Skip to content

Commit 75a0e1c

Browse files
epappasepappas
authored
Merge pull request #309 from one-covenant/feat/k3s-automated-security
feat(k3s) Add automated security scanners
2 parents 8724e85 + 24db0d5 commit 75a0e1c

File tree

13 files changed

+4358
-0
lines changed

13 files changed

+4358
-0
lines changed

‎orchestrator/ansible/playbooks/deploy-security.yml‎

Lines changed: 177 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,177 @@
1+
---
2+
# Deploy Security Stack (Trivy + Falco) to K3s Cluster
3+
# Usage: ansible-playbook -i inventories/production.ini playbooks/deploy-security.yml
4+
- name: Deploy Security Stack (Trivy + Falco)
5+
hosts: k3s_server[0]
6+
become: yes
7+
gather_facts: yes
8+
9+
vars:
10+
kubeconfig_path: "{{ ansible_env.HOME }}/.kube/k3s-basilica-config"
11+
k8s_security_dir: "{{ playbook_dir }}/../../k8s/security"
12+
trivy_operator_image: "ghcr.io/aquasecurity/trivy-operator:0.20.0"
13+
falco_image: "falcosecurity/falco-no-driver:0.37.0"
14+
falcosidekick_image: "falcosecurity/falcosidekick:2.28.0"
15+
16+
tasks:
17+
- name: Verify K3s cluster is healthy
18+
command: kubectl --kubeconfig={{ kubeconfig_path }} get nodes
19+
register: nodes_status
20+
changed_when: false
21+
failed_when: "'NotReady' in nodes_status.stdout"
22+
23+
- name: Display cluster nodes
24+
debug:
25+
msg: "{{ nodes_status.stdout_lines }}"
26+
27+
# ===== Trivy Deployment =====
28+
- name: Create trivy-system namespace
29+
kubernetes.core.k8s:
30+
kubeconfig: "{{ kubeconfig_path }}"
31+
state: present
32+
src: "{{ k8s_security_dir }}/trivy/namespace.yaml"
33+
34+
- name: Deploy Trivy RBAC
35+
kubernetes.core.k8s:
36+
kubeconfig: "{{ kubeconfig_path }}"
37+
state: present
38+
src: "{{ k8s_security_dir }}/trivy/rbac.yaml"
39+
40+
- name: Deploy Trivy Operator
41+
kubernetes.core.k8s:
42+
kubeconfig: "{{ kubeconfig_path }}"
43+
state: present
44+
src: "{{ k8s_security_dir }}/trivy/operator-deployment.yaml"
45+
46+
- name: Wait for Trivy Operator readiness
47+
kubernetes.core.k8s_info:
48+
kubeconfig: "{{ kubeconfig_path }}"
49+
kind: Deployment
50+
namespace: trivy-system
51+
name: trivy-operator
52+
wait: yes
53+
wait_timeout: 300
54+
wait_condition:
55+
type: Available
56+
status: "True"
57+
58+
- name: Verify Trivy Operator pod status
59+
command: >
60+
kubectl --kubeconfig={{ kubeconfig_path }}
61+
get pods -n trivy-system -l app=trivy-operator -o jsonpath='{.items[0].status.phase}'
62+
register: trivy_pod_status
63+
changed_when: false
64+
65+
- name: Display Trivy Operator status
66+
debug:
67+
msg: "Trivy Operator status: {{ trivy_pod_status.stdout }}"
68+
69+
# ===== Falco Deployment =====
70+
- name: Create falco namespace
71+
kubernetes.core.k8s:
72+
kubeconfig: "{{ kubeconfig_path }}"
73+
state: present
74+
src: "{{ k8s_security_dir }}/falco/namespace.yaml"
75+
76+
- name: Deploy Falco RBAC
77+
kubernetes.core.k8s:
78+
kubeconfig: "{{ kubeconfig_path }}"
79+
state: present
80+
src: "{{ k8s_security_dir }}/falco/rbac.yaml"
81+
82+
- name: Deploy Falco ConfigMap
83+
kubernetes.core.k8s:
84+
kubeconfig: "{{ kubeconfig_path }}"
85+
state: present
86+
src: "{{ k8s_security_dir }}/falco/configmap.yaml"
87+
88+
- name: Deploy Falco GPU security rules
89+
kubernetes.core.k8s:
90+
kubeconfig: "{{ kubeconfig_path }}"
91+
state: present
92+
src: "{{ k8s_security_dir }}/falco/rules-gpu.yaml"
93+
94+
- name: Deploy Falco DaemonSet
95+
kubernetes.core.k8s:
96+
kubeconfig: "{{ kubeconfig_path }}"
97+
state: present
98+
src: "{{ k8s_security_dir }}/falco/daemonset.yaml"
99+
100+
- name: Deploy Falcosidekick
101+
kubernetes.core.k8s:
102+
kubeconfig: "{{ kubeconfig_path }}"
103+
state: present
104+
src: "{{ k8s_security_dir }}/falco/falcosidekick-deployment.yaml"
105+
106+
- name: Wait for Falco DaemonSet rollout
107+
command: >
108+
kubectl --kubeconfig={{ kubeconfig_path }}
109+
rollout status daemonset/falco -n falco --timeout=300s
110+
register: falco_rollout
111+
changed_when: false
112+
113+
- name: Verify Falco DaemonSet coverage
114+
command: >
115+
kubectl --kubeconfig={{ kubeconfig_path }}
116+
get daemonset -n falco falco -o jsonpath='{.status.numberReady}/{.status.desiredNumberScheduled}'
117+
register: falco_coverage
118+
changed_when: false
119+
120+
- name: Display Falco DaemonSet coverage
121+
debug:
122+
msg: "Falco coverage: {{ falco_coverage.stdout }} pods ready"
123+
124+
- name: Wait for Falcosidekick readiness
125+
kubernetes.core.k8s_info:
126+
kubeconfig: "{{ kubeconfig_path }}"
127+
kind: Deployment
128+
namespace: falco
129+
name: falcosidekick
130+
wait: yes
131+
wait_timeout: 120
132+
wait_condition:
133+
type: Available
134+
status: "True"
135+
136+
# ===== Common Resources =====
137+
- name: Deploy network policies
138+
kubernetes.core.k8s:
139+
kubeconfig: "{{ kubeconfig_path }}"
140+
state: present
141+
src: "{{ k8s_security_dir }}/common/network-policies.yaml"
142+
143+
- name: Deploy resource quotas
144+
kubernetes.core.k8s:
145+
kubeconfig: "{{ kubeconfig_path }}"
146+
state: present
147+
src: "{{ k8s_security_dir }}/common/resource-quotas.yaml"
148+
149+
# ===== Verification =====
150+
- name: Get security stack pods
151+
command: >
152+
kubectl --kubeconfig={{ kubeconfig_path }}
153+
get pods -n {{ item }} -o wide
154+
loop:
155+
- trivy-system
156+
- falco
157+
register: security_pods
158+
changed_when: false
159+
160+
- name: Display security stack status
161+
debug:
162+
msg: "{{ item.stdout_lines }}"
163+
loop: "{{ security_pods.results }}"
164+
loop_control:
165+
label: "{{ item.item }}"
166+
167+
- name: Summary
168+
debug:
169+
msg:
170+
- "Security stack deployed successfully"
171+
- "Trivy Operator: {{ trivy_pod_status.stdout }}"
172+
- "Falco DaemonSet: {{ falco_coverage.stdout }} pods"
173+
- ""
174+
- "Next steps:"
175+
- " 1. Monitor VulnerabilityReports: kubectl get vulnerabilityreports -A"
176+
- " 2. Check Falco logs: kubectl logs -n falco -l app=falco --tail=50"
177+
- " 3. View architecture docs: docs/architecture/TRIVY-FALCO-INTEGRATION.md"

‎orchestrator/k8s/security/common/network-policies.yaml‎

Lines changed: 177 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,177 @@
1+
---
2+
# Ingress policy for Trivy Operator
3+
apiVersion: networking.k8s.io/v1
4+
kind: NetworkPolicy
5+
metadata:
6+
name: trivy-operator-ingress
7+
namespace: trivy-system
8+
spec:
9+
podSelector:
10+
matchLabels:
11+
app: trivy-operator
12+
policyTypes:
13+
- Ingress
14+
ingress:
15+
# Prometheus scraping from basilica-system
16+
- from:
17+
- namespaceSelector:
18+
matchLabels:
19+
kubernetes.io/metadata.name: basilica-system
20+
ports:
21+
- protocol: TCP
22+
port: 8080
23+
# Health checks from kubelet
24+
- from:
25+
- namespaceSelector:
26+
matchLabels:
27+
kubernetes.io/metadata.name: kube-system
28+
ports:
29+
- protocol: TCP
30+
port: 9090
31+
---
32+
# Egress policy for Trivy Operator
33+
apiVersion: networking.k8s.io/v1
34+
kind: NetworkPolicy
35+
metadata:
36+
name: trivy-operator-egress
37+
namespace: trivy-system
38+
spec:
39+
podSelector:
40+
matchLabels:
41+
app: trivy-operator
42+
policyTypes:
43+
- Egress
44+
egress:
45+
# K8s API server access
46+
- to: []
47+
ports:
48+
- protocol: TCP
49+
port: 443
50+
- protocol: TCP
51+
port: 6443
52+
# DNS
53+
- to: []
54+
ports:
55+
- protocol: UDP
56+
port: 53
57+
- protocol: TCP
58+
port: 53
59+
# Container registries (HTTPS)
60+
- to: []
61+
ports:
62+
- protocol: TCP
63+
port: 443
64+
---
65+
# Ingress policy for Falco DaemonSet (Prometheus scraping)
66+
apiVersion: networking.k8s.io/v1
67+
kind: NetworkPolicy
68+
metadata:
69+
name: falco-ingress
70+
namespace: falco
71+
spec:
72+
podSelector:
73+
matchLabels:
74+
app: falco
75+
policyTypes:
76+
- Ingress
77+
ingress:
78+
# Prometheus scraping from basilica-system
79+
- from:
80+
- namespaceSelector:
81+
matchLabels:
82+
kubernetes.io/metadata.name: basilica-system
83+
ports:
84+
- protocol: TCP
85+
port: 8765
86+
# Health checks from kubelet
87+
- from:
88+
- namespaceSelector:
89+
matchLabels:
90+
kubernetes.io/metadata.name: kube-system
91+
ports:
92+
- protocol: TCP
93+
port: 8765
94+
---
95+
# Egress policy for Falco DaemonSet
96+
apiVersion: networking.k8s.io/v1
97+
kind: NetworkPolicy
98+
metadata:
99+
name: falco-egress
100+
namespace: falco
101+
spec:
102+
podSelector:
103+
matchLabels:
104+
app: falco
105+
policyTypes:
106+
- Egress
107+
egress:
108+
# K8s API server access
109+
- to: []
110+
ports:
111+
- protocol: TCP
112+
port: 443
113+
- protocol: TCP
114+
port: 6443
115+
# DNS
116+
- to: []
117+
ports:
118+
- protocol: UDP
119+
port: 53
120+
- protocol: TCP
121+
port: 53
122+
# Falcosidekick communication
123+
- to:
124+
- podSelector:
125+
matchLabels:
126+
app: falcosidekick
127+
ports:
128+
- protocol: TCP
129+
port: 2801
130+
---
131+
# Network policies for Falcosidekick
132+
apiVersion: networking.k8s.io/v1
133+
kind: NetworkPolicy
134+
metadata:
135+
name: falcosidekick-egress
136+
namespace: falco
137+
spec:
138+
podSelector:
139+
matchLabels:
140+
app: falcosidekick
141+
policyTypes:
142+
- Egress
143+
- Ingress
144+
ingress:
145+
# Allow inbound from Falco pods
146+
- from:
147+
- podSelector:
148+
matchLabels:
149+
app: falco
150+
ports:
151+
- protocol: TCP
152+
port: 2801
153+
egress:
154+
# DNS
155+
- to: []
156+
ports:
157+
- protocol: UDP
158+
port: 53
159+
- protocol: TCP
160+
port: 53
161+
# External observability (Loki, Prometheus)
162+
- to: []
163+
ports:
164+
- protocol: TCP
165+
port: 443
166+
- protocol: TCP
167+
port: 3100
168+
- protocol: TCP
169+
port: 9090
170+
# Basilica API webhook
171+
- to:
172+
- namespaceSelector:
173+
matchLabels:
174+
kubernetes.io/metadata.name: basilica-system
175+
ports:
176+
- protocol: TCP
177+
port: 8080

0 commit comments

Comments
 (0)