K3S-HOME/security
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
167 Commits 1 Branch 0 Tags
2cfcc586bef4be0299aacce2c9bb3e88df9c7629
Commit Graph

38 Commits

Author SHA1 Message Date
Mayne0213
2cfcc586be refactor: update Vault secret paths to new categorized structure 
- authelia: postgresql → storage/postgresql, authelia → security/authelia
- external-secrets: zot → storage/zot (ClusterExternalSecret)
- vault: secret/data/vault/config → security/vault, authelia → security/authelia

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-11 22:36:33 +09:00
Mayne0213
5e717ff9b1 migrate: change repoURLs from GitHub to Gitea 
Update all ArgoCD Application references to use Gitea (github0213.com)
instead of GitHub for K3S-HOME/security repository.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-10 20:43:23 +09:00
Mayne0213
d29651af7a REFACTOR(repo): remove control-plane scheduling 
- Remove nodeSelector for control-plane node
- Remove tolerations for control-plane taint
- Allow pods to schedule on any available node
 2026-01-10 18:35:15 +09:00
Mayne0213
5acc1c7f9e PERF(security): adjust resources based on VPA 
- Update authelia memory 256Mi→194Mi
- Update authelia redis cpu 10m→23m, memory 64Mi→100Mi
- Update falco memory 263Mi→283Mi
- Update falcosidekick cpu 10m→15m, memory 128Mi→100Mi
- Update external-secrets operator cpu 5m→15m, memory 128Mi→100Mi
- Update external-secrets webhook cpu 2m→15m, memory 128Mi→100Mi
- Update external-secrets certController cpu 2m→15m, memory 256Mi→283Mi
- Update vault cpu 35m→49m, memory 263Mi→175Mi
 2026-01-10 14:32:33 +09:00
Mayne0213
119e86d482 PERF(vault): add high-priority class 
- Add high-priority PriorityClass
- Keep tolerations for HA across all nodes (3 replicas)
 2026-01-10 13:14:08 +09:00
Mayne0213
5f9573133e FIX(authelia): configure OIDC claims and scopes 
- Remove groups scope (not provided by Authelia)
- Add claims_policy for preferred_username
- Remove sub from claims_policy (standard claim)
 2026-01-10 01:16:58 +09:00
Mayne0213
507cb61ec4 FEAT(vault): add OIDC auth for Authelia SSO 
- Add ExternalSecret for VAULT_CLIENT_SECRET
- Configure default and admin roles for OIDC login
- Fix claim settings (use sub instead of preferred_username)
- Remove oidc-setup-job (already configured)
 2026-01-10 01:16:57 +09:00
Mayne0213
739ac544c7 REFACTOR(repo): standardize taint to control-plane 
- Remove deprecated master taint from falco
- Update vault tolerations to control-plane
- Change effect from NoExecute to NoSchedule
 2026-01-09 21:45:16 +09:00
Mayne0213
31007c5586 PERF(resources): remove CPU limits - keep memory limits only 
- CPU throttling prevents app startup, not crashes
- Memory OOM is the real cascading failure cause
- CPU request ensures fair scheduling
 2026-01-07 23:48:43 +09:00
Mayne0213
6fbf2b16c2 REFACTOR(vault): move resources to manifests 
- Move additional resources to manifests/ folder
- Separate from Helm chart configuration
 2026-01-06 01:38:33 +09:00
Mayne0213
321685822f REFACTOR(repo): security repo structure 
- Add application.yaml for ArgoCD app-of-apps
- Add kustomization.yaml with security components
- Add renovate.json for automated updates
- Update all component argocd.yaml repoURLs to security repo

Components: authelia, vault, external-secrets, falco, trivy
 2026-01-05 00:40:26 +09:00
Mayne0213
9822441e38 REFACTOR(repo): migrate repoURL to K3S-HOME 
- Update repository URL to K3S-HOME organization
- Change from personal to organization repo
 2026-01-05 00:40:26 +09:00
Mayne0213
fd31dc3c65 REFACTOR(authelia): remove redirect to Vault 
- Remove redirect configuration to Vault
- Clean up authentication flow
 2026-01-05 00:40:26 +09:00
Mayne0213
cb4492f277 FEAT(authelia): add Authelia SSO to Vault and ArgoCD 
- Add Authelia SSO to vault and argocd ingress
- Enable single sign-on authentication
 2026-01-04 23:41:39 +09:00
Mayne0213
5688b41026 PERF(vault): reduce Vault CPU request from 100m to 50m 
- Reduce based on actual usage (24-30m)
- Optimize resource allocation
 2026-01-04 23:41:39 +09:00
Mayne0213
2a0a239260 FEAT(vault): add master node toleration to Vault 
- Allows vault pods to run on master with NoExecute taint
 2026-01-04 23:41:39 +09:00
Mayne0213
dc31575f03 FIX(repo): set ha.config to empty to avoid duplicate listener 
- Set HA config to empty
- Prevent duplicate listener issue
 2026-01-04 23:41:39 +09:00
Mayne0213
207351a932 FEAT(postgresql): configure vault 
- to use externalsecret for postgresq...
- Add ExternalSecret to pull vault config from Vault itself
- Add RBAC for vault token reviewer (kubernetes auth)
- Update helm-values to mount secret as config
- Connection string is now stored in Vault, not in git
 2026-01-04 23:41:39 +09:00
Mayne0213
25379aebd0 PERF(authentik): increase replicas for HA 
- Traefik, CoreDNS, Authentik
- Traefik: 2 replicas
- CoreDNS: 2 replicas (new HelmChartConfig)
- Authentik: 2 replicas for server and worker
- Vault: Keep file storage (standalone)
 2026-01-04 23:41:39 +09:00
Mayne0213
f38cbedcba REFACTOR(traefik): switch from HAProxy 
- to Traefik ingress controller
- Update all ingress files to use ingressClassName: traefik
- Update cert-manager ClusterIssuer to use traefik class
- Remove haproxy.org annotations from ingress files
- Update vault helm-values to use traefik
 2026-01-04 23:41:39 +09:00
Mayne0213
1b139e53dc REFACTOR(postgresql): change vault storage 
- from pg to file st...
- Remove PostgreSQL backend dependency to avoid circular reference
- Vault no longer needs vault-pg-connection secret to start
- Use Longhorn PVC for data persistence
 2026-01-04 23:41:39 +09:00
Mayne0213
64aeb36e78 CHORE(external-secrets): update ESO API version from v1beta1 to v1 
- Update ExternalSecret API version
- Migrate to stable API
 2026-01-04 23:41:39 +09:00
Mayne0213
0a8c4bde16 REFACTOR(gitea): migrate repoURL from Gitea to GitHub 
- Update repository URL to GitHub
- Change source control provider
 2026-01-04 23:41:39 +09:00
Mayne0213
a2682e292b REFACTOR(goldilocks): use managedNamespaceMetadata for namespace labels 
- Remove namespace.yaml files
- Add managedNamespaceMetadata with Goldilocks label
- Set CreateNamespace=true in syncOptions
- Update kustomization.yaml to remove namespace.yaml references
 2026-01-04 23:41:39 +09:00
Mayne0213
1aca10fb2d FEAT(cert-manager): add cert-manager annotation to Vault ingress 
- Add TLS certificate annotation
- Enable automatic certificate management
 2026-01-04 23:41:39 +09:00
Mayne0213
b07fcc5e74 REFACTOR(velero): simplify vault 
- and velero configs
- vault: Fix CreateNamespace conflict (set to false)
- velero: Consolidate ExternalSecrets into vault/velero-secrets.yaml
- velero: Clean up kustomization.yaml
 2026-01-04 23:41:39 +09:00
Mayne0213
09f08fba75 FEAT(cert-manager): integrate cert-manager, Vault, Velero 
- Add cert-manager configuration
- Add Vault and Velero integration
 2026-01-04 23:41:39 +09:00
Mayne0213
ae8414f459 FIX(argocd): helm valueFiles paths in ArgoCD 
- Applications
- Update valueFiles paths from helm-values/<app>.yaml to helm-
  values.yaml
- Fixes ComparisonError after folder restructuring

Applications fixed:
- cert-manager
- cnpg
- external-secrets
- vault
- vpa
- velero
 2026-01-04 23:41:39 +09:00
Mayne0213
34a1c9f783 REFACTOR(repo): restructure infra folder structure 
- Remove argocd/, helm-values/, ingress/ subdirectories
- Move files to parent directory with standardized names
- Add namespace.yaml to all apps with Goldilocks labels
- Preserve vault/ subdirectories (falco, velero)
- Update main kustomization.yaml to reference argocd.yaml files directly
- Comment out argocd.yaml in each app's kustomization.yaml to prevent
  circular reference

Applications restructured:
- cert-manager (2 ArgoCD apps)
- external-secrets
- reloader
- vault (2 ArgoCD apps)
- velero (2 ArgoCD apps)
- falco
- cnpg
- haproxy
- metallb
- vpa
- argocd
 2026-01-04 23:41:39 +09:00
Mayne0213
8e98ea181c FIX(postgresql): vault PostgreSQL connection 
- using environment variable
- Removed hardcoded connection_url from config
- Use VAULT_PG_CONNECTION_URL environment variable instead
- Connection URL stored securely in vault-pg-connection Secret
- Fixes environment variable substitution issue in HCL config
 2026-01-04 23:41:39 +09:00
Mayne0213
c8f945034e REFACTOR(postgresql): change vault from dev 
- to production mode with P...
- Disabled dev mode
- Added standalone mode with PostgreSQL storage backend
- Connected to postgresql-cnpg cluster (vault database)
- Added environment variable for PostgreSQL password from secret
- Increased resource limits (cpu: 100m, memory: 256Mi)
 2026-01-04 23:41:39 +09:00
Mayne0213
1408000e4c REFACTOR(falco): remove cpu limits entirely 
- from vault and falco
- Remove cpu line from limits section (not just set to null)
- Prevents Helm charts from applying default CPU limit values
- Eliminates CPU throttling for infrastructure components
 2026-01-04 23:41:39 +09:00
Mayne0213
420cc38efc CHORE(vault): set CPU limits to null for Vault 
- Remove CPU limits to prevent throttling
- Optimize resource configuration
 2026-01-04 23:41:39 +09:00
Mayne0213
100b7be198 REFACTOR(resources): remove cpu limits 
- to prevent throttling
Removed CPU limits from all infrastructure components while keeping
memory limits for protection:

- cnpg: removed 500m CPU limit
- external-secrets: removed 200m, 100m CPU limits (operator, webhook,
  certController)
- falco: removed 500m CPU limit (falcosidekick webui)
- vault: removed 500m CPU limit
- velero: removed 500m, 1000m CPU limits (server, node-agent)

Benefits:
- ✅ Prevents CPU throttling
- ✅ Better performance and lower latency
- ✅ More efficient resource utilization
- ✅ Simpler management (only requests to tune)

Memory limits are kept to prevent memory leaks and OOM issues.
 2026-01-04 23:41:39 +09:00
Mayne0213
cf249930a7 REFACTOR(traefik): migrate all ingresses 
- from NGINX to HAProxy
- Changed all ingressClassName from nginx to haproxy
- Updated NGINX to ClusterIP mode (backup)
- Set HAProxy as default ingress controller
- Affected files:
  - ingress-nginx/ingress.yaml (22 ingresses)
  - vault/helm-values/vault.yaml (1 ingress)
  - haproxy/argocd/haproxy.yaml (controller config)
  - ingress-nginx/helm-values/ingress-nginx.yaml (backup mode)

This completes the migration to HAProxy as the primary ingress
controller.
 2026-01-04 23:41:39 +09:00
Mayne0213
fa24f224ee FEAT(vault): add clustersecretstore 
- for vault-backend
- Create cluster-wide secret store for External Secrets Operator
- Configure Kubernetes auth with external-secrets service account
- Enable all namespaces to access Vault secrets via ClusterSecretStore
 2026-01-04 23:41:39 +09:00
Mayne0213
05a5de7c0f CHORE(argocd): update ArgoCD applications to point to cluster-infrastructure 
- Update repoURL to cluster-infrastructure repo
- Change source repository reference
 2025-12-17 15:12:46 +09:00
Mayne0213
2a89801d5e INIT(repo): cluster infrastructure setup 2025-12-17 15:04:56 +09:00