Initial commit

apps/nessus/manifests/cnpg-cluster.yaml

@@ -0,0 +1,52 @@
+# CloudNative PostgreSQL cluster for Nessus
+# Low resource configuration for memory-constrained environments
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: pg-nessus
+  namespace: nessus
+spec:
+  imageName: ghcr.io/cloudnative-pg/postgresql:16
+  instances: 2
+
+  # Low resource limits for constrained environments
+  resources:
+    requests:
+      memory: "512Mi"
+      cpu: "50m"
+    limits:
+      memory: "1Gi"
+
+  # Spread replicas across different nodes for HA
+  affinity:
+    topologyKey: kubernetes.io/hostname
+
+  storage:
+    size: 20Gi
+    storageClass: rook-ceph-block
+
+  primaryUpdateStrategy: unsupervised
+  
+  # PostgreSQL configuration optimized for low memory
+  postgresql:
+    parameters:
+      max_connections: "100"
+      shared_buffers: "256MB"
+      effective_cache_size: "768MB"
+      maintenance_work_mem: "64MB"
+      checkpoint_completion_target: "0.9"
+      wal_buffers: "8MB"
+      default_statistics_target: "100"
+      random_page_cost: "1.1"
+      effective_io_concurrency: "200"
+      work_mem: "2621kB"
+      min_wal_size: "512MB"
+      max_wal_size: "2GB"
+
+  bootstrap:
+    initdb:
+      database: nessus
+      owner: nessus
+
+  monitoring:
+    enablePodMonitor: true

apps/nessus/manifests/cnpg-secrets.yaml

@@ -0,0 +1,44 @@
+# External Secrets Operator configuration for Nessus PostgreSQL password rotation
+# This auto-generates and rotates the database password in Vault
+---
+apiVersion: generators.external-secrets.io/v1alpha1
+kind: Password
+metadata:
+  name: nessus-db-password
+  namespace: nessus
+spec:
+  length: 32
+  digits: 10
+  symbols: 0  # No special chars to avoid escaping issues
+  symbolCharacters: ""
+  noUpper: false
+  allowRepeat: true
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: nessus-cnpg-secret
+  namespace: nessus
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  target:
+    name: nessus-db-secret
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      data:
+        password: "{{ .password }}"
+        username: "nessus"
+        host: "pg-nessus-rw"
+        port: "5432"
+        database: "nessus"
+  dataFrom:
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: Password
+          name: nessus-db-password

apps/nessus/manifests/deployment.yaml

@@ -0,0 +1,134 @@
+# Nessus Vulnerability Scanner Deployment
+# Optimized for low resource usage in constrained environments
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nessus
+  namespace: nessus
+  labels:
+    app: nessus
+    app.kubernetes.io/name: nessus
+    app.kubernetes.io/component: security-scanner
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate  # Only one instance can mount the PVC at a time
+  selector:
+    matchLabels:
+      app: nessus
+  template:
+    metadata:
+      labels:
+        app: nessus
+      annotations:
+        # Reloader auto-restart when secrets change
+        secret.reloader.stakater.com/reload: "nessus-admin-credentials"
+    spec:
+      containers:
+        - name: nessus
+          image: docker.io/tenable/nessus:10.8.3-ubuntu
+          imagePullPolicy: IfNotPresent
+          
+          # Low resource configuration for constrained environments
+          resources:
+            requests:
+              memory: "1Gi"
+              cpu: "50m"
+            limits:
+              memory: "2Gi"
+          
+          ports:
+            - name: https
+              containerPort: 8834
+              protocol: TCP
+          
+          # Environment variables for Nessus configuration
+          env:
+            # Admin credentials from Vault (via ESO)
+            - name: USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: nessus-admin-credentials
+                  key: NESSUS_USERNAME
+            - name: PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: nessus-admin-credentials
+                  key: NESSUS_PASSWORD
+            
+            # Auto-update settings (plugins only to save bandwidth/time)
+            - name: AUTO_UPDATE
+              value: "plugins"
+          
+          # Volume mounts for persistent data
+          volumeMounts:
+            - name: nessus-data
+              mountPath: /opt/nessus/var/nessus
+          
+          # Startup probe - give Nessus time to initialize
+          startupProbe:
+            httpGet:
+              path: /
+              port: 8834
+              scheme: HTTPS
+            initialDelaySeconds: 60
+            periodSeconds: 15
+            timeoutSeconds: 5
+            failureThreshold: 60  # 15 minutes total startup time
+          
+          # Liveness probe
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 8834
+              scheme: HTTPS
+            initialDelaySeconds: 300
+            periodSeconds: 30
+            timeoutSeconds: 10
+            failureThreshold: 5
+          
+          # Readiness probe
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 8834
+              scheme: HTTPS
+            initialDelaySeconds: 120
+            periodSeconds: 15
+            timeoutSeconds: 5
+            failureThreshold: 5
+          
+          # Security context
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: false  # Nessus requires root
+            capabilities:
+              drop:
+                - ALL
+              add:
+                - NET_ADMIN  # Required for network scanning
+                - NET_RAW    # Required for raw socket scanning
+      
+      volumes:
+        - name: nessus-data
+          persistentVolumeClaim:
+            claimName: nessus-data
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: nessus
+  namespace: nessus
+  labels:
+    app: nessus
+spec:
+  type: ClusterIP
+  ports:
+    - name: https
+      port: 8834
+      targetPort: 8834
+      protocol: TCP
+  selector:
+    app: nessus

apps/nessus/manifests/external-secret.yaml

@@ -0,0 +1,30 @@
+# External Secrets Operator configuration for Nessus admin credentials
+# Pulls Nessus admin username and password from Vault
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: nessus-admin-secret
+  namespace: nessus
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  target:
+    name: nessus-admin-credentials
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      data:
+        NESSUS_USERNAME: "{{ .username }}"
+        NESSUS_PASSWORD: "{{ .password }}"
+  data:
+    - secretKey: username
+      remoteRef:
+        key: secret/nessus
+        property: admin-username
+    - secretKey: password
+      remoteRef:
+        key: secret/nessus
+        property: admin-password

apps/nessus/manifests/istio-virtualservice.yaml

@@ -0,0 +1,31 @@
+apiVersion: networking.istio.io/v1beta1
+kind: DestinationRule
+metadata:
+  name: nessus
+  namespace: nessus
+spec:
+  host: nessus.nessus.svc.cluster.local
+  trafficPolicy:
+    tls:
+      mode: SIMPLE
+      sni: nessus.nessus.svc.cluster.local
+      insecureSkipVerify: true
+
+---
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: nessus
+  namespace: nessus
+spec:
+  hosts:
+    - nessus.kube.huskypup.net
+  gateways:
+    - istio-system/edge
+  http:
+    - timeout: 3600s
+      route:
+        - destination:
+            host: nessus.nessus.svc.cluster.local
+            port:
+              number: 8834

apps/nessus/manifests/pvc.yaml

@@ -0,0 +1,13 @@
+# PersistentVolumeClaim for Nessus scan data and plugin storage
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nessus-data
+  namespace: nessus
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: rook-ceph-block
+  resources:
+    requests:
+      storage: 50Gi