clawd
ca83efe828
- Add comprehensive network policies to k8s/staging/network-policy.yaml - Implements default-deny ingress pattern with explicit allow rules - Critical: Add DNS egress rule for CoreDNS resolution (port 53 UDP/TCP) - Policies cover: ingress-nginx→backend, backend→postgres, monitoring scrape - External API egress for backend (HTTP/HTTPS) - CDN egress for frontend (HTTP/HTTPS) - Status: Applied to gravl-staging namespace, verified operational
128 lines
3.6 KiB
YAML
128 lines
3.6 KiB
YAML
# sealed-secrets Installation & Configuration
|
|
# Phase 10-07, Task 5: Secrets Management Security Gate
|
|
# Status: READY FOR IMPLEMENTATION
|
|
|
|
---
|
|
# Option 1: sealed-secrets via kubeseal
|
|
# Installation: kubectl apply -f https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.24.0/controller.yaml
|
|
|
|
# Add Bitnami Helm repo
|
|
# helm repo add sealed-secrets https://bitnami-labs.github.io/sealed-secrets
|
|
# helm repo update
|
|
|
|
# Install sealed-secrets controller
|
|
# helm install sealed-secrets -n kube-system sealed-secrets/sealed-secrets
|
|
|
|
---
|
|
# After installation, extract sealing key for production backup
|
|
# kubectl get secret -n kube-system -l sealedsecrets.bitnami.com/status=active -o jsonpath='{.items[0].data.tls\.crt}' | base64 -d > /secure/location/sealed-secrets-prod.crt
|
|
# kubectl get secret -n kube-system -l sealedsecrets.bitnami.com/status=active -o jsonpath='{.items[0].data.tls\.key}' | base64 -d > /secure/location/sealed-secrets-prod.key
|
|
|
|
---
|
|
# Example: Sealing a secret for production
|
|
# 1. Create plain secret:
|
|
# cat <<EOF | kubectl apply -f -
|
|
# apiVersion: v1
|
|
# kind: Secret
|
|
# metadata:
|
|
# name: gravl-secrets
|
|
# namespace: gravl-prod
|
|
# type: Opaque
|
|
# data:
|
|
# DATABASE_PASSWORD: $(echo -n 'your-secure-password' | base64)
|
|
# JWT_SECRET: $(openssl rand -hex 64 | base64)
|
|
# EOF
|
|
|
|
# 2. Seal the secret:
|
|
# kubeseal --format=yaml < <(kubectl get secret gravl-secrets -n gravl-prod -o yaml) > gravl-secrets-sealed.yaml
|
|
# kubectl delete secret gravl-secrets -n gravl-prod (delete plain secret)
|
|
|
|
# 3. Apply sealed secret:
|
|
# kubectl apply -f gravl-secrets-sealed.yaml
|
|
|
|
---
|
|
# Template for sealed secret (encrypted, safe to commit)
|
|
apiVersion: bitnami.com/v1alpha1
|
|
kind: SealedSecret
|
|
metadata:
|
|
name: gravl-secrets
|
|
namespace: gravl-prod
|
|
spec:
|
|
encryptedData:
|
|
DATABASE_PASSWORD: AgBvZ... (encrypted blob)
|
|
JWT_SECRET: AgBpR... (encrypted blob)
|
|
template:
|
|
metadata:
|
|
name: gravl-secrets
|
|
namespace: gravl-prod
|
|
type: Opaque
|
|
---
|
|
|
|
# Alternative: External Secrets Operator + AWS Secrets Manager
|
|
# For production with AWS infrastructure
|
|
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: external-secrets
|
|
---
|
|
|
|
# Install External Secrets Operator
|
|
# helm repo add external-secrets https://charts.external-secrets.io
|
|
# helm install external-secrets external-secrets/external-secrets -n external-secrets --create-namespace
|
|
|
|
---
|
|
# AWS Secret (in AWS Secrets Manager - NOT in Git)
|
|
# aws secretsmanager create-secret --name gravl/prod/db-password --secret-string "your-secure-password"
|
|
# aws secretsmanager create-secret --name gravl/prod/jwt-secret --secret-string $(openssl rand -hex 64)
|
|
|
|
---
|
|
# IRSA (IAM Role for Service Account) - allows pod to assume AWS role
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: gravl-secrets-reader
|
|
namespace: gravl-prod
|
|
annotations:
|
|
eks.amazonaws.com/role-arn: arn:aws:iam::ACCOUNT_ID:role/gravl-prod-secrets-reader
|
|
---
|
|
|
|
# External Secret that pulls from AWS Secrets Manager
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: gravl-aws-secrets
|
|
namespace: gravl-prod
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: aws-secrets-store
|
|
kind: SecretStore
|
|
target:
|
|
name: gravl-secrets
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: DATABASE_PASSWORD
|
|
remoteRef:
|
|
key: gravl/prod/db-password
|
|
- secretKey: JWT_SECRET
|
|
remoteRef:
|
|
key: gravl/prod/jwt-secret
|
|
---
|
|
|
|
# AWS SecretStore (references IRSA role)
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: SecretStore
|
|
metadata:
|
|
name: aws-secrets-store
|
|
namespace: gravl-prod
|
|
spec:
|
|
provider:
|
|
aws:
|
|
service: SecretsManager
|
|
region: eu-west-1
|
|
auth:
|
|
jwt:
|
|
serviceAccountRef:
|
|
name: gravl-secrets-reader
|