Admin Bot
2d55830412
CI / CI (pull_request) Successful in 3m7s
Security improvements: - Fix gateway→authentik port from 80 to 9000 (matches NetworkPolicy) - Encrypt gateway ConfigMap (contains internal cluster DNS names) - Encrypt gateway-config-secret with SOPS using AGE encryption - Add .sops.yaml configuration for future secret management Files encrypted with AGE key: - k8s/configmap.yaml (ConfigMap → encrypted) - k8s/gateway-config-secret.enc.yaml (Secret → encrypted) Internal infrastructure details now protected: ✓ Service DNS names (.svc.cluster.local) ✓ Upstream URLs ✓ Auth endpoints ✓ Port configurations Fixes JWT validation failures and 401 errors on LLM requests. Reduces attack surface by protecting infrastructure topology.
5 lines
233 B
YAML
5 lines
233 B
YAML
creation_rules:
|
|
# Encrypt secrets, configs, and deployment files with infrastructure details
|
|
- path_regex: k8s/(.*secret.*|.*config.*|.*deployment.*\.ya?ml)
|
|
age: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
|