessly fetches IP addresses from Bunny CDN for both address types.
Monitoring Ready: Includes robust logging and status tracking for thorough monitoring of the system.
Easy Integration: Designed for straightforward integration with various applications through multiple consumption methods.
Security Hardened: Operates in non-root containers with read-only filesystems and enforced resource limits for enhanced security.

Usage Example

To integrate Bunny CDN trusted proxy IPs in applications, environment variables or file mounts can be used:

Environment Variable

env:
- name: TRUSTED_PROXY_IPS
  valueFrom:
    configMapKeyRef:
      name: bunny-trusted-ips
      key: TRUSTED_PROXY_IP

File Mount

volumeMounts:
- name: trusted-ips
  mountPath: /etc/trusted-ips
  readOnly: true
volumes:
- name: trusted-ips
  configMap:
    name: bunny-trusted-ips

Integration with Mastodon

The project includes a special integration for the Mastodon Helm chart, simplifying the setup of trusted proxy configurations:

# Deploy Mastodon integration
kubectl apply -f examples/mastodon-integration.yaml

# Use provided Helm values
helm install mastodon mastodon/mastodon \
  --namespace mastodon \
  --values examples/mastodon-values.yaml

For a detailed setup guide, refer to docs/MASTODON_INTEGRATION.md.

Monitoring and Management

Utilize built-in commands to monitor the status and logs:

# Check CronJob status
kubectl get cronjob bunny-ip-updater

# View recent job logs
kubectl logs -l job-name=bunny-ip-updater --tail=50

# Check IP count
kubectl get configmap bunny-trusted-ips -o jsonpath='{.data.TRUSTED_PROXY_IP}' | tr ',' '\n' | wc -l

# Use monitoring script for advanced checks
./scripts/monitor.sh status
./scripts/monitor.sh compare  # Compare with live API

Repository Structure

The repository is organized for ease of use and includes:

├── bunny-ip-updater.yaml               # Main Kubernetes manifests
├── examples/                            # Integration examples
│   ├── app-deployment.yaml             # Basic application integration
│   ├── mastodon-integration.yaml       # Mastodon Helm chart integration
│   ├── mastodon-values.yaml            # Mastodon Helm values template
│   └── nginx-config.yaml               # Nginx configuration example
├── scripts/                             # Deployment and monitoring scripts
│   ├── setup.sh                        # Interactive deployment script
│   └── monitor.sh                      # Monitoring and management tools
├── docs/                               # Documentation
│   └── MASTODON_INTEGRATION.md         # Detailed Mastodon integration guide
├── .github/workflows/                  # CI/CD workflows
│   └── semgrep.yml                     # Security scanning
├── CLAUDE.md                           # AI assistant instructions
└── README.md                           # This file

Security Measures

This project implements a range of security best practices:

Operates exclusively within the deployment namespace using RBAC.
Access is tailored to specific resources, specifically the bunny-trusted-ips ConfigMap.
Runs non-root containers and utilizes a read-only filesystem to mitigate security risks.
Enforces resource limits on memory, CPU, and storage to optimize efficiency.

0 comments

No comments yet.

New comment