jakman85andClaude Opus 4.8
d9a80e5350
Prep only — nothing deployed; running cluster untouched. Reconciliation graph (operator-approved Option A): author clusters/dev/rollout/ = 4 per-component Flux Kustomizations (kyverno->cilium->longhorn->monitoring, monitoring dependsOn longhorn). Dev overlay $patch:delete's the monolithic base platform/apps and adds ./rollout, so only the no-secret tier reconciles; the secret-blocked components are simply not created until hand-offs arrive. The no-secret tier carries no SOPS content, so it needs no sops-age key. prod is untouched (still builds the monolith). Convergence path coded in (delete rollout/ + the two deletes) — R-ENV-02 divergence flagged for architect review. Component hardening via cluster-vars (prod keeps strict posture): - KYVERNO_VALIDATION_ACTION Enforce->Audit(dev), _WEBHOOK_FAILURE_POLICY Fail->Ignore(dev), _ADMISSION_REPLICAS 3->1(dev); webhook namespaceSelector excludes system+platform namespaces. - MONITORING_STORAGE_CLASS var; GRAFANA_ADMIN_SECRET var (dev ''=chart default); Alertmanager SMTP/secret deferred to Phase-4 with verbatim re-enable markers. Cilium parity verified against the live CNI (no-op adopt). Validated: kubectl kustomize dev/prod/all-components, envsubst->YAML parse, make -C ci gate PASS. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
58 lines
2.4 KiB
YAML
58 lines
2.4 KiB
YAML
# Serves: R-SEC-01 (in-cluster admission variant)
|
|
#
|
|
# WHY THIS EXISTS (and diverges from the CI policy):
|
|
# The CI policy `disallow-plaintext-secrets` requires a top-level `sops` block on
|
|
# the Secret manifest. That works in CI (it scans the encrypted git manifest) but
|
|
# is IMPOSSIBLE to satisfy at admission: Flux decrypts SOPS *before* the Secret
|
|
# reaches the API server, so an admitted Secret never has a `sops` block. Applying
|
|
# the CI policy in-cluster would reject every real Secret.
|
|
#
|
|
# So the in-cluster invariant is PROVENANCE, not ciphertext: a Secret in an
|
|
# application namespace must have been produced by the SOPS/Flux path (it carries
|
|
# Flux's kustomize labels) OR be an exempt controller-generated Secret. A Secret
|
|
# hand-applied with `kubectl` (the plaintext-into-the-cluster path) has neither and
|
|
# is rejected. This is the enforceable reading of docs/07's "reject a plaintext
|
|
# Secret at admission" -- flagged as an escalation in the T-0.5 report.
|
|
apiVersion: kyverno.io/v1
|
|
kind: ClusterPolicy
|
|
metadata:
|
|
name: secret-provenance
|
|
annotations:
|
|
policies.kyverno.io/title: Require managed provenance on app-namespace Secrets
|
|
policies.kyverno.io/category: Secrets
|
|
policies.kyverno.io/severity: critical
|
|
homelab.keithjackson.dev/requirements: R-SEC-01
|
|
homelab.keithjackson.dev/scope: admission-only
|
|
spec:
|
|
validationFailureAction: ${KYVERNO_VALIDATION_ACTION}
|
|
background: false
|
|
rules:
|
|
- name: secrets-must-be-flux-managed
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- Secret
|
|
namespaceSelector:
|
|
matchLabels:
|
|
homelab.keithjackson.dev/app-namespace: "true"
|
|
# Controller-generated Secrets (SA tokens, cert-manager, Helm) are exempt.
|
|
exclude:
|
|
any:
|
|
- resources:
|
|
selector:
|
|
matchLabels:
|
|
homelab.keithjackson.dev/secret-managed-by: controller
|
|
- resources:
|
|
selector:
|
|
matchExpressions:
|
|
- key: kustomize.toolkit.fluxcd.io/name
|
|
operator: Exists
|
|
validate:
|
|
message: >-
|
|
Secrets in application namespaces must be delivered by Flux from
|
|
SOPS-encrypted git (they carry a kustomize.toolkit.fluxcd.io/name label) or
|
|
be exempt controller-generated Secrets. Hand-applied (plaintext) Secrets are
|
|
rejected (R-SEC-01, docs/07).
|
|
deny: {}
|