K3S-HOME/security
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
121 Commits 1 Branch 0 Tags
52bc1b9d573a2161d690394e1ca186123aee2b11
Commit Graph

121 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Mayne0213
334c16f22a REFACTOR(postgresql): change Authelia PostgreSQL user 
- Change database user from app to bluemayne
- Update authentication configuration
 2026-01-04 23:41:39 +09:00
Mayne0213
5688b41026 PERF(vault): reduce Vault CPU request from 100m to 50m 
- Reduce based on actual usage (24-30m)
- Optimize resource allocation
 2026-01-04 23:41:39 +09:00
Mayne0213
2a0a239260 FEAT(vault): add master node toleration to Vault 
- Allows vault pods to run on master with NoExecute taint
 2026-01-04 23:41:39 +09:00
Mayne0213
114307fa4b CHORE(goldilocks): disable Goldilocks and Trivy 
- Comment out goldilocks/argocd.yaml from kustomization
- Comment out trivy/argocd.yaml from kustomization
- Disable autoSync in both applications
- Server overload mitigation
 2026-01-04 23:41:39 +09:00
Mayne0213
8da74949b8 FEAT(trivy): add trivy operator 
- for container vulnerability scanning
- Add Trivy Operator Helm chart (v0.31.0)
- Configure ServiceMonitor for Prometheus integration
- Enable vulnerability, config audit, and RBAC scanners
- Use Longhorn storage class for Trivy DB
- Exclude kube-system namespaces from scanning
 2026-01-04 23:41:39 +09:00
Mayne0213
dc31575f03 FIX(repo): set ha.config to empty to avoid duplicate listener 
- Set HA config to empty
- Prevent duplicate listener issue
 2026-01-04 23:41:39 +09:00
Mayne0213
207351a932 FEAT(postgresql): configure vault 
- to use externalsecret for postgresq...
- Add ExternalSecret to pull vault config from Vault itself
- Add RBAC for vault token reviewer (kubernetes auth)
- Update helm-values to mount secret as config
- Connection string is now stored in Vault, not in git
 2026-01-04 23:41:39 +09:00
Mayne0213
db24350909 REFACTOR(repo): rename users-database.yaml 
- to config.yaml
 2026-01-04 23:41:39 +09:00
Mayne0213
a22f4240b5 FIX(authelia): authelia secret keys 
- to dot notation
 2026-01-04 23:41:39 +09:00
Mayne0213
9081778d80 FIX(postgresql): postgresql password property key 2026-01-04 23:41:39 +09:00
Mayne0213
d049fd42f3 FIX(authelia): authelia secret key format 
- dot notation
 2026-01-04 23:41:39 +09:00
Mayne0213
f8d383f02e REFACTOR(postgresql): switch authelia 
- to pg storage, fix secr...
 2026-01-04 23:41:39 +09:00
Mayne0213
9af3f96546 CHORE(authelia): update Authelia admin password 
- hash
 2026-01-04 23:41:39 +09:00
Mayne0213
0ec31ac5a9 FEAT(authentik): add authelia sso 
- replacing authentik
 2026-01-04 23:41:39 +09:00
Mayne0213
87b16d13e3 FEAT(falco): configure falco redis 
- with 200mb maxmemory and lru eviction
 2026-01-04 23:41:39 +09:00
Mayne0213
27d1e5c4b1 FIX(falco): re-enable falco webui 
- with redis memory limit 128mi
 2026-01-04 23:41:39 +09:00
Mayne0213
26e40d234a CHORE(falco): disable sidekick web ui 
- to save 535mb redis memory
 2026-01-04 23:41:39 +09:00
Mayne0213
368f7b5f5a PERF(falco): reduce falcosidekick replicas to 1 
- Scale down to single replica
- Reduce resource usage
 2026-01-04 23:41:39 +09:00
Mayne0213
25379aebd0 PERF(authentik): increase replicas for HA 
- Traefik, CoreDNS, Authentik
- Traefik: 2 replicas
- CoreDNS: 2 replicas (new HelmChartConfig)
- Authentik: 2 replicas for server and worker
- Vault: Keep file storage (standalone)
 2026-01-04 23:41:39 +09:00
Mayne0213
d392bbc57a REFACTOR(argocd): remove serversideapply 
- from argocd applications
- Fixes OutOfSync issues caused by operator-added default values
- ServerSideApply causes stricter field management that conflicts with
  CRD defaults
 2026-01-04 23:41:39 +09:00
Mayne0213
f38cbedcba REFACTOR(traefik): switch from HAProxy 
- to Traefik ingress controller
- Update all ingress files to use ingressClassName: traefik
- Update cert-manager ClusterIssuer to use traefik class
- Remove haproxy.org annotations from ingress files
- Update vault helm-values to use traefik
 2026-01-04 23:41:39 +09:00
Mayne0213
1b139e53dc REFACTOR(postgresql): change vault storage 
- from pg to file st...
- Remove PostgreSQL backend dependency to avoid circular reference
- Vault no longer needs vault-pg-connection secret to start
- Use Longhorn PVC for data persistence
 2026-01-04 23:41:39 +09:00
Mayne0213
64aeb36e78 CHORE(external-secrets): update ESO API version from v1beta1 to v1 
- Update ExternalSecret API version
- Migrate to stable API
 2026-01-04 23:41:39 +09:00
Mayne0213
fe484fb4a1 FEAT(external-secrets): add ServerSideApply=true to ESO 
- Enable ServerSideApply for External Secrets Operator
- Fix CRD management
 2026-01-04 23:41:39 +09:00
Mayne0213
0a8c4bde16 REFACTOR(gitea): migrate repoURL from Gitea to GitHub 
- Update repository URL to GitHub
- Change source control provider
 2026-01-04 23:41:39 +09:00
Mayne0213
970b69cedc CHORE(deps): upgrade ESO to 1.2.0 for v1 API support 
- Upgrade External Secrets Operator
- Enable v1 API support
 2026-01-04 23:41:39 +09:00
Mayne0213
a2682e292b REFACTOR(goldilocks): use managedNamespaceMetadata for namespace labels 
- Remove namespace.yaml files
- Add managedNamespaceMetadata with Goldilocks label
- Set CreateNamespace=true in syncOptions
- Update kustomization.yaml to remove namespace.yaml references
 2026-01-04 23:41:39 +09:00
Mayne0213
1aca10fb2d FEAT(cert-manager): add cert-manager annotation to Vault ingress 
- Add TLS certificate annotation
- Enable automatic certificate management
 2026-01-04 23:41:39 +09:00
Mayne0213
7653a33ffa CHORE(repo): clean kustomization files 
- Remove unused entries from kustomization
- Clean up configuration
 2026-01-04 23:41:39 +09:00
Mayne0213
b07fcc5e74 REFACTOR(velero): simplify vault 
- and velero configs
- vault: Fix CreateNamespace conflict (set to false)
- velero: Consolidate ExternalSecrets into vault/velero-secrets.yaml
- velero: Clean up kustomization.yaml
 2026-01-04 23:41:39 +09:00
Mayne0213
09f08fba75 FEAT(cert-manager): integrate cert-manager, Vault, Velero 
- Add cert-manager configuration
- Add Vault and Velero integration
 2026-01-04 23:41:39 +09:00
Mayne0213
ae8414f459 FIX(argocd): helm valueFiles paths in ArgoCD 
- Applications
- Update valueFiles paths from helm-values/<app>.yaml to helm-
  values.yaml
- Fixes ComparisonError after folder restructuring

Applications fixed:
- cert-manager
- cnpg
- external-secrets
- vault
- vpa
- velero
 2026-01-04 23:41:39 +09:00
Mayne0213
34a1c9f783 REFACTOR(repo): restructure infra folder structure 
- Remove argocd/, helm-values/, ingress/ subdirectories
- Move files to parent directory with standardized names
- Add namespace.yaml to all apps with Goldilocks labels
- Preserve vault/ subdirectories (falco, velero)
- Update main kustomization.yaml to reference argocd.yaml files directly
- Comment out argocd.yaml in each app's kustomization.yaml to prevent
  circular reference

Applications restructured:
- cert-manager (2 ArgoCD apps)
- external-secrets
- reloader
- vault (2 ArgoCD apps)
- velero (2 ArgoCD apps)
- falco
- cnpg
- haproxy
- metallb
- vpa
- argocd
 2026-01-04 23:41:39 +09:00
Mayne0213
cedb4ec0d4 FIX(falco): falco sync loop by updating ignoreDiff 
- Remove optional operator (?) from jqPathExpressions
- Add apiVersion and kind to ignored fields for volumeClaimTemplates
- Prevents continuous sync loop caused by Kubernetes removing these
  fields from StatefulSet
 2026-01-04 23:41:39 +09:00
Mayne0213
8e98ea181c FIX(postgresql): vault PostgreSQL connection 
- using environment variable
- Removed hardcoded connection_url from config
- Use VAULT_PG_CONNECTION_URL environment variable instead
- Connection URL stored securely in vault-pg-connection Secret
- Fixes environment variable substitution issue in HCL config
 2026-01-04 23:41:39 +09:00
Mayne0213
c8f945034e REFACTOR(postgresql): change vault from dev 
- to production mode with P...
- Disabled dev mode
- Added standalone mode with PostgreSQL storage backend
- Connected to postgresql-cnpg cluster (vault database)
- Added environment variable for PostgreSQL password from secret
- Increased resource limits (cpu: 100m, memory: 256Mi)
 2026-01-04 23:41:39 +09:00
Mayne0213
5c918b64fc REFACTOR(falco): use falco-ui-secret 
- for sidekick webui authenti...
 2026-01-04 23:41:39 +09:00
Mayne0213
4e0d10e581 FIX(falco): falco UI auth: use 
- FALCOSIDEKICK_UI_USER format
 2026-01-04 23:41:39 +09:00
Mayne0213
90c7883c37 FEAT(velero): add velero and falco UI auth 
- secrets from Vault
 2026-01-04 23:41:39 +09:00
Mayne0213
50ceb6d98d FIX(argocd): falco cpu requests in argocd 
- application
- Falco: 100m → 30m
- Falcosidekick Web UI: 50m → 30m

The previous commit only updated helm-values/falco.yaml which wasn't
being used. The ArgoCD Application uses inline helm values.
 2026-01-04 23:41:39 +09:00
Mayne0213
4d2a0f5169 PERF(cnpg): reduce cpu requests 
- to allow cnpg join pod scheduling
- Falco: 40m → 30m
- Falcosidekick Web UI: 50m → 30m
- Velero UI: 50m → 30m

This frees up ~40m CPU on worker nodes to allow CNPG join pods
(which request 500m) to be scheduled successfully.
 2026-01-04 23:41:39 +09:00
Mayne0213
27d26cdfb3 CHORE(falco): ignore volumeClaimTemplates status 
- in falco StatefulSet
 2026-01-04 23:41:39 +09:00
Mayne0213
8a398a3bdc REFACTOR(falco): use cpu: null 
- to delete Helm chart default CPU limit...
Following Helm best practice to override default values with null.
 2026-01-04 23:41:39 +09:00
Mayne0213
6e1304f703 FIX(falco): re-enable auto-sync 
- for falco and use Helm chart defaults
Let Helm chart apply default CPU limits like other apps.
 2026-01-04 23:41:39 +09:00
Mayne0213
d6b9fe6a01 CHORE(falco): disable auto-sync for falco 
- to allow manual CPU limit r...
Will manually patch DaemonSet to remove CPU limits after this is
applied.
 2026-01-04 23:41:39 +09:00
Mayne0213
85ef6e8c9f CHORE(falco): set Falco CPU limit to empty string 
- Override Helm default CPU limit
- Prevent throttling
 2026-01-04 23:41:39 +09:00
Mayne0213
10211f35bc REFACTOR(falco): remove invalid empty string CPU 
- limit from falco
Kubernetes rejects cpu: "" as invalid quantity format. Will allow
DaemonSet
to be created with default CPU limit, then manually patch and disable
auto-sync.
 2026-01-04 23:41:39 +09:00
Mayne0213
fa98684528 CHORE(falco): set Falco CPU limit to empty string 
- Override Helm default CPU limit
- Prevent throttling
 2026-01-04 23:41:39 +09:00
Mayne0213
1408000e4c REFACTOR(falco): remove cpu limits entirely 
- from vault and falco
- Remove cpu line from limits section (not just set to null)
- Prevents Helm charts from applying default CPU limit values
- Eliminates CPU throttling for infrastructure components
 2026-01-04 23:41:39 +09:00
Mayne0213
420cc38efc CHORE(vault): set CPU limits to null for Vault 
- Remove CPU limits to prevent throttling
- Optimize resource configuration
 2026-01-04 23:41:39 +09:00