From f063666137d1bd053ad7d468b26a9212025f6fc2 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Fri, 23 Oct 2026 15:50:00 +0200 Subject: [PATCH 1/3] feat(observability): activate security progress dashboards in Coroot --- docs/coroot-security-progress.md | 9 +++++---- k8s/providers/hetzner/infrastructure/kustomization.yaml | 3 +++ scripts/validate-eks-ci-role-policy/approved-surface.txt | 4 ++++ 3 files changed, 12 insertions(+), 4 deletions(-) diff --git a/docs/coroot-security-progress.md b/docs/coroot-security-progress.md index b101a83354..dbbbf57284 100644 --- a/docs/coroot-security-progress.md +++ b/docs/coroot-security-progress.md @@ -70,10 +70,11 @@ metrics and route are preserved by this component. ## Deployment and maintenance -The component is **off by default**: no normal overlay references it. After its validation -and review, a separate activation adds -`../../../bases/infrastructure/coroot/components/security-progress` to the production -infrastructure overlay's `components`. Use the protected merge/deploy path. The +The shared base leaves this component **off by default**. The production infrastructure +overlay explicitly enables +`../../../bases/infrastructure/coroot/components/security-progress` in its `components`. +To disable collection and reconciliation, remove that production component reference +through the protected merge/deploy path. The collector needs only the explicitly listed read-only resources; only its container receives a projected service-account token. Exec probes check publication freshness, project binding and the two local services. Reporting a failed security source still diff --git a/k8s/providers/hetzner/infrastructure/kustomization.yaml b/k8s/providers/hetzner/infrastructure/kustomization.yaml index 5cbb6043d0..86edf56773 100644 --- a/k8s/providers/hetzner/infrastructure/kustomization.yaml +++ b/k8s/providers/hetzner/infrastructure/kustomization.yaml @@ -204,6 +204,9 @@ components: # shared Coroot base because Crossplane exists only on this provider. The # adjacent alerter delivers stuck-resource and coverage-gap notifications. - ../../../bases/infrastructure/coroot/components/crossplane-sync-exporter + # Prod-only security progress: collect policy and scan evidence, and reconcile + # the three owned Coroot dashboards. Policy Reporter retains detail workflows. + - ../../../bases/infrastructure/coroot/components/security-progress # Platform-wide HelmRelease drift detection (mode: enabled). See # bases/components/helmrelease-drift-detection. - ../../../bases/components/helmrelease-drift-detection diff --git a/scripts/validate-eks-ci-role-policy/approved-surface.txt b/scripts/validate-eks-ci-role-policy/approved-surface.txt index 1b4e915c12..c17b5e8028 100644 --- a/scripts/validate-eks-ci-role-policy/approved-surface.txt +++ b/scripts/validate-eks-ci-role-policy/approved-surface.txt @@ -162,6 +162,8 @@ rbac.authorization.k8s.io/v1|ClusterRoleBinding||ascoachingogvaner-external-dns rbac.authorization.k8s.io/v1|ClusterRoleBinding||cnpg-degraded-alert 51487655b693fe18c5d7196d0042e4bc8345a15b0ea3afe03216e69d37905940 +rbac.authorization.k8s.io/v1|ClusterRoleBinding||coroot-security-progress f2180564b6200bc35eebe9d814c8cad1d38f5f2fb6323322659a73441ad86aa5 + rbac.authorization.k8s.io/v1|ClusterRoleBinding||crossplane-provider-unhealthy-alert 1cc87f7bfd2b06426b26df11488ceb00e9a22e749bfca05814c1c9a0edc7be9a rbac.authorization.k8s.io/v1|ClusterRoleBinding||crossplane-sync-alerter 2ff039b4399f755bb15112771e2586ac05d68b113313824972720f4a6e156147 @@ -210,6 +212,8 @@ rbac.authorization.k8s.io/v1|ClusterRole||cnpg-degraded-alert 42c958c00b28103b38 rbac.authorization.k8s.io/v1|ClusterRole||cnpg-tenant-edit 942ba69a066888eb7a82444a29f3917aa8c836c0bb800cee159e4e3bda4e3974 +rbac.authorization.k8s.io/v1|ClusterRole||coroot-security-progress eca07a4b13c08811b86ad738681fa9ca315c6d798380c86d6449b74507213832 + rbac.authorization.k8s.io/v1|ClusterRole||crossplane-provider-unhealthy-alert 6a8845e6cd798bea6c9dd0353f5ac34dc93e3f2ccdda4e4d92288705e0dc6a45 rbac.authorization.k8s.io/v1|ClusterRole||crossplane-sync-alerter faf47ab2d737acd58c26bbf7aa3b46f23e5b22fc52aed6acd0fcf7f434fc431f From d04c482daa2e3f0c2cac83dabf695c5051c8d451 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Fri, 23 Oct 2026 15:58:49 +0200 Subject: [PATCH 2/3] fix(observability): review collector alongside the Coroot disruption budget --- docs/coroot-security-progress.md | 5 ++++- scripts/pdb-selector-exceptions.tsv | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/docs/coroot-security-progress.md b/docs/coroot-security-progress.md index dbbbf57284..9b2f46c9c7 100644 --- a/docs/coroot-security-progress.md +++ b/docs/coroot-security-progress.md @@ -74,7 +74,10 @@ The shared base leaves this component **off by default**. The production infrast overlay explicitly enables `../../../bases/infrastructure/coroot/components/security-progress` in its `components`. To disable collection and reconciliation, remove that production component reference -through the protected merge/deploy path. The +through the protected merge/deploy path. In the same change, remove +`Deployment/coroot-security-progress` from the Coroot budget's reviewed-unrelated list +in `scripts/pdb-selector-exceptions.tsv`, since it no longer renders alongside the +operator-managed Coroot server. The collector needs only the explicitly listed read-only resources; only its container receives a projected service-account token. Exec probes check publication freshness, project binding and the two local services. Reporting a failed security source still diff --git a/scripts/pdb-selector-exceptions.tsv b/scripts/pdb-selector-exceptions.tsv index c2542b966b..0cd265fd2e 100644 --- a/scripts/pdb-selector-exceptions.tsv +++ b/scripts/pdb-selector-exceptions.tsv @@ -35,4 +35,4 @@ # satisfies, that its cluster does not render, or for a cluster that is no overlay, fails the # guard, so remove it then. prod kube-system/coredns external:talos file:ksail.prod.yaml:.spec.cluster.talos.version v1.13.11 - Talos installs the CoreDNS Deployment from its own bootstrap manifests, so no layer of the prod cluster renders it. Pod label k8s-app=kube-dns verified in the Talos source, internal/app/machined/pkg/controllers/k8s/internal/k8stemplates/coredns.go. -prod observability/coroot-coroot Coroot/observability/coroot HelmRelease/observability/coroot-operator 0.10.6 Deployment/crossplane-sync-exporter coroot-operator builds the coroot-coroot StatefulSet from this custom resource at runtime; its chart renders only the operator. Pod labels managed-by=coroot-operator, part-of= and component=coroot verified in the coroot-operator source (app version v1.10.6), controller/controller.go Labels and controller/coroot.go. The crossplane-sync-exporter Deployment is this repository's own metrics exporter; it shares only the grouping label part-of=coroot. +prod observability/coroot-coroot Coroot/observability/coroot HelmRelease/observability/coroot-operator 0.10.6 Deployment/coroot-security-progress,Deployment/crossplane-sync-exporter coroot-operator builds the coroot-coroot StatefulSet from this custom resource at runtime; its chart renders only the operator. Pod labels managed-by=coroot-operator, part-of= and component=coroot verified in the coroot-operator source (app version v1.10.6), controller/controller.go Labels and controller/coroot.go. The coroot-security-progress collector and crossplane-sync-exporter are this repository's own separate Deployments; each shares only the grouping label part-of=coroot and lacks the managed-by=coroot-operator and component=coroot labels that this budget requires. From 0b655f020bb1ee28b5ff825e59fc0662c3f4683b Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Fri, 23 Oct 2026 16:31:57 +0200 Subject: [PATCH 3/3] docs(observability): complete security dashboard toggle procedure --- docs/coroot-security-progress.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/docs/coroot-security-progress.md b/docs/coroot-security-progress.md index 9b2f46c9c7..76c7b70c4e 100644 --- a/docs/coroot-security-progress.md +++ b/docs/coroot-security-progress.md @@ -77,7 +77,13 @@ To disable collection and reconciliation, remove that production component refer through the protected merge/deploy path. In the same change, remove `Deployment/coroot-security-progress` from the Coroot budget's reviewed-unrelated list in `scripts/pdb-selector-exceptions.tsv`, since it no longer renders alongside the -operator-managed Coroot server. The +operator-managed Coroot server. Also remove the `ClusterRole/coroot-security-progress` +and `ClusterRoleBinding/coroot-security-progress` entries from +`scripts/validate-eks-ci-role-policy/approved-surface.txt`; the authorization validator +rejects approvals for resources that no longer render. To re-enable the component, +restore its production reference and the reviewed-unrelated entry, then review the +rendered RBAC and restore both matching authorization fingerprints in the same +protected change. Run the deployment validation before either transition. The collector needs only the explicitly listed read-only resources; only its container receives a projected service-account token. Exec probes check publication freshness, project binding and the two local services. Reporting a failed security source still