K3S-HOME/security
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
150 Commits 1 Branch 0 Tags
16dd9d88aa9c59bc2c5bf6942888403842669087
Commit Graph

63 Commits

Author SHA1 Message Date
Mayne0213
b7d3c5bab1 PERF(falco): optimize falco cpu request 
- for worker-node-2
Reduced Falco DaemonSet CPU request to prevent node-agent
scheduling failures:
- Falco: 50m → 40m (actual usage ~39m)

This optimization frees up 10m CPU per node. On worker-node-2,
this contributes to the total 110m CPU savings needed for
Velero node-agent (30m request) to be scheduled successfully.

Worker-node-2 CPU allocation before: 840m/1000m (84%)
Worker-node-2 CPU allocation after: 730m/1000m (73%)
 2026-01-04 23:41:39 +09:00
Mayne0213
9bdb035d93 PERF(falco): reduce Falco resource requests 
- Reduce CPU/memory requests for worker-node-2 optimization
- Free up resources
 2026-01-04 23:41:39 +09:00
Mayne0213
7eba5c06c4 FEAT(velero): activate HTTPS in Falco and update Velero version 
- Enable HTTPS for Falco UI
- Update Velero chart version
 2026-01-04 23:41:39 +09:00
Mayne0213
25d0bc2c55 FIX(falco): disable SSL redirect for Falco UI 
- Disable SSL redirect on ingress
- Fix routing configuration
 2026-01-04 23:41:39 +09:00
Mayne0213
fe6cc1f9e7 REFACTOR(falco): move Falco Ingress to falco folder 
- Move ingress configuration to falco directory
- Disable SSL redirect
 2026-01-04 23:41:39 +09:00
Mayne0213
81e000260f FEAT(falco): add Falco UI Ingress via infrastructure 
- Add ingress for Falco UI
- Configure routing
 2026-01-04 23:41:39 +09:00
Mayne0213
c5c5a7e469 FEAT(falco): add HAProxy Ingress for Falco UI 
- Add HAProxy ingress at falco0213.kro.kr
- Configure SSL/TLS
 2026-01-04 23:41:39 +09:00
Mayne0213
ac5fde6ba4 FIX(repo): simplify ignoreDiff for all StatefulSets 
- Simplify ignoreDifferences configuration
- Reduce complexity
 2026-01-04 23:41:39 +09:00
Mayne0213
70eb551871 FIX(falco): disable selfHeal for Falco 
- Prevent StatefulSet drift issues
- Disable automatic healing
 2026-01-04 23:41:39 +09:00
Mayne0213
3f18a3cdf8 FEAT(repo): enhance syncPolicy and ignoreDiff for StatefulSet 
- Add enhanced sync policy
- Configure ignoreDifferences for StatefulSet
 2026-01-04 23:41:39 +09:00
Mayne0213
c2b9175b8b FIX(storage): improve ignoreDiff for StatefulSet PVC retention 
- Improve ignoreDifferences configuration
- Handle PVC retention policy
 2026-01-04 23:41:39 +09:00
Mayne0213
18dac6b77f FIX(falco): change Falco driver to modern_ebpf 
- Use modern_ebpf driver for kernel 6.14 compatibility
- Fix kernel module issues
 2026-01-04 23:41:39 +09:00
Mayne0213
10308d48d0 FEAT(velero): Add Velero, Falco, 
- and CNPG infrastructure components
Add three critical infrastructure components via GitOps:

- Velero: Backup and disaster recovery solution
  - Configured with Minio S3 backend
  - Daily full cluster backups (30-day retention)
  - Hourly backups for critical namespaces (7-day retention)
  - Credentials managed via External Secrets from Vault

- Falco: Runtime security monitoring
  - eBPF-based threat detection
  - Custom rules for container security
  - Falcosidekick for alert forwarding
  - Prometheus metrics enabled

- CNPG (CloudNativePG): PostgreSQL operator
  - Kubernetes-native PostgreSQL management
  - Automated failover and backups
  - Will replace Bitnami PostgreSQL

All components follow existing GitOps patterns:
- Helm charts deployed via ArgoCD
- Values managed in Git
- Automated sync with selfHeal enabled
 2026-01-04 23:41:39 +09:00