jakman85andClaude Opus 4.8
d9a80e5350
Prep only — nothing deployed; running cluster untouched. Reconciliation graph (operator-approved Option A): author clusters/dev/rollout/ = 4 per-component Flux Kustomizations (kyverno->cilium->longhorn->monitoring, monitoring dependsOn longhorn). Dev overlay $patch:delete's the monolithic base platform/apps and adds ./rollout, so only the no-secret tier reconciles; the secret-blocked components are simply not created until hand-offs arrive. The no-secret tier carries no SOPS content, so it needs no sops-age key. prod is untouched (still builds the monolith). Convergence path coded in (delete rollout/ + the two deletes) — R-ENV-02 divergence flagged for architect review. Component hardening via cluster-vars (prod keeps strict posture): - KYVERNO_VALIDATION_ACTION Enforce->Audit(dev), _WEBHOOK_FAILURE_POLICY Fail->Ignore(dev), _ADMISSION_REPLICAS 3->1(dev); webhook namespaceSelector excludes system+platform namespaces. - MONITORING_STORAGE_CLASS var; GRAFANA_ADMIN_SECRET var (dev ''=chart default); Alertmanager SMTP/secret deferred to Phase-4 with verbatim re-enable markers. Cilium parity verified against the live CNI (no-op adopt). Validated: kubectl kustomize dev/prod/all-components, envsubst->YAML parse, make -C ci gate PASS. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
66 lines
2.3 KiB
YAML
66 lines
2.3 KiB
YAML
# SCAFFOLDING for a later phase (Phase 2, task T-2.7) -- NOT applied in Phase 0
|
|
# (no cluster exists yet). Installs Kyverno so the SAME L0 policies run in-cluster
|
|
# as an admission controller (defense in depth per docs/07, ADR-0011). Flux
|
|
# HelmRelease skeleton; chart/app versions are pinned and bumped via the update path.
|
|
---
|
|
apiVersion: source.toolkit.fluxcd.io/v1
|
|
kind: HelmRepository
|
|
metadata:
|
|
name: kyverno
|
|
namespace: kyverno
|
|
spec:
|
|
interval: 24h
|
|
url: https://kyverno.github.io/kyverno/
|
|
---
|
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: kyverno
|
|
namespace: kyverno
|
|
spec:
|
|
interval: 1h
|
|
chart:
|
|
spec:
|
|
chart: kyverno
|
|
version: "3.3.x" # pin to the exact chart the operator vendors
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: kyverno
|
|
namespace: kyverno
|
|
install:
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
remediation:
|
|
retries: 3
|
|
values:
|
|
# Admission controller replicas — cluster-vars knob (prod 3 / dev 1). HA so a single pod
|
|
# restart cannot open an enforcement gap; dev drops to 1 to save RAM during bootstrap.
|
|
admissionController:
|
|
replicas: ${KYVERNO_ADMISSION_REPLICAS}
|
|
backgroundController:
|
|
enabled: true # needed for generate (default-deny baseline) + sync
|
|
reportsController:
|
|
enabled: true
|
|
cleanupController:
|
|
enabled: true
|
|
# Webhook failure policy — cluster-vars knob (prod Fail / dev Ignore). Fail is fail-CLOSED
|
|
# (reject rather than silently admit when the webhook is unreachable, coordination-protocol.md
|
|
# #8); dev uses Ignore (fail-open) so a cold/unhealthy Kyverno cannot brick admission during
|
|
# bootstrap. The namespaceSelector ALSO excludes system + platform namespaces at the webhook
|
|
# layer — belt-and-suspenders: policies already scope to app-namespace=true, but this
|
|
# guarantees kube-system/flux-system/CNI/storage/monitoring admission never routes to Kyverno.
|
|
config:
|
|
webhooks:
|
|
- failurePolicy: ${KYVERNO_WEBHOOK_FAILURE_POLICY}
|
|
namespaceSelector:
|
|
matchExpressions:
|
|
- key: kubernetes.io/metadata.name
|
|
operator: NotIn
|
|
values:
|
|
- kube-system
|
|
- flux-system
|
|
- kyverno
|
|
- longhorn-system
|
|
- monitoring
|