refactor: retire Terraform, migrate to pure ArgoCD GitOps + CI validation

2026-08-18 15:08:01 -07:00
parent adbad3d97e
commit 563f720d09
47 changed files with 1987 additions and 4115 deletions
@@ -0,0 +1,119 @@
+name: Security Scan
+
+on:
+  push:
+    branches:
+      - main
+      - develop
+    paths:
+      - 'k8s/**'
+  pull_request:
+    paths:
+      - 'k8s/**'
+
+jobs:
+  security:
+    runs-on: docker
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Tools
+        run: |
+          apt-get update && apt-get install -y \
+            python3-pip \
+            curl
+
+          # Install Trivy (vulnerability scanner)
+          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+
+          # Install Polaris (K8s security audit)
+          curl -L https://github.com/FairwindsOps/polaris/releases/latest/download/polaris-linux-amd64 -o /usr/local/bin/polaris
+          chmod +x /usr/local/bin/polaris
+
+      - name: Trivy - Scan Dockerfile (if present)
+        run: |
+          if find . -name "Dockerfile" 2>/dev/null | grep -v node_modules | head -1 | grep -q .; then
+            echo "=== Scanning Dockerfiles with Trivy ==="
+            find . -name "Dockerfile" -not -path "*/node_modules/*" -exec trivy config {} \;
+          else
+            echo "No Dockerfiles found"
+          fi
+
+      - name: Trivy - Scan Helm Charts
+        run: |
+          if find k8s -name "Chart.yaml" 2>/dev/null | head -1 | grep -q .; then
+            echo "=== Scanning Helm charts with Trivy ==="
+            find k8s -name "Chart.yaml" -exec dirname {} \; | while read chart; do
+              echo "Scanning $chart..."
+              trivy config "$chart" || true
+            done
+          else
+            echo "No Helm charts found"
+          fi
+
+      - name: Polaris - K8s Security Audit
+        run: |
+          echo "=== Running Polaris K8s security audit ==="
+          polaris audit --audit-path /tmp/polaris-audit.json k8s/ || true
+
+          if [ -f /tmp/polaris-audit.json ]; then
+            echo "Security issues found:"
+            jq '.results[] | select(.pass == false)' /tmp/polaris-audit.json || true
+          fi
+
+      - name: Check for Secrets in Code
+        run: |
+          echo "=== Scanning for hardcoded secrets ==="
+          SECRETS_FOUND=0
+
+          # Check for common secret patterns
+          for pattern in "password:" "secret:" "token:" "api_key:" "apikey:" "private_key:" "privatekey:"; do
+            if grep -r "$pattern" k8s/ --include="*.yaml" --include="*.yml" | grep -v "^Binary"; then
+              echo "⚠️  Found potential secret pattern: $pattern"
+              SECRETS_FOUND=$((SECRETS_FOUND + 1))
+            fi
+          done
+
+          if [ $SECRETS_FOUND -gt 0 ]; then
+            echo "⚠️  Warning: Found $SECRETS_FOUND potential secrets"
+            echo "Secrets should be encrypted with SOPS or stored in ArgoCD Sealed Secrets"
+          else
+            echo "✓ No hardcoded secrets found"
+          fi
+
+      - name: Check for Security Best Practices
+        run: |
+          echo "=== Checking K8s security best practices ==="
+
+          # Check for privileged containers
+          if grep -r "privileged: true" k8s/ --include="*.yaml" --include="*.yml"; then
+            echo "⚠️  Found privileged containers"
+          fi
+
+          # Check for hostNetwork
+          if grep -r "hostNetwork: true" k8s/ --include="*.yaml" --include="*.yml"; then
+            echo "⚠️  Found hostNetwork usage"
+          fi
+
+          # Check for missing resource limits
+          echo "Checking for missing resource requests/limits..."
+          MISSING=0
+          find k8s -name "*.yaml" -o -name "*.yml" | while read file; do
+            if grep -q "kind: Deployment\|kind: StatefulSet\|kind: DaemonSet" "$file"; then
+              if ! grep -q "resources:" "$file"; then
+                echo "⚠️  $file: Missing resource requests/limits"
+                MISSING=$((MISSING + 1))
+              fi
+            fi
+          done
+
+      - name: Summary
+        if: always()
+        run: |
+          echo "=== Security Scan Summary ==="
+          echo "✓ Dockerfiles scanned"
+          echo "✓ Helm charts scanned"
+          echo "✓ K8s manifests audited"
+          echo "✓ Secrets check completed"
+          echo "✓ Best practices verified"