K3S-HOME/security
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
162 Commits 1 Branch 0 Tags
5acc1c7f9e89c66d7a793be642a44e4c32c2f820
Commit Graph

30 Commits

Author SHA1 Message Date
Mayne0213
5acc1c7f9e PERF(security): adjust resources based on VPA 
- Update authelia memory 256Mi→194Mi
- Update authelia redis cpu 10m→23m, memory 64Mi→100Mi
- Update falco memory 263Mi→283Mi
- Update falcosidekick cpu 10m→15m, memory 128Mi→100Mi
- Update external-secrets operator cpu 5m→15m, memory 128Mi→100Mi
- Update external-secrets webhook cpu 2m→15m, memory 128Mi→100Mi
- Update external-secrets certController cpu 2m→15m, memory 256Mi→283Mi
- Update vault cpu 35m→49m, memory 263Mi→175Mi
 2026-01-10 14:32:33 +09:00
Mayne0213
c2d6958407 PERF(external-secrets): reduce replicas to 1 
- Reduce external-secrets replicas to 1
- Reduce cert-controller replicas to 1
- Reduce webhook replicas to 1
 2026-01-10 13:31:52 +09:00
Mayne0213
ac6eaef446 CHORE(external-secrets): increase certController memory 
- Increase certController memory request and limit from 128Mi to 256Mi
- Maintain CPU request at 2m
 2026-01-10 02:09:28 +09:00
Mayne0213
5f9573133e FIX(authelia): configure OIDC claims and scopes 
- Remove groups scope (not provided by Authelia)
- Add claims_policy for preferred_username
- Remove sub from claims_policy (standard claim)
 2026-01-10 01:16:58 +09:00
Mayne0213
c368d2e983 FIX(external-secrets): increase certController memory to 128Mi 
- cert-controller uses ~73Mi at runtime, 64Mi causes OOMKilled
 2026-01-10 01:16:57 +09:00
Mayne0213
871882927b FIX(external-secrets): increase memory limits for webhook and certController 
- Increase memory from 32Mi to 64Mi to prevent OOMKilled
- Remove duplicate webhook/certController sections (keep ones with affinity)
 2026-01-10 01:16:57 +09:00
Mayne0213
74d29aabfc CHORE(resources): set memory limits equal to memory requests 
- Align memory limits with memory requests for guaranteed QoS class
- falco: falcosidekick
- external-secrets: main, webhook, certController
- authelia: main, redis
 2026-01-10 01:16:56 +09:00
Mayne0213
66d845140e FIX(authelia): move affinity to top level 
- Move affinity from pod.affinity to top-level affinity
- Fix Helm chart schema validation error
- Maintain soft anti-affinity configuration

FIX(security): remove unsupported affinity from authelia

- Remove affinity from authelia (chart schema limitation)
- Fix external-secrets duplicate webhook/certController sections
- Merge affinity into respective component sections
- Authelia chart does not support affinity in values.yaml
 2026-01-09 21:45:16 +09:00
Mayne0213
cbf00275e8 FEAT(security): enable HA with replica 2 and soft anti-affinity 
- Add replicaCount: 2 to authelia, external-secrets, falco
- Add soft pod anti-affinity for node distribution
- Configure affinity for all security components
 2026-01-08 13:07:56 +09:00
Mayne0213
5e161fca8a FEAT(external-secrets): add ClusterExternalSecret for Zot 
- Add zot-registry-credentials ClusterExternalSecret
- Auto-create dockerconfigjson in labeled namespaces
- API version v1 (v1beta1 deprecated)
 2026-01-07 14:28:58 +09:00
Mayne0213
7cdc4f1e9e FIX(external-secrets): disable CRD installation via Helm 
- Set installCRDs: false to avoid annotation size limit
- CRDs already installed, manual upgrade when needed
 2026-01-07 01:24:07 +09:00
Mayne0213
661659acdb FIX(external-secrets): ignore CRD status in diff 
- Add /status to ignoreDifferences for CRDs
- Fix comparison error with terminatingReplicas field
 2026-01-07 01:20:02 +09:00
Mayne0213
3ea8b0d7c9 REVERT(external-secrets): remove ServerSideApply 
- ServerSideApply causes schema compatibility issues
- Removed annotations directly from CRDs instead
 2026-01-07 01:18:44 +09:00
Mayne0213
835395f7ec FIX(external-secrets): add ServerSideApply for CRD sync 
- Fix CRD annotation size limit exceeded error
- ServerSideApply avoids last-applied-configuration annotation
 2026-01-07 01:15:03 +09:00
Mayne0213
321685822f REFACTOR(repo): security repo structure 
- Add application.yaml for ArgoCD app-of-apps
- Add kustomization.yaml with security components
- Add renovate.json for automated updates
- Update all component argocd.yaml repoURLs to security repo

Components: authelia, vault, external-secrets, falco, trivy
 2026-01-05 00:40:26 +09:00
Mayne0213
9822441e38 REFACTOR(repo): migrate repoURL to K3S-HOME 
- Update repository URL to K3S-HOME organization
- Change from personal to organization repo
 2026-01-05 00:40:26 +09:00
Mayne0213
4e4be3109a FIX(external-secrets): fix ESO CRD OutOfSync 
- Add ignoreDifferences for CRD caBundle and spec/versions
- Add RespectIgnoreDifferences syncOption
- Prevents ArgoCD from detecting drift on CRD fields managed by webhook
 2026-01-05 00:40:26 +09:00
renovate[bot]
8fd3daa65f CHORE(external-secrets): update ESO to v1.2.1 
- Upgrade External Secrets Operator chart
- Apply dependency updates
 2026-01-05 00:40:26 +09:00
Mayne0213
d392bbc57a REFACTOR(argocd): remove serversideapply 
- from argocd applications
- Fixes OutOfSync issues caused by operator-added default values
- ServerSideApply causes stricter field management that conflicts with
  CRD defaults
 2026-01-04 23:41:39 +09:00
Mayne0213
fe484fb4a1 FEAT(external-secrets): add ServerSideApply=true to ESO 
- Enable ServerSideApply for External Secrets Operator
- Fix CRD management
 2026-01-04 23:41:39 +09:00
Mayne0213
0a8c4bde16 REFACTOR(gitea): migrate repoURL from Gitea to GitHub 
- Update repository URL to GitHub
- Change source control provider
 2026-01-04 23:41:39 +09:00
Mayne0213
970b69cedc CHORE(deps): upgrade ESO to 1.2.0 for v1 API support 
- Upgrade External Secrets Operator
- Enable v1 API support
 2026-01-04 23:41:39 +09:00
Mayne0213
a2682e292b REFACTOR(goldilocks): use managedNamespaceMetadata for namespace labels 
- Remove namespace.yaml files
- Add managedNamespaceMetadata with Goldilocks label
- Set CreateNamespace=true in syncOptions
- Update kustomization.yaml to remove namespace.yaml references
 2026-01-04 23:41:39 +09:00
Mayne0213
7653a33ffa CHORE(repo): clean kustomization files 
- Remove unused entries from kustomization
- Clean up configuration
 2026-01-04 23:41:39 +09:00
Mayne0213
ae8414f459 FIX(argocd): helm valueFiles paths in ArgoCD 
- Applications
- Update valueFiles paths from helm-values/<app>.yaml to helm-
  values.yaml
- Fixes ComparisonError after folder restructuring

Applications fixed:
- cert-manager
- cnpg
- external-secrets
- vault
- vpa
- velero
 2026-01-04 23:41:39 +09:00
Mayne0213
34a1c9f783 REFACTOR(repo): restructure infra folder structure 
- Remove argocd/, helm-values/, ingress/ subdirectories
- Move files to parent directory with standardized names
- Add namespace.yaml to all apps with Goldilocks labels
- Preserve vault/ subdirectories (falco, velero)
- Update main kustomization.yaml to reference argocd.yaml files directly
- Comment out argocd.yaml in each app's kustomization.yaml to prevent
  circular reference

Applications restructured:
- cert-manager (2 ArgoCD apps)
- external-secrets
- reloader
- vault (2 ArgoCD apps)
- velero (2 ArgoCD apps)
- falco
- cnpg
- haproxy
- metallb
- vpa
- argocd
 2026-01-04 23:41:39 +09:00
Mayne0213
861a5e97d7 PERF(grafana): optimize cpu requests based on 
- actual usage from grafa...
- external-secrets: 20m → 5m (actual: 1m)
- external-secrets-webhook: 10m → 2m (actual: 1m)
- external-secrets-cert: 10m → 2m (actual: 1m)
- cnpg: 100m → 5m (actual: 2m)
- haproxy-ingress: 100m → 15m (actual: 9-10m)
 2026-01-04 23:41:39 +09:00
Mayne0213
100b7be198 REFACTOR(resources): remove cpu limits 
- to prevent throttling
Removed CPU limits from all infrastructure components while keeping
memory limits for protection:

- cnpg: removed 500m CPU limit
- external-secrets: removed 200m, 100m CPU limits (operator, webhook,
  certController)
- falco: removed 500m CPU limit (falcosidekick webui)
- vault: removed 500m CPU limit
- velero: removed 500m, 1000m CPU limits (server, node-agent)

Benefits:
- ✅ Prevents CPU throttling
- ✅ Better performance and lower latency
- ✅ More efficient resource utilization
- ✅ Simpler management (only requests to tune)

Memory limits are kept to prevent memory leaks and OOM issues.
 2026-01-04 23:41:39 +09:00
Mayne0213
05a5de7c0f CHORE(argocd): update ArgoCD applications to point to cluster-infrastructure 
- Update repoURL to cluster-infrastructure repo
- Change source repository reference
 2025-12-17 15:12:46 +09:00
Mayne0213
2a89801d5e INIT(repo): cluster infrastructure setup 2025-12-17 15:04:56 +09:00