K3S-HOME/security
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
142 Commits 1 Branch 0 Tags
130da5c76de47473e20a05f123d600cd382ce537
Commit Graph

142 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Mayne0213
130da5c76d CHORE(repo): remove self-referencing application.yaml 
- Delete application.yaml (managed by platform)
 2026-01-09 21:45:16 +09:00
Mayne0213
369181717b REFACTOR(authelia): switch to Deployment mode 
- Change from DaemonSet to Deployment with 1 replica
- Remove Redis dependency (not needed for single replica)
 2026-01-09 21:45:16 +09:00
Mayne0213
45ab6592d6 FIX(authelia): disable Redis authentication 
- Remove password requirement for Redis
- Simplify internal cluster communication
 2026-01-09 21:45:16 +09:00
Mayne0213
e6f496c439 FEAT(authelia): add Redis for session storage 
- Enable Redis for HA session support
- Configure session.redis settings
 2026-01-09 21:45:16 +09:00
Mayne0213
739ac544c7 REFACTOR(repo): standardize taint to control-plane 
- Remove deprecated master taint from falco
- Update vault tolerations to control-plane
- Change effect from NoExecute to NoSchedule
 2026-01-09 21:45:16 +09:00
Mayne0213
8f449666b5 CHORE(authelia): Remove immich OIDC client 
- Remove IMMICH_CLIENT_SECRET from extraVolumes/extraVolumeMounts
- Remove immich OIDC client configuration
- Immich application removed

CHORE(authelia): Remove IMMICH_CLIENT_SECRET from ExternalSecret
 2026-01-09 21:45:16 +09:00
Mayne0213
870eea8664 CHORE(authelia): remove replica setting for DaemonSet 
- Remove pod.replicas from helm-values.yaml
- DaemonSet does not use replica configuration
- Each node runs one pod automatically
 2026-01-09 21:45:16 +09:00
Mayne0213
66d845140e FIX(authelia): move affinity to top level 
- Move affinity from pod.affinity to top-level affinity
- Fix Helm chart schema validation error
- Maintain soft anti-affinity configuration

FIX(security): remove unsupported affinity from authelia

- Remove affinity from authelia (chart schema limitation)
- Fix external-secrets duplicate webhook/certController sections
- Merge affinity into respective component sections
- Authelia chart does not support affinity in values.yaml
 2026-01-09 21:45:16 +09:00
Mayne0213
cbf00275e8 FEAT(security): enable HA with replica 2 and soft anti-affinity 
- Add replicaCount: 2 to authelia, external-secrets, falco
- Add soft pod anti-affinity for node distribution
- Configure affinity for all security components
 2026-01-08 13:07:56 +09:00
Mayne0213
56c7c0d29d CHORE(trivy): remove Trivy vulnerability scanner 
- Delete trivy directory and configuration files
- Remove trivy from kustomization.yaml
- Reduce cluster resource usage
 2026-01-08 01:28:01 +09:00
Mayne0213
c24313154d FIX(security): remove CPU limits from falco and trivy 
- falco: set cpu: null to disable chart default (1 core)
- trivy: set cpu: null for operator and scan jobs (500m default)
 2026-01-08 00:33:13 +09:00
Mayne0213
31007c5586 PERF(resources): remove CPU limits - keep memory limits only 
- CPU throttling prevents app startup, not crashes
- Memory OOM is the real cascading failure cause
- CPU request ensures fair scheduling
 2026-01-07 23:48:43 +09:00
Mayne0213
5e161fca8a FEAT(external-secrets): add ClusterExternalSecret for Zot 
- Add zot-registry-credentials ClusterExternalSecret
- Auto-create dockerconfigjson in labeled namespaces
- API version v1 (v1beta1 deprecated)
 2026-01-07 14:28:58 +09:00
Mayne0213
41e8771889 FIX(authelia): fix Headlamp OIDC token auth 
- Change token_endpoint_auth_method to client_secret_basic
- Headlamp uses client_secret_basic by default
- Authelia was configured with client_secret_post
- Fix token exchange failure causing login redirect loop
 2026-01-07 02:23:50 +09:00
Mayne0213
7cdc4f1e9e FIX(external-secrets): disable CRD installation via Helm 
- Set installCRDs: false to avoid annotation size limit
- CRDs already installed, manual upgrade when needed
 2026-01-07 01:24:07 +09:00
Mayne0213
661659acdb FIX(external-secrets): ignore CRD status in diff 
- Add /status to ignoreDifferences for CRDs
- Fix comparison error with terminatingReplicas field
 2026-01-07 01:20:02 +09:00
Mayne0213
3ea8b0d7c9 REVERT(external-secrets): remove ServerSideApply 
- ServerSideApply causes schema compatibility issues
- Removed annotations directly from CRDs instead
 2026-01-07 01:18:44 +09:00
Mayne0213
835395f7ec FIX(external-secrets): add ServerSideApply for CRD sync 
- Fix CRD annotation size limit exceeded error
- ServerSideApply avoids last-applied-configuration annotation
 2026-01-07 01:15:03 +09:00
Mayne0213
384d73d1fa REFACTOR(secrets): flatten Vault paths 
- Change secret paths from <category>/<app> to <app>
- databases/postgresql → postgresql
- cluster-infrastructure/authelia → authelia
 2026-01-06 16:53:10 +09:00
Mayne0213
677214b848 REFACTOR(repo): move vault/ to manifests/ 
- Move ExternalSecret file from vault/ to manifests/secret.yaml
- Update kustomization.yaml references
- Remove vault/ folder

Apps: authelia
 2026-01-06 16:43:38 +09:00
Mayne0213
3c51bb3b5e FIX(authelia): keep ingress in manifests 
- Keep ingress in manifests/ due to chart schema complexity
- Authelia chart has complex ingress schema
 2026-01-06 15:27:17 +09:00
Mayne0213
52bc1b9d57 FIX(authelia): use rulesOverride for config 
- Use rulesOverride for access control configuration
- Fix invalid Helm values properties
 2026-01-06 15:26:24 +09:00
Mayne0213
875dbbc42c REFACTOR(authelia): integrate ingress in values 
- Move config.yaml, middleware.yaml, rbac.yaml to manifests/
- Add ingress configuration to helm-values.yaml
- Remove separate ingress.yaml
 2026-01-06 15:12:22 +09:00
Mayne0213
6fbf2b16c2 REFACTOR(vault): move resources to manifests 
- Move additional resources to manifests/ folder
- Separate from Helm chart configuration
 2026-01-06 01:38:33 +09:00
Mayne0213
321685822f REFACTOR(repo): security repo structure 
- Add application.yaml for ArgoCD app-of-apps
- Add kustomization.yaml with security components
- Add renovate.json for automated updates
- Update all component argocd.yaml repoURLs to security repo

Components: authelia, vault, external-secrets, falco, trivy
 2026-01-05 00:40:26 +09:00
Mayne0213
27ba06b750 REFACTOR(grafana): remove Falco and Traefik UI 
- Use Grafana dashboards instead
- Delete falco-ui-secret ExternalSecret
- Delete traefik dashboard IngressRoute
 2026-01-05 00:40:26 +09:00
Mayne0213
c90574aee2 REFACTOR(grafana): remove Trivy UI 
- Use Grafana dashboard instead
- Delete trivy-ui ArgoCD Application
- Delete trivy ingress.yaml
- Update kustomization.yaml
 2026-01-05 00:40:26 +09:00
Mayne0213
c51cca27d8 CHORE(falco): disable sidekick-ui and Redis 
- Use Grafana dashboard instead
- Set webui.enabled: false (disables UI and Redis)
- Remove ingress.yaml for falco-ui
- Saves ~384Mi memory (Redis 256Mi + UI 128Mi)
 2026-01-05 00:40:26 +09:00
Mayne0213
c66801a166 FEAT(falco): add loki output to falcosidekick 
- Send Falco events directly to Loki
- Enables viewing detailed events in Grafana with all fields
- Same data as Falco UI but queryable in Grafana
 2026-01-05 00:40:26 +09:00
Mayne0213
76c5fd8343 FIX(falco): use SM create instead of enabled 
- Falco chart uses 'serviceMonitor.create' not 'enabled'
- Add release: prometheus label for Prometheus discovery
 2026-01-05 00:40:26 +09:00
Mayne0213
d4b84305a2 FIX(redis): use customConfig for maxmemory 
- extraArgs was not being applied to Redis container
- Use customConfig which is the correct way to set Redis directives
- maxmemory 800mb with allkeys-lru policy
 2026-01-05 00:40:26 +09:00
Mayne0213
94dcb7d585 FEAT(falco): add 6h TTL to sidekick-ui 
- to prevent Redis OOM
- Events older than 6 hours are auto-deleted
- Prevents linear memory growth in Redis
 2026-01-05 00:40:26 +09:00
Mayne0213
9822441e38 REFACTOR(repo): migrate repoURL to K3S-HOME 
- Update repository URL to K3S-HOME organization
- Change from personal to organization repo
 2026-01-05 00:40:26 +09:00
Mayne0213
4e4be3109a FIX(external-secrets): fix ESO CRD OutOfSync 
- Add ignoreDifferences for CRD caBundle and spec/versions
- Add RespectIgnoreDifferences syncOption
- Prevents ArgoCD from detecting drift on CRD fields managed by webhook
 2026-01-05 00:40:26 +09:00
Mayne0213
168193845b FIX(authelia): fix TOTP config for chart 0.10.x 
- Change enabled to disable for TOTP configuration
- Fix chart compatibility
 2026-01-05 00:40:26 +09:00
renovate[bot]
a6342a2fdd CHORE(authelia): update authelia to 0.10.x 
- Upgrade Authelia chart version
- Apply dependency updates
 2026-01-05 00:40:26 +09:00
renovate[bot]
8fd3daa65f CHORE(external-secrets): update ESO to v1.2.1 
- Upgrade External Secrets Operator chart
- Apply dependency updates
 2026-01-05 00:40:26 +09:00
Mayne0213
fd31dc3c65 REFACTOR(authelia): remove redirect to Vault 
- Remove redirect configuration to Vault
- Clean up authentication flow
 2026-01-05 00:40:26 +09:00
Mayne0213
1cd89f6bae REFACTOR(falco): remove CPU limit 
- Set cpu: null to override chart default (1 core)
- Prevents CPU throttling under high load
 2026-01-05 00:40:26 +09:00
Mayne0213
bce1bdf12b FIX(trivy): fix Trivy resource limits 
- Operator: add 512Mi memory limit
- Scan jobs: increase memory limit 500M -> 768Mi
- Reduce concurrent scan jobs 3 -> 2
 2026-01-05 00:40:26 +09:00
Mayne0213
c67b720ee4 FIX(falco): falco oom issues 
- increase memory limits
- Falco: add 512Mi memory limit
- Falcosidekick: increase memory limit 256Mi -> 512Mi
- Redis: increase memory limit 512Mi -> 1Gi (was 84 restarts)
- Redis: increase maxmemory 400mb -> 800mb
 2026-01-05 00:40:26 +09:00
Mayne0213
a9a4ed1bf3 FIX(authelia): increase Authelia memory limit 
- to 256Mi
OOMKilled with 128Mi limit. Increased to 256Mi for stability.
 2026-01-05 00:40:26 +09:00
Mayne0213
589b98a875 REFACTOR(trivy): remove Trivy scan job CPU limit 
- Remove CPU limit to prevent throttling
- Optimize scan job performance
 2026-01-05 00:40:26 +09:00
Mayne0213
ede767498d PERF(redis): increase Redis memory limit to 512Mi 
- Increase memory limit to prevent OOM
- Optimize Redis configuration
 2026-01-05 00:40:26 +09:00
Mayne0213
a0e483a8c4 FEAT(trivy): add ignoreDiff for trivy-ui CPU limit 
- Add ignoreDifferences for CPU limit field
- Prevent ArgoCD sync drift
 2026-01-05 00:40:26 +09:00
Mayne0213
59b834c250 REFACTOR(resources): use tilde for null CPU 
- Use ~ (tilde) for null CPU limit values
- YAML best practice for null
 2026-01-05 00:40:26 +09:00
Mayne0213
e1ecf43096 REFACTOR(trivy): remove trivy-ui CPU limit 
- Remove CPU limit to prevent throttling
- Optimize resource configuration
 2026-01-05 00:40:26 +09:00
Mayne0213
1a551b47ca PERF(falco): optimize falco rules 
- and add sidekick memory limit
- Add macros to exclude trivy, postgres, minio, vault from rules
- Disable Container Drift Detection (too noisy)
- Remove /etc/passwd from sensitive file access (normal lookups)
- Add 256Mi memory limit to falcosidekick (was using 1.1GB)
 2026-01-05 00:40:26 +09:00
Mayne0213
8d46ae9e49 FEAT(immich): add email to admin user for OAuth 
- Add email field to admin user
- Required for Immich OAuth integration
 2026-01-05 00:40:26 +09:00
Mayne0213
04bc972466 FEAT(authelia): add Immich as OIDC client in Authelia 
- Add Immich OIDC client configuration
- Enable OAuth authentication for Immich
 2026-01-05 00:40:26 +09:00