Confidentialite¶

# Pattern recommande : OIDC token exchange
steps:
  - name: Authenticate to Vault via OIDC
    run: |
      # Le runner obtient un JWT temporaire du serveur Gitea
      JWT="${ACTIONS_ID_TOKEN_REQUEST_TOKEN}"

      # Echange contre un token Vault ephemere
      VAULT_TOKEN=$(vault write -field=token \
        auth/jwt/login role=ci-runner jwt="${JWT}")

      # Le token Vault expire apres le pipeline
      export VAULT_TOKEN

      # Recuperer les secrets necessaires
      DB_PASS=$(vault kv get -field=password secret/ci/database)
      echo "::add-mask::${DB_PASS}"

# Patterns a masquer dans les logs du runner
# config.yaml du act runner
runner:
  env_file: /data/.env
  # Les variables dans .env sont automatiquement masquees dans les logs

# namespace-runners.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: ci-runners
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted

# networkpolicy-runners.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: runner-egress
  namespace: ci-runners
spec:
  podSelector: {}
  policyTypes:
    - Egress
    - Ingress
  ingress: []   # aucun trafic entrant autorise
  egress:
    # Acces au serveur Gitea (SCM)
    - to:
        - namespaceSelector:
            matchLabels:
              name: gitea
      ports:
        - port: 443
          protocol: TCP

    # Acces au registre Harbor
    - to:
        - namespaceSelector:
            matchLabels:
              name: harbor
      ports:
        - port: 443
          protocol: TCP

    # Acces a Vault (secrets)
    - to:
        - namespaceSelector:
            matchLabels:
              name: vault
      ports:
        - port: 8200
          protocol: TCP

    # Acces au miroir de paquets (builds)
    - to:
        - namespaceSelector:
            matchLabels:
              name: mirrors
      ports:
        - port: 443
          protocol: TCP

    # DNS interne
    - to:
        - namespaceSelector: {}
      ports:
        - port: 53
          protocol: UDP
        - port: 53
          protocol: TCP

# pod-security-standard: restricted
# Les runners ne doivent JAMAIS s'executer en mode privilegie
container:
  privileged: false    # dans la config du act runner
  options: |
    --security-opt=no-new-privileges
    --cap-drop=ALL
    --read-only

# Limiter les ressources par runner pour empecher l'epuisement
container:
  options: |
    --memory=4g
    --memory-swap=4g
    --cpus=2
    --pids-limit=256
    --ulimit nofile=1024:1024

# Namespace pour l'equipe backend
apiVersion: v1
kind: Namespace
metadata:
  name: app-backend
  labels:
    toolkit.fluxcd.io/tenant: team-backend
---
# ServiceAccount dedie pour Flux dans ce tenant
apiVersion: v1
kind: ServiceAccount
metadata:
  name: flux-team-backend
  namespace: app-backend
---
# RoleBinding : le ServiceAccount ne peut deployer que dans son namespace
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: flux-team-backend
  namespace: app-backend
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin    # dans le namespace uniquement
subjects:
  - kind: ServiceAccount
    name: flux-team-backend
    namespace: app-backend

# clusters/production/tenants/team-backend.yaml
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: team-backend-apps
  namespace: app-backend
spec:
  interval: 5m
  prune: true
  serviceAccountName: flux-team-backend    # restreint au namespace
  sourceRef:
    kind: GitRepository
    name: team-backend-manifests
    namespace: flux-system
  path: ./overlays/production
  targetNamespace: app-backend

# NetworkPolicy : proteger le namespace flux-system
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: flux-system-deny-all
  namespace: flux-system
spec:
  podSelector: {}
  policyTypes:
    - Ingress
  ingress:
    # Seul le webhook receiver accepte du trafic entrant
    - from:
        - namespaceSelector:
            matchLabels:
              name: ingress-nginx
      ports:
        - port: 9292
          protocol: TCP