From ac994f144af757bc95fa4b55cb6b988029c7b523 Mon Sep 17 00:00:00 2001 From: Sirius Devops Date: Fri, 15 May 2026 00:00:58 +0000 Subject: [PATCH 1/3] fix: container hardening + NetworkPolicy for waitlist-api - deployment.yaml: securityContext (runAsNonRoot, readOnlyRootFilesystem, drop ALL caps) - network-policy.yaml: egress only to CNPG PG (5432) + api.telegram.org (443) - kustomization.yaml: register new NetworkPolicy resource - waitlist-telegram-secret: add admin_api_key field --- .../customer1/waitlist-api/deployment.yaml | 26 +++++++++++ .../customer1/waitlist-api/kustomization.yaml | 1 + .../waitlist-api/network-policy.yaml | 44 +++++++++++++++++++ .../waitlist-telegram-secret.yaml | 1 + 4 files changed, 72 insertions(+) create mode 100644 apps/base/customer1/waitlist-api/network-policy.yaml diff --git a/apps/base/customer1/waitlist-api/deployment.yaml b/apps/base/customer1/waitlist-api/deployment.yaml index a1c9c9f..9beed23 100644 --- a/apps/base/customer1/waitlist-api/deployment.yaml +++ b/apps/base/customer1/waitlist-api/deployment.yaml @@ -13,6 +13,12 @@ spec: labels: app: waitlist-api spec: + serviceAccountName: waitlist-api + securityContext: + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 1000 + fsGroup: 1000 containers: - name: api image: ghcr.io/sirius0xdev/waitlist-api:latest @@ -20,6 +26,12 @@ spec: ports: - containerPort: 8080 protocol: TCP + securityContext: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL env: - name: DB_HOST value: "siriusdevops-pgdb-rw.customer1.svc.cluster.local" @@ -47,6 +59,11 @@ spec: secretKeyRef: name: waitlist-telegram-secret key: chat_id + - name: ADMIN_API_KEY + valueFrom: + secretKeyRef: + name: waitlist-telegram-secret + key: admin_api_key resources: requests: cpu: 50m @@ -55,6 +72,11 @@ spec: cpu: 200m memory: 256Mi + volumeMounts: + - name: tmp + mountPath: /tmp + readOnly: false + startupProbe: httpGet: path: /healthz @@ -88,6 +110,10 @@ spec: failureThreshold: 3 successThreshold: 1 + volumes: + - name: tmp + emptyDir: {} + --- apiVersion: v1 kind: Service diff --git a/apps/base/customer1/waitlist-api/kustomization.yaml b/apps/base/customer1/waitlist-api/kustomization.yaml index a221887..7dfda4c 100644 --- a/apps/base/customer1/waitlist-api/kustomization.yaml +++ b/apps/base/customer1/waitlist-api/kustomization.yaml @@ -4,3 +4,4 @@ resources: - deployment.yaml - waitlist-telegram-secret.yaml - http-route.yaml + - network-policy.yaml diff --git a/apps/base/customer1/waitlist-api/network-policy.yaml b/apps/base/customer1/waitlist-api/network-policy.yaml new file mode 100644 index 0000000..8f2c9ea --- /dev/null +++ b/apps/base/customer1/waitlist-api/network-policy.yaml @@ -0,0 +1,44 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: waitlist-api-egress + namespace: customer1 +spec: + podSelector: + matchLabels: + app: waitlist-api + policyTypes: + - Egress + egress: + # Allow DNS resolution (required for api.telegram.org lookups) + - to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + - podSelector: + matchLabels: + k8s-app: kube-dns + ports: + - protocol: UDP + port: 53 + - protocol: TCP + port: 53 + # Allow PostgreSQL to CNPG cluster + - to: + - podSelector: + matchLabels: + cnpg.io/cluster: siriusdevops-pgdb + ports: + - protocol: TCP + port: 5432 + # Allow Telegram Bot API + - to: + - ipBlock: + cidr: 0.0.0.0/0 + except: + - 10.0.0.0/8 + - 172.16.0.0/12 + - 192.168.0.0/16 + ports: + - protocol: TCP + port: 443 diff --git a/apps/base/customer1/waitlist-api/waitlist-telegram-secret.yaml b/apps/base/customer1/waitlist-api/waitlist-telegram-secret.yaml index 961e65b..7d63e27 100644 --- a/apps/base/customer1/waitlist-api/waitlist-telegram-secret.yaml +++ b/apps/base/customer1/waitlist-api/waitlist-telegram-secret.yaml @@ -7,6 +7,7 @@ type: Opaque stringData: bot_token: CHANGEME chat_id: CHANGEME + admin_api_key: CHANGEME sops: age: - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7 From 31fcd59a5f73357800efc17c42c8accdd38d8750 Mon Sep 17 00:00:00 2001 From: Sirius Devops Date: Fri, 15 May 2026 01:36:06 +0000 Subject: [PATCH 2/3] fix: SOPS-encrypt waitlist secrets with age key MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - DB password: random 48-char hex string - admin_api_key: random 32-char hex string - Telegram bot_token/chat_id still CHANGEME — fill before deploying --- .../waitlist-db-credentials.yaml | 20 +++++++++++++++-- .../waitlist-telegram-secret.yaml | 22 ++++++++++++++++--- 2 files changed, 37 insertions(+), 5 deletions(-) diff --git a/apps/base/customer1/siriusdevops-db/waitlist-db-credentials.yaml b/apps/base/customer1/siriusdevops-db/waitlist-db-credentials.yaml index ab6f997..f9cc11d 100644 --- a/apps/base/customer1/siriusdevops-db/waitlist-db-credentials.yaml +++ b/apps/base/customer1/siriusdevops-db/waitlist-db-credentials.yaml @@ -5,9 +5,25 @@ metadata: namespace: customer1 type: Opaque stringData: - username: waitlist - password: CHANGEME + username: ENC[AES256_GCM,data:Gla9qDWPnL4=,iv:fOFJEBrZ2C6UChUhIKbG3pcO0Zkiv0WGybWoW+5UOXU=,tag:5QulFOKmUb8g89Ssv/4pKg==,type:str] + password: ENC[AES256_GCM,data:fMajWmKxkD2ezhLfSvnGG3lMabgVSHCCr9ORtVnj7apfW9L3+xaVI3b0sYJD4vP7,iv:6qs2FTP7GuNCFB2YyK77MDtYLrcC+WuiWpo6NmTH7EE=,tag:ppcc4+aBDJL0akE02Q5n7g==,type:str] sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] age: - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOdVJZT2twOHFDRHgzaWVm + WWcxODRhSG5jSTNITnZsRHR1dnB6NVpqMFN3CkxUMElMcEN4dEdrZXQ4Z1dkMk9G + ZWYrTGFkMHhrb3UrUWJYRTlzc0xiS0EKLS0tICtLNC9qZk5VSnE3K3NtUGx6USsv + a3hXaG1rYlI5ampRSlFXWktTSzhtem8KVRHAel5jBPiMMDT7bYboorkryiuvdjOL + +uD/aMZT04vyeG9i1d4peeab/NP8jmnxWKJOftGKN3PIqPYrZ6OHCQ== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-05-15T01:35:29Z" + mac: ENC[AES256_GCM,data:s3/3/oKVNisc9LVUUzbMPvnaPTR3DJ0pPzYQpxCKkVJ7Cu0GOOsWQBUsgB3wfzLAWSGD2vTYLabzczTRXTkwq5R66ySv1FUOJjAxnZJhwLqcST5+wSzzNczEMbJFBhZepPUNZsMuqkHElQ5f3xZIfo71QITBmrdtg3wEvkHqPrM=,iv:ItkjTFniNlhx3PGoIZUXMtOpBNE5MyqElMFE9rojkOc=,tag:KGW3lD++RvI46lDUTmc7SA==,type:str] + pgp: [] encrypted_regex: ^(data|stringData)$ + version: 3.9.0 diff --git a/apps/base/customer1/waitlist-api/waitlist-telegram-secret.yaml b/apps/base/customer1/waitlist-api/waitlist-telegram-secret.yaml index 7d63e27..6b5d3fc 100644 --- a/apps/base/customer1/waitlist-api/waitlist-telegram-secret.yaml +++ b/apps/base/customer1/waitlist-api/waitlist-telegram-secret.yaml @@ -5,10 +5,26 @@ metadata: namespace: customer1 type: Opaque stringData: - bot_token: CHANGEME - chat_id: CHANGEME - admin_api_key: CHANGEME + bot_token: ENC[AES256_GCM,data:Oc0SMrjZpO0=,iv:7MUe7Ew4Hvmp83AYVhz6yyX431NckEwK2lEfuxqFqKA=,tag:MTIs8XDzxNbHll9MiEdGlw==,type:str] + chat_id: ENC[AES256_GCM,data:TmRBJWB7gHo=,iv:DDEdFefsw4zmhLfGpO8OMI0VR1J81GBatSGnkZMKgDI=,tag:n2gJwD873wMagBFaxv2sxQ==,type:str] + admin_api_key: ENC[AES256_GCM,data:S3VdB11Z37hxz1gIRCODkO36ZdoaifDGx1QmmCKOf8k=,iv:FvoGOdAf6Mzf+riWOx780M6zoGK6ApxX5/0iD+bKi1U=,tag:xNoL74kDhI1Fmu4HGAXC/g==,type:str] sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] age: - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvcUpOeVdGb2JZbjFZT2gx + RVgya2lKQitaM0RoYnNQU1JtWlQxR3F1c3dFCmVnWlFTOE5SVTVKWnZSdlUrdDhN + NVo5MzdMMUdlb0JRZEFBajgyem5QM3cKLS0tICtDQXNpc2U4eUJ2SENZNHB5WWYx + UFlpVS9kU3lGVzJCT2w3M09POE8vK2MKy9hUP+R7LyguASYwszy7emzoETUfn3EG + qdppIQNIF0r6We6khq2IMkRM1ubPKKoMUYXjLtNyfuteuV7YcsTbmw== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-05-15T01:35:29Z" + mac: ENC[AES256_GCM,data:7CuKClWk42TxcCVHWn3tAUAqefEbAtF9eGp59WPwBlMWsQwwL37CavCnofq2bF3G+k1ZrvaHwwdIe5kacQmD+cx3p97+Df5FImQcuu+nnzYQH9GnpoqrBIC6UC4LTbD7se/vGNCK7P8lMLumbRy2/GCiEttCYNhneF0AQiHQIzs=,iv:G/3Ejb0aMMJgyybcLGLEdPLsRzYxnPL1acDBLogfWxM=,tag:OFSyTwoVlkP3s2tc3F9uZg==,type:str] + pgp: [] encrypted_regex: ^(data|stringData)$ + version: 3.9.0 From 334be3778198bb0f9d2c79d2337f4fe8f5a61bd7 Mon Sep 17 00:00:00 2001 From: Sirius Devops Date: Fri, 15 May 2026 02:10:47 +0000 Subject: [PATCH 3/3] fix: add real Telegram bot_token and chat_id --- .../waitlist-telegram-secret.yaml | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/apps/base/customer1/waitlist-api/waitlist-telegram-secret.yaml b/apps/base/customer1/waitlist-api/waitlist-telegram-secret.yaml index 6b5d3fc..a5f7f9b 100644 --- a/apps/base/customer1/waitlist-api/waitlist-telegram-secret.yaml +++ b/apps/base/customer1/waitlist-api/waitlist-telegram-secret.yaml @@ -5,9 +5,9 @@ metadata: namespace: customer1 type: Opaque stringData: - bot_token: ENC[AES256_GCM,data:Oc0SMrjZpO0=,iv:7MUe7Ew4Hvmp83AYVhz6yyX431NckEwK2lEfuxqFqKA=,tag:MTIs8XDzxNbHll9MiEdGlw==,type:str] - chat_id: ENC[AES256_GCM,data:TmRBJWB7gHo=,iv:DDEdFefsw4zmhLfGpO8OMI0VR1J81GBatSGnkZMKgDI=,tag:n2gJwD873wMagBFaxv2sxQ==,type:str] - admin_api_key: ENC[AES256_GCM,data:S3VdB11Z37hxz1gIRCODkO36ZdoaifDGx1QmmCKOf8k=,iv:FvoGOdAf6Mzf+riWOx780M6zoGK6ApxX5/0iD+bKi1U=,tag:xNoL74kDhI1Fmu4HGAXC/g==,type:str] + bot_token: ENC[AES256_GCM,data:LKtH09TKaOwlmZ6MplFC3PIltAnuc3peljdpQ+dv1FFYEETrM5ktC6kgSVEZYg==,iv:6SO9vYXrPgWWHD7JOBMv185VbrlhVy8J4bOujqFg2kk=,tag:wlIQPf/CpwQa67Q4rhgLWw==,type:str] + chat_id: ENC[AES256_GCM,data:/PDKXjKoOT/3TQ==,iv:cABt0cLh7P1aRZ2xvCiEQSGbsh+Er7GGLpIcomTysk4=,tag:fBIvsK59wJjXyyjcOWBu5A==,type:str] + admin_api_key: ENC[AES256_GCM,data:CJX1+BDOxhAZIF8ZZ/guENjM6RL2IQh8jKjRPF+QdzU=,iv:kngkGX6K8ePmrU2+Awsrg5OuPvsasMFmAwoTT0gW+Yk=,tag:cbDVxecQKWuy+tQKhrEnNQ==,type:str] sops: kms: [] gcp_kms: [] @@ -17,14 +17,14 @@ sops: - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7 enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvcUpOeVdGb2JZbjFZT2gx - RVgya2lKQitaM0RoYnNQU1JtWlQxR3F1c3dFCmVnWlFTOE5SVTVKWnZSdlUrdDhN - NVo5MzdMMUdlb0JRZEFBajgyem5QM3cKLS0tICtDQXNpc2U4eUJ2SENZNHB5WWYx - UFlpVS9kU3lGVzJCT2w3M09POE8vK2MKy9hUP+R7LyguASYwszy7emzoETUfn3EG - qdppIQNIF0r6We6khq2IMkRM1ubPKKoMUYXjLtNyfuteuV7YcsTbmw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5dGNjV2xvMTZ6eWVNUk9w + M04xVDBrYjFkSTFGem9pT2VKbGR2L0tRM1hjClFlcWJQU3hjZ0EwNzRoMXNXYkVI + RlNWT29oQ2dOaDZPaFVTNVFrQWpHYkkKLS0tIHQ0R2gwdVUyN3lXRlBlVWd6WEZV + NkoybXJYMkVJcWFuay9ycE1Tc2dpOFUKZzTATUeC53NTK8eXunGdpeKeQnXLTb5E + C2VoGFnmqyJMnH/cN8Q6zrSmFqyt2LX6H1z26StHwF6Rgs+MlCdiVQ== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-05-15T01:35:29Z" - mac: ENC[AES256_GCM,data:7CuKClWk42TxcCVHWn3tAUAqefEbAtF9eGp59WPwBlMWsQwwL37CavCnofq2bF3G+k1ZrvaHwwdIe5kacQmD+cx3p97+Df5FImQcuu+nnzYQH9GnpoqrBIC6UC4LTbD7se/vGNCK7P8lMLumbRy2/GCiEttCYNhneF0AQiHQIzs=,iv:G/3Ejb0aMMJgyybcLGLEdPLsRzYxnPL1acDBLogfWxM=,tag:OFSyTwoVlkP3s2tc3F9uZg==,type:str] + lastmodified: "2026-05-15T02:10:31Z" + mac: ENC[AES256_GCM,data:OAq/3HdIF2aPo0RqjjMKmeZPeE16S4CiaoVEJAQVqOfQFp4XDW0j50iKNwfDrXate4X1bv+g0qYLPyXq6ZoZuExsYuUuUskZevWDNqcyNcQ0joe5WntCqgy14Q8/WP9gKighG/UVTojxMcMn6afEjnXcN7XaWk/p1Atmys3eVNo=,iv:U61p5bALcibbfI99yayRTKZ+/HZ+HCaJztWVGGq08Ww=,tag:5MPfVnsDDTFNo3OZuvGvMw==,type:str] pgp: [] encrypted_regex: ^(data|stringData)$ version: 3.9.0