diff --git a/apps/argocd/manifests/envoy-route.yaml b/apps/argocd/manifests/envoy-route.yaml index 4ce309b..58d900a 100644 --- a/apps/argocd/manifests/envoy-route.yaml +++ b/apps/argocd/manifests/envoy-route.yaml @@ -5,7 +5,9 @@ metadata: namespace: argocd spec: parentRefs: - - name: edge + - group: gateway.networking.k8s.io + kind: Gateway + name: edge namespace: gateway sectionName: https hostnames: @@ -16,5 +18,8 @@ spec: type: PathPrefix value: / backendRefs: - - name: argocd-server + - group: "" + kind: Service + name: argocd-server port: 80 + weight: 1 diff --git a/apps/argocd/values.yaml b/apps/argocd/values.yaml index be0fef8..885f60f 100644 --- a/apps/argocd/values.yaml +++ b/apps/argocd/values.yaml @@ -6,6 +6,36 @@ global: configs: cm: url: https://argocd.kube.huskypup.net + resource.customizations.ignoreDifferences.all: | + managedFieldsManagers: + - external-secrets + - istio-system + jqPathExpressions: + - .metadata.finalizers + resource.customizations.ignoreDifferences.external-secrets.io_ExternalSecret: | + jqPathExpressions: + - .metadata.annotations."force-sync" + - .metadata.annotations."reconcile.external-secrets.io/force-sync" + - .metadata.finalizers + - .spec.data[].remoteRef.conversionStrategy + - .spec.data[].remoteRef.decodingStrategy + - .spec.data[].remoteRef.metadataPolicy + resource.customizations.ignoreDifferences.gateway.networking.k8s.io_HTTPRoute: | + jqPathExpressions: + - .metadata.annotations + - .spec.parentRefs[].port + resource.customizations.ignoreDifferences.monitoring.coreos.com_ServiceMonitor: | + jqPathExpressions: + - .spec.endpoints[].relabelings[].action + - .spec.endpoints[].metricRelabelings[].action + resource.customizations.ignoreDifferences.monitoring.coreos.com_PodMonitor: | + jqPathExpressions: + - .spec.podMetricsEndpoints[].relabelings[].action + - .spec.podMetricsEndpoints[].metricRelabelings[].action + resource.customizations.ignoreDifferences.apps_StatefulSet: | + jqPathExpressions: + - .spec.volumeClaimTemplates[].apiVersion + - .spec.volumeClaimTemplates[].kind oidc.config: | name: Authentik issuer: https://auth.kube.huskypup.net/application/o/argocd/ diff --git a/apps/frigate/manifests/envoy-route.yaml b/apps/frigate/manifests/envoy-route.yaml index 6068b30..a82af86 100644 --- a/apps/frigate/manifests/envoy-route.yaml +++ b/apps/frigate/manifests/envoy-route.yaml @@ -5,7 +5,9 @@ metadata: namespace: frigate spec: parentRefs: - - name: edge + - group: gateway.networking.k8s.io + kind: Gateway + name: edge namespace: gateway sectionName: https hostnames: @@ -16,5 +18,8 @@ spec: type: PathPrefix value: / backendRefs: - - name: frigate + - group: "" + kind: Service + name: frigate port: 5000 + weight: 1 diff --git a/apps/gitlab/manifests/envoy-routes.yaml b/apps/gitlab/manifests/envoy-routes.yaml index e5f05cf..2c5387c 100644 --- a/apps/gitlab/manifests/envoy-routes.yaml +++ b/apps/gitlab/manifests/envoy-routes.yaml @@ -5,7 +5,9 @@ metadata: namespace: gitlab spec: parentRefs: - - name: edge + - group: gateway.networking.k8s.io + kind: Gateway + name: edge namespace: gateway sectionName: https hostnames: @@ -16,8 +18,11 @@ spec: type: PathPrefix value: / backendRefs: - - name: gitlab-webservice-default + - group: "" + kind: Service + name: gitlab-webservice-default port: 8181 + weight: 1 --- apiVersion: gateway.networking.k8s.io/v1 @@ -27,7 +32,9 @@ metadata: namespace: gitlab spec: parentRefs: - - name: edge + - group: gateway.networking.k8s.io + kind: Gateway + name: edge namespace: gateway sectionName: https hostnames: @@ -38,8 +45,11 @@ spec: type: PathPrefix value: / backendRefs: - - name: gitlab-registry + - group: "" + kind: Service + name: gitlab-registry port: 5000 + weight: 1 --- apiVersion: gateway.networking.k8s.io/v1 @@ -49,7 +59,9 @@ metadata: namespace: gitlab spec: parentRefs: - - name: edge + - group: gateway.networking.k8s.io + kind: Gateway + name: edge namespace: gateway sectionName: https hostnames: @@ -60,8 +72,11 @@ spec: type: PathPrefix value: / backendRefs: - - name: gitlab-minio-svc + - group: "" + kind: Service + name: gitlab-minio-svc port: 9000 + weight: 1 --- apiVersion: gateway.networking.k8s.io/v1 @@ -71,7 +86,9 @@ metadata: namespace: gitlab spec: parentRefs: - - name: edge + - group: gateway.networking.k8s.io + kind: Gateway + name: edge namespace: gateway sectionName: https hostnames: @@ -82,5 +99,8 @@ spec: type: PathPrefix value: / backendRefs: - - name: gitlab-kas + - group: "" + kind: Service + name: gitlab-kas port: 8154 + weight: 1 diff --git a/apps/guacamole/manifests/envoy-gateway.yaml b/apps/guacamole/manifests/envoy-gateway.yaml index f8d1aac..a382bdf 100644 --- a/apps/guacamole/manifests/envoy-gateway.yaml +++ b/apps/guacamole/manifests/envoy-gateway.yaml @@ -27,7 +27,8 @@ spec: tls: mode: Terminate certificateRefs: - - kind: Secret + - group: "" + kind: Secret name: guacamole-envoy-tls --- @@ -38,7 +39,9 @@ metadata: namespace: guacamole spec: parentRefs: - - name: guacamole + - group: gateway.networking.k8s.io + kind: Gateway + name: guacamole sectionName: https hostnames: - guacamole.kube.huskypup.net @@ -55,13 +58,19 @@ spec: type: ReplacePrefixMatch replacePrefixMatch: / backendRefs: - - name: guacamole + - group: "" + kind: Service + name: guacamole port: 8080 + weight: 1 # Standard root routing - matches: - path: type: PathPrefix value: / backendRefs: - - name: guacamole + - group: "" + kind: Service + name: guacamole port: 8080 + weight: 1 diff --git a/apps/home-assistant/esphome/envoy-route.yaml b/apps/home-assistant/esphome/envoy-route.yaml index d1da151..e5c5c36 100644 --- a/apps/home-assistant/esphome/envoy-route.yaml +++ b/apps/home-assistant/esphome/envoy-route.yaml @@ -5,7 +5,9 @@ metadata: namespace: home-assistant spec: parentRefs: - - name: edge + - group: gateway.networking.k8s.io + kind: Gateway + name: edge namespace: gateway sectionName: https hostnames: @@ -16,5 +18,8 @@ spec: type: PathPrefix value: / backendRefs: - - name: esphome + - group: "" + kind: Service + name: esphome port: 6052 + weight: 1 diff --git a/apps/home-assistant/manifests/envoy-route.yaml b/apps/home-assistant/manifests/envoy-route.yaml index 4fcf0a9..9bba251 100644 --- a/apps/home-assistant/manifests/envoy-route.yaml +++ b/apps/home-assistant/manifests/envoy-route.yaml @@ -5,7 +5,9 @@ metadata: namespace: home-assistant spec: parentRefs: - - name: edge + - group: gateway.networking.k8s.io + kind: Gateway + name: edge namespace: gateway sectionName: https hostnames: @@ -16,5 +18,8 @@ spec: type: PathPrefix value: / backendRefs: - - name: home-assistant + - group: "" + kind: Service + name: home-assistant port: 8123 + weight: 1 diff --git a/apps/n8n/manifests/envoy-route.yaml b/apps/n8n/manifests/envoy-route.yaml index 20d9d82..b4b74a2 100644 --- a/apps/n8n/manifests/envoy-route.yaml +++ b/apps/n8n/manifests/envoy-route.yaml @@ -5,7 +5,9 @@ metadata: namespace: n8n spec: parentRefs: - - name: edge + - group: gateway.networking.k8s.io + kind: Gateway + name: edge namespace: gateway sectionName: https hostnames: @@ -16,5 +18,8 @@ spec: type: PathPrefix value: / backendRefs: - - name: n8n + - group: "" + kind: Service + name: n8n port: 80 + weight: 1 diff --git a/apps/nextcloud/manifests/envoy-route.yaml b/apps/nextcloud/manifests/envoy-route.yaml index 385efa0..0790bf1 100644 --- a/apps/nextcloud/manifests/envoy-route.yaml +++ b/apps/nextcloud/manifests/envoy-route.yaml @@ -5,7 +5,9 @@ metadata: namespace: nextcloud spec: parentRefs: - - name: edge + - group: gateway.networking.k8s.io + kind: Gateway + name: edge namespace: gateway sectionName: https hostnames: @@ -16,5 +18,8 @@ spec: type: PathPrefix value: / backendRefs: - - name: nextcloud + - group: "" + kind: Service + name: nextcloud port: 8080 + weight: 1 diff --git a/apps/teslamate/manifests/envoy-route.yaml b/apps/teslamate/manifests/envoy-route.yaml index 15e02af..3a0c7b6 100644 --- a/apps/teslamate/manifests/envoy-route.yaml +++ b/apps/teslamate/manifests/envoy-route.yaml @@ -5,7 +5,9 @@ metadata: namespace: teslamate spec: parentRefs: - - name: edge + - group: gateway.networking.k8s.io + kind: Gateway + name: edge namespace: gateway sectionName: https hostnames: @@ -16,5 +18,8 @@ spec: type: PathPrefix value: / backendRefs: - - name: teslamate + - group: "" + kind: Service + name: teslamate port: 4000 + weight: 1 diff --git a/argocd-apps/infrastructure/cilium.yaml b/argocd-apps/infrastructure/cilium.yaml index 5323342..509faf4 100644 --- a/argocd-apps/infrastructure/cilium.yaml +++ b/argocd-apps/infrastructure/cilium.yaml @@ -9,6 +9,26 @@ metadata: - resources-finalizer.argocd.argoproj.io spec: project: infrastructure + ignoreDifferences: + - group: "" + kind: Secret + name: cilium-ca + jsonPointers: + - /data + - group: "" + kind: Secret + name: hubble-relay-client-certs + jsonPointers: + - /data + - group: "" + kind: Secret + name: hubble-server-certs + jsonPointers: + - /data + - group: monitoring.coreos.com + kind: ServiceMonitor + jqPathExpressions: + - .spec.endpoints[].relabelings[].action sources: - repoURL: https://helm.cilium.io chart: cilium diff --git a/argocd-apps/infrastructure/crowdsec.yaml b/argocd-apps/infrastructure/crowdsec.yaml index 480c3cd..14b5a6e 100644 --- a/argocd-apps/infrastructure/crowdsec.yaml +++ b/argocd-apps/infrastructure/crowdsec.yaml @@ -9,6 +9,12 @@ metadata: - resources-finalizer.argocd.argoproj.io spec: project: infrastructure + ignoreDifferences: + - group: "" + kind: Secret + name: crowdsec-lapi-secrets + jsonPointers: + - /data sources: - repoURL: https://crowdsecurity.github.io/helm-charts chart: crowdsec diff --git a/argocd-apps/infrastructure/istio-base.yaml b/argocd-apps/infrastructure/istio-base.yaml index 0b0ca2a..9a90d11 100644 --- a/argocd-apps/infrastructure/istio-base.yaml +++ b/argocd-apps/infrastructure/istio-base.yaml @@ -9,6 +9,11 @@ metadata: - resources-finalizer.argocd.argoproj.io spec: project: infrastructure + ignoreDifferences: + - group: admissionregistration.k8s.io + kind: ValidatingWebhookConfiguration + jqPathExpressions: + - .webhooks[].failurePolicy source: repoURL: https://istio-release.storage.googleapis.com/charts chart: base diff --git a/argocd-apps/infrastructure/istiod.yaml b/argocd-apps/infrastructure/istiod.yaml index 3a6b287..1186270 100644 --- a/argocd-apps/infrastructure/istiod.yaml +++ b/argocd-apps/infrastructure/istiod.yaml @@ -9,6 +9,11 @@ metadata: - resources-finalizer.argocd.argoproj.io spec: project: infrastructure + ignoreDifferences: + - group: admissionregistration.k8s.io + kind: ValidatingWebhookConfiguration + jqPathExpressions: + - .webhooks[].failurePolicy sources: - repoURL: https://istio-release.storage.googleapis.com/charts chart: istiod diff --git a/infrastructure/authentik/manifests/envoy-route.yaml b/infrastructure/authentik/manifests/envoy-route.yaml index 922c789..99dd370 100644 --- a/infrastructure/authentik/manifests/envoy-route.yaml +++ b/infrastructure/authentik/manifests/envoy-route.yaml @@ -5,7 +5,9 @@ metadata: namespace: authentik spec: parentRefs: - - name: edge + - group: gateway.networking.k8s.io + kind: Gateway + name: edge namespace: gateway sectionName: https hostnames: @@ -16,5 +18,8 @@ spec: type: PathPrefix value: / backendRefs: - - name: authentik-server + - group: "" + kind: Service + name: authentik-server port: 80 + weight: 1 diff --git a/infrastructure/envoy-gateway/manifests/edge.yaml b/infrastructure/envoy-gateway/manifests/edge.yaml index c91d069..ec7a7be 100644 --- a/infrastructure/envoy-gateway/manifests/edge.yaml +++ b/infrastructure/envoy-gateway/manifests/edge.yaml @@ -82,7 +82,8 @@ spec: tls: mode: Terminate certificateRefs: - - kind: Secret + - group: "" + kind: Secret name: edge-wildcard-kube-huskypup-net allowedRoutes: namespaces: diff --git a/infrastructure/grafana/manifests/envoy-route.yaml b/infrastructure/grafana/manifests/envoy-route.yaml index e5b87a4..0dffe37 100644 --- a/infrastructure/grafana/manifests/envoy-route.yaml +++ b/infrastructure/grafana/manifests/envoy-route.yaml @@ -5,7 +5,9 @@ metadata: namespace: grafana spec: parentRefs: - - name: edge + - group: gateway.networking.k8s.io + kind: Gateway + name: edge namespace: gateway sectionName: https hostnames: @@ -16,5 +18,8 @@ spec: type: PathPrefix value: / backendRefs: - - name: grafana + - group: "" + kind: Service + name: grafana port: 80 + weight: 1 diff --git a/infrastructure/kyverno/policies/disallow-automount-sa-token.yaml b/infrastructure/kyverno/policies/disallow-automount-sa-token.yaml index 50bf1de..2374ff2 100644 --- a/infrastructure/kyverno/policies/disallow-automount-sa-token.yaml +++ b/infrastructure/kyverno/policies/disallow-automount-sa-token.yaml @@ -16,6 +16,7 @@ spec: background: true rules: - name: validate-automount + skipBackgroundRequests: true match: any: - resources: @@ -60,6 +61,7 @@ spec: - n8n - nessus validate: + allowExistingViolations: true message: >- Pods should set automountServiceAccountToken to false unless API access is required (STIG V-242382). diff --git a/infrastructure/kyverno/policies/disallow-default-namespace.yaml b/infrastructure/kyverno/policies/disallow-default-namespace.yaml index f2188ab..b57948b 100644 --- a/infrastructure/kyverno/policies/disallow-default-namespace.yaml +++ b/infrastructure/kyverno/policies/disallow-default-namespace.yaml @@ -14,6 +14,7 @@ spec: background: true rules: - name: validate-namespace + skipBackgroundRequests: true match: any: - resources: @@ -27,6 +28,7 @@ spec: namespaces: - default validate: + allowExistingViolations: true message: >- Workloads must not run in the default namespace (STIG V-242383). Create a dedicated namespace for your application. diff --git a/infrastructure/kyverno/policies/disallow-host-namespaces.yaml b/infrastructure/kyverno/policies/disallow-host-namespaces.yaml index 3456a64..5f5aec0 100644 --- a/infrastructure/kyverno/policies/disallow-host-namespaces.yaml +++ b/infrastructure/kyverno/policies/disallow-host-namespaces.yaml @@ -15,6 +15,7 @@ spec: background: true rules: - name: host-namespaces + skipBackgroundRequests: true match: any: - resources: @@ -31,6 +32,7 @@ spec: - kyverno - crowdsec validate: + allowExistingViolations: true message: >- Sharing host PID, IPC, or network namespaces is not allowed (STIG V-242386). pattern: diff --git a/infrastructure/kyverno/policies/disallow-latest-tag.yaml b/infrastructure/kyverno/policies/disallow-latest-tag.yaml index bd20dcf..f17d022 100644 --- a/infrastructure/kyverno/policies/disallow-latest-tag.yaml +++ b/infrastructure/kyverno/policies/disallow-latest-tag.yaml @@ -11,6 +11,7 @@ spec: background: true rules: - name: disallow-latest + skipBackgroundRequests: true match: any: - resources: @@ -25,6 +26,7 @@ spec: - crowdsec - home-assistant validate: + allowExistingViolations: true message: "Using ':latest' image tag is not allowed. Specify an explicit tag." pattern: spec: diff --git a/infrastructure/kyverno/policies/disallow-nodeport.yaml b/infrastructure/kyverno/policies/disallow-nodeport.yaml index 8d4731d..fbfb409 100644 --- a/infrastructure/kyverno/policies/disallow-nodeport.yaml +++ b/infrastructure/kyverno/policies/disallow-nodeport.yaml @@ -11,6 +11,7 @@ spec: background: true rules: - name: disallow-nodeport + skipBackgroundRequests: true match: any: - resources: @@ -23,6 +24,7 @@ spec: - kube-system - istio-system validate: + allowExistingViolations: true message: "NodePort services are not allowed. Use ClusterIP or LoadBalancer." pattern: spec: diff --git a/infrastructure/kyverno/policies/disallow-privileged.yaml b/infrastructure/kyverno/policies/disallow-privileged.yaml index 2d8c769..5af0ecc 100644 --- a/infrastructure/kyverno/policies/disallow-privileged.yaml +++ b/infrastructure/kyverno/policies/disallow-privileged.yaml @@ -11,6 +11,7 @@ spec: background: true rules: - name: disallow-privileged + skipBackgroundRequests: true match: any: - resources: @@ -29,6 +30,7 @@ spec: - tetragon - crowdsec validate: + allowExistingViolations: true message: "Privileged containers are not allowed." pattern: spec: diff --git a/infrastructure/kyverno/policies/require-drop-all-capabilities.yaml b/infrastructure/kyverno/policies/require-drop-all-capabilities.yaml index d3a9345..9b87e84 100644 --- a/infrastructure/kyverno/policies/require-drop-all-capabilities.yaml +++ b/infrastructure/kyverno/policies/require-drop-all-capabilities.yaml @@ -15,6 +15,7 @@ spec: background: true rules: - name: require-drop-all + skipBackgroundRequests: true match: any: - resources: @@ -55,6 +56,7 @@ spec: - checkov - external-secrets validate: + allowExistingViolations: true message: >- Containers must drop ALL capabilities (STIG V-242398). Add securityContext.capabilities.drop: ["ALL"] to each container. diff --git a/infrastructure/kyverno/policies/require-istio-ambient.yaml b/infrastructure/kyverno/policies/require-istio-ambient.yaml index d78e072..3581693 100644 --- a/infrastructure/kyverno/policies/require-istio-ambient.yaml +++ b/infrastructure/kyverno/policies/require-istio-ambient.yaml @@ -14,6 +14,7 @@ spec: background: true rules: - name: check-namespace-ambient-label + skipBackgroundRequests: true match: any: - resources: @@ -74,6 +75,7 @@ spec: - user-* - cluster-fleet-* validate: + allowExistingViolations: true message: "Application namespaces must have istio.io/dataplane-mode=ambient for zero-trust mTLS." pattern: metadata: diff --git a/infrastructure/kyverno/policies/require-labels.yaml b/infrastructure/kyverno/policies/require-labels.yaml index c8cce67..6f7ad78 100644 --- a/infrastructure/kyverno/policies/require-labels.yaml +++ b/infrastructure/kyverno/policies/require-labels.yaml @@ -11,6 +11,7 @@ spec: background: true rules: - name: require-app-label + skipBackgroundRequests: true match: any: - resources: @@ -33,6 +34,7 @@ spec: - scylla-operator - cert-manager validate: + allowExistingViolations: true message: "The label 'app' or 'app.kubernetes.io/name' is required." anyPattern: - metadata: diff --git a/infrastructure/kyverno/policies/require-non-root.yaml b/infrastructure/kyverno/policies/require-non-root.yaml index bdf8358..faac9fe 100644 --- a/infrastructure/kyverno/policies/require-non-root.yaml +++ b/infrastructure/kyverno/policies/require-non-root.yaml @@ -11,6 +11,7 @@ spec: background: true rules: - name: require-run-as-non-root + skipBackgroundRequests: true match: any: - resources: @@ -27,6 +28,7 @@ spec: - kyverno - tetragon validate: + allowExistingViolations: true message: "Containers must run as non-root. Set runAsNonRoot to true." pattern: spec: diff --git a/infrastructure/kyverno/policies/require-probes.yaml b/infrastructure/kyverno/policies/require-probes.yaml index 91ba2bc..88ff73c 100644 --- a/infrastructure/kyverno/policies/require-probes.yaml +++ b/infrastructure/kyverno/policies/require-probes.yaml @@ -11,6 +11,7 @@ spec: background: true rules: - name: require-probes + skipBackgroundRequests: true match: any: - resources: @@ -44,6 +45,7 @@ spec: - nextcloud - scylla-manager validate: + allowExistingViolations: true message: "Liveness and readiness probes are required for all containers." pattern: spec: diff --git a/infrastructure/kyverno/policies/require-resource-limits.yaml b/infrastructure/kyverno/policies/require-resource-limits.yaml index cb16365..24f6ea1 100644 --- a/infrastructure/kyverno/policies/require-resource-limits.yaml +++ b/infrastructure/kyverno/policies/require-resource-limits.yaml @@ -11,6 +11,7 @@ spec: background: true rules: - name: require-limits + skipBackgroundRequests: true match: any: - resources: @@ -53,6 +54,7 @@ spec: - checkov - scylla-manager validate: + allowExistingViolations: true message: "All containers must have CPU and memory limits defined." pattern: spec: diff --git a/infrastructure/kyverno/policies/require-ro-rootfs.yaml b/infrastructure/kyverno/policies/require-ro-rootfs.yaml index d07259e..89633bc 100644 --- a/infrastructure/kyverno/policies/require-ro-rootfs.yaml +++ b/infrastructure/kyverno/policies/require-ro-rootfs.yaml @@ -11,6 +11,7 @@ spec: background: true rules: - name: require-ro-rootfs + skipBackgroundRequests: true match: any: - resources: @@ -31,6 +32,7 @@ spec: - nextcloud - home-assistant validate: + allowExistingViolations: true message: "Containers should use a read-only root filesystem." pattern: spec: diff --git a/infrastructure/kyverno/policies/restrict-image-registries.yaml b/infrastructure/kyverno/policies/restrict-image-registries.yaml index 480c7f2..524a717 100644 --- a/infrastructure/kyverno/policies/restrict-image-registries.yaml +++ b/infrastructure/kyverno/policies/restrict-image-registries.yaml @@ -16,6 +16,7 @@ spec: background: true rules: - name: validate-container-registries + skipBackgroundRequests: true match: any: - resources: @@ -29,6 +30,7 @@ spec: - kube-node-lease - kyverno validate: + allowExistingViolations: true message: >- Images must come from allowed registries: docker.io, ghcr.io, quay.io, registry.k8s.io, gcr.io, lscr.io, registry.gitlab.com, cr.fluentbit.io, diff --git a/infrastructure/prometheus/manifests/envoy-route.yaml b/infrastructure/prometheus/manifests/envoy-route.yaml index 8b9b786..7d2a8ff 100644 --- a/infrastructure/prometheus/manifests/envoy-route.yaml +++ b/infrastructure/prometheus/manifests/envoy-route.yaml @@ -5,7 +5,9 @@ metadata: namespace: prometheus spec: parentRefs: - - name: edge + - group: gateway.networking.k8s.io + kind: Gateway + name: edge namespace: gateway sectionName: https hostnames: @@ -16,5 +18,8 @@ spec: type: PathPrefix value: / backendRefs: - - name: kube-prometheus-stack-prometheus + - group: "" + kind: Service + name: kube-prometheus-stack-prometheus port: 9090 + weight: 1 diff --git a/infrastructure/rook-ceph/manifests/envoy-route.yaml b/infrastructure/rook-ceph/manifests/envoy-route.yaml index bbfa626..5796c35 100644 --- a/infrastructure/rook-ceph/manifests/envoy-route.yaml +++ b/infrastructure/rook-ceph/manifests/envoy-route.yaml @@ -5,7 +5,9 @@ metadata: namespace: rook-ceph spec: parentRefs: - - name: edge + - group: gateway.networking.k8s.io + kind: Gateway + name: edge namespace: gateway sectionName: https hostnames: @@ -19,3 +21,4 @@ spec: - group: gateway.envoyproxy.io kind: Backend name: ceph-dashboard + weight: 1 diff --git a/infrastructure/tetragon/tracing-policies/kubernetes-api-access.yaml b/infrastructure/tetragon/tracing-policies/kubernetes-api-access.yaml index 943b123..dd23220 100644 --- a/infrastructure/tetragon/tracing-policies/kubernetes-api-access.yaml +++ b/infrastructure/tetragon/tracing-policies/kubernetes-api-access.yaml @@ -6,9 +6,13 @@ spec: kprobes: - call: tcp_connect syscall: false + return: false args: - index: 0 type: sock + maxData: false + resolve: "" + returnCopy: false selectors: - matchArgs: - index: 0 diff --git a/infrastructure/tetragon/tracing-policies/network-monitoring.yaml b/infrastructure/tetragon/tracing-policies/network-monitoring.yaml index 2ec17c0..312cbd4 100644 --- a/infrastructure/tetragon/tracing-policies/network-monitoring.yaml +++ b/infrastructure/tetragon/tracing-policies/network-monitoring.yaml @@ -6,17 +6,25 @@ spec: kprobes: - call: tcp_connect syscall: false + return: false args: - index: 0 type: sock + maxData: false + resolve: "" + returnCopy: false selectors: - matchActions: - action: Post - call: tcp_close syscall: false + return: false args: - index: 0 type: sock + maxData: false + resolve: "" + returnCopy: false selectors: - matchActions: - action: Post diff --git a/infrastructure/tetragon/tracing-policies/privilege-escalation.yaml b/infrastructure/tetragon/tracing-policies/privilege-escalation.yaml index b9a58e2..0521ec4 100644 --- a/infrastructure/tetragon/tracing-policies/privilege-escalation.yaml +++ b/infrastructure/tetragon/tracing-policies/privilege-escalation.yaml @@ -6,9 +6,13 @@ spec: kprobes: - call: __x64_sys_setuid syscall: true + return: false args: - index: 0 type: int + maxData: false + resolve: "" + returnCopy: false selectors: - matchArgs: - index: 0 @@ -19,9 +23,13 @@ spec: - action: Post - call: __x64_sys_setgid syscall: true + return: false args: - index: 0 type: int + maxData: false + resolve: "" + returnCopy: false selectors: - matchArgs: - index: 0 diff --git a/infrastructure/tetragon/tracing-policies/process-execution.yaml b/infrastructure/tetragon/tracing-policies/process-execution.yaml index 6ef58d4..e0d92b9 100644 --- a/infrastructure/tetragon/tracing-policies/process-execution.yaml +++ b/infrastructure/tetragon/tracing-policies/process-execution.yaml @@ -9,6 +9,9 @@ spec: args: - index: 4 type: syscall64 + maxData: false + resolve: "" + returnCopy: false selectors: - matchArgs: - index: 4 diff --git a/infrastructure/tetragon/tracing-policies/sensitive-file-access.yaml b/infrastructure/tetragon/tracing-policies/sensitive-file-access.yaml index 4da86f3..7b676a8 100644 --- a/infrastructure/tetragon/tracing-policies/sensitive-file-access.yaml +++ b/infrastructure/tetragon/tracing-policies/sensitive-file-access.yaml @@ -6,11 +6,18 @@ spec: kprobes: - call: fd_install syscall: false + return: false args: - index: 0 type: int + maxData: false + resolve: "" + returnCopy: false - index: 1 type: file + maxData: false + resolve: "" + returnCopy: false selectors: - matchArgs: - index: 1 diff --git a/infrastructure/vault/manifests/envoy-route.yaml b/infrastructure/vault/manifests/envoy-route.yaml index 53b3587..2fc802c 100644 --- a/infrastructure/vault/manifests/envoy-route.yaml +++ b/infrastructure/vault/manifests/envoy-route.yaml @@ -5,7 +5,9 @@ metadata: namespace: vault spec: parentRefs: - - name: edge + - group: gateway.networking.k8s.io + kind: Gateway + name: edge namespace: gateway sectionName: https hostnames: @@ -16,5 +18,8 @@ spec: type: PathPrefix value: / backendRefs: - - name: vault + - group: "" + kind: Service + name: vault port: 8200 + weight: 1