From 0fff155f17b1f01cbef39a1db2110c451e27ba49 Mon Sep 17 00:00:00 2001 From: Viktor Barzin Date: Tue, 17 Mar 2026 23:17:47 +0000 Subject: [PATCH] feat(k8s-portal): update onboarding + architecture with SOPS state docs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Onboarding (namespace-owner): - Add steps for sops/terragrunt install, state decrypt, apply workflow - Add flow diagram showing auth → decrypt → apply → encrypt → push - Add architecture overview with security model table - Add access control callout explaining per-stack Transit keys Architecture: - Add secrets & state encryption section with ASCII diagrams - Add request flow diagram (Cloudflare → Traefik → pods) - Add CI/CD pipeline diagram (GHA → Woodpecker → K8s) [ci skip] --- .../src/routes/architecture/+page.svelte | 68 +++++++ .../files/src/routes/onboarding/+page.svelte | 176 ++++++++++++++++-- 2 files changed, 226 insertions(+), 18 deletions(-) diff --git a/stacks/k8s-portal/modules/k8s-portal/files/src/routes/architecture/+page.svelte b/stacks/k8s-portal/modules/k8s-portal/files/src/routes/architecture/+page.svelte index 2790f074..cd1393ab 100644 --- a/stacks/k8s-portal/modules/k8s-portal/files/src/routes/architecture/+page.svelte +++ b/stacks/k8s-portal/modules/k8s-portal/files/src/routes/architecture/+page.svelte @@ -59,6 +59,74 @@ Proxmox (Dell R730) └── ... (70+ more)

Changes go through git: branch → PR → review → merge → CI applies automatically.

+ +
+

Secrets & State Encryption

+

Terraform state is committed to git as SOPS-encrypted JSON. Secrets live in HashiCorp Vault.

+ 
+Authentication & Authorization
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+User → Authentik SSO (OIDC) → Vault Token
+                                  │
+                   ┌──────────────┼──────────────┐
+                   ▼              ▼              ▼
+            KV Secrets    Transit Keys    K8s Creds
+            (per-stack)   (per-stack)    (deployer)
+
+State Encryption Flow
+━━━━━━━━━━━━━━━━━━━━
+.tfstate ──SOPS──▶ .tfstate.enc ──git──▶ repo
+                      │
+              encrypted with:
+              ├── Vault Transit key (per-stack)
+              └── age keys (admin DR fallback)
+
+Access Control
+━━━━━━━━━━━━━━
+Admin:    vault-admin policy  → all transit keys
+User:     sops-user-* policy  → own stack keys only
+Fallback: age key on disk     → admin only (no users)
+
+ +
+

Request Flow

+ 
+Internet → Cloudflare (CDN + WAF)
+              │
+              ▼
+         Cloudflared tunnel
+              │
+              ▼
+         Traefik (3 replicas)
+         ├── CrowdSec bouncer (rate limit, bot block)
+         ├── Authentik forward-auth (SSO for protected apps)
+         └── TLS termination
+              │
+              ▼
+         K8s Service → Pod(s)
+              │
+              ├── NFS volume (app data)
+              └── iSCSI volume (databases)
+
+ +
+

CI/CD Pipeline

+ 
+git push
+   │
+   ├──▶ GitHub Actions (build Docker image, push to DockerHub)
+   │         │
+   │         ▼
+   │    POST Woodpecker API (trigger deploy)
+   │         │
+   │         ▼
+   │    Woodpecker (kubectl set image, Slack notify)
+   │
+   └──▶ Woodpecker (terragrunt apply — infra changes)
+              │
+              ▼
+         Kubernetes API → rolling update
+