From d7587ed2a4ae95da40ffde50b7ce98cf2e05e362 Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Sat, 4 Apr 2026 23:32:22 +0200 Subject: [PATCH] fix: Use SealedSecrets for CrowdSec bouncer API key Replace hardcoded bouncer key with SealedSecrets in both crowdsec and ingress namespaces. CrowdSec LAPI pre-registers the bouncer via BOUNCER_KEY_ingress env var, ingress-nginx reads the same key from its namespace's secret. Co-Authored-By: Claude Opus 4.6 (1M context) --- kubernetes/apps/crowdsec/bouncer-secret.yaml | 15 +++++++++++++++ kubernetes/apps/crowdsec/helmrelease.yaml | 10 +++++----- kubernetes/apps/crowdsec/kustomization.yaml | 1 + .../ingress-nginx/bouncer-secret.yaml | 15 +++++++++++++++ .../infrastructure/ingress-nginx/helmrelease.yaml | 5 ++++- .../ingress-nginx/kustomization.yaml | 1 + 6 files changed, 41 insertions(+), 6 deletions(-) create mode 100644 kubernetes/apps/crowdsec/bouncer-secret.yaml create mode 100644 kubernetes/infrastructure/ingress-nginx/bouncer-secret.yaml diff --git a/kubernetes/apps/crowdsec/bouncer-secret.yaml b/kubernetes/apps/crowdsec/bouncer-secret.yaml new file mode 100644 index 00000000..b65c79e3 --- /dev/null +++ b/kubernetes/apps/crowdsec/bouncer-secret.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + creationTimestamp: null + name: crowdsec-bouncer-key + namespace: crowdsec +spec: + encryptedData: + key: AgAXOKwAYFUYaOWatROeEt8Kw8fTUbHibipBy9/nAFJW8N3yWYQNNmNeA2y7X+UUWPSJhrbtlSKE0r0THsI0vAG5R3hrToO5qoaRL2XaG9/38HQZrngRTIOKeZVIo3maUNeiz/sEjmgbguFNqpWpp/tKRu5XMmRka80bcjXyb+NGsPpIPfQaJmILqEST/cI0pB3vr8rLeblGoJr6sGiG8Mwh0XUr6L9flXRIFEvlepWzzViwixiP9bcGjarO4BxwCgMN2FjWM0uuLSnzVweJzx4js1SuiQ/+mG3CDOhxj97SjD3tkTCEebp34bhKezLpMcCmliuTAch6MvDJ6B1dlsE/YByDTrelz+TOnmD4dLjjoHTAqTs0IDqWmye3GKIAn1O21wz2L7OQq0IJkPuBiDZArHeBoTq0zkEBL7v8vRW/smp1hSxYrz8LJieVB2DmaIpep6P6o+t8YiPMFHfnYMpm5A6/SejDdE4X0y35kVsRiS/FAuIv+CZiuhp6ZLSUxSyToXKezGXmq5pb4jBwFNm4BOjTI2IkDS+1elzYVF/zvp2q+uH4V9+/iNwAZWl/ad8/ZXtcTUFo31ib5XDagLu0MQWaKtmAL06LSJSjZSQJfh8qxu8M0ClRx3ylbS9p2n48wZX/az56H51gojmqxwO5cBYa8VYGEzgaJ17LDW02fbzGqBK1nvI5UIWXxlt+vf6y1RTuKDGmsKapdQA2nApVjLNxhmuAvcxCpnY1l3j3tvwRPzCrz81OMrf3hg== + template: + metadata: + creationTimestamp: null + name: crowdsec-bouncer-key + namespace: crowdsec diff --git a/kubernetes/apps/crowdsec/helmrelease.yaml b/kubernetes/apps/crowdsec/helmrelease.yaml index c8d8fb9d..812ed7a4 100644 --- a/kubernetes/apps/crowdsec/helmrelease.yaml +++ b/kubernetes/apps/crowdsec/helmrelease.yaml @@ -43,19 +43,19 @@ spec: storageClassName: ceph-block size: 100Mi env: - - name: ENROLL_KEY - value: "" - name: ENROLL_INSTANCE_NAME value: "k8s-homelab" + - name: BOUNCER_KEY_ingress + valueFrom: + secretKeyRef: + name: crowdsec-bouncer-key + key: key agent: acquisition: - namespace: ingress podName: ingress-nginx-controller-* program: nginx - - namespace: apps - podName: "*" - program: nginx env: - name: COLLECTIONS value: "crowdsecurity/nginx crowdsecurity/http-cve crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules" diff --git a/kubernetes/apps/crowdsec/kustomization.yaml b/kubernetes/apps/crowdsec/kustomization.yaml index 4fd939d4..34fdd033 100644 --- a/kubernetes/apps/crowdsec/kustomization.yaml +++ b/kubernetes/apps/crowdsec/kustomization.yaml @@ -1,4 +1,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: + - bouncer-secret.yaml - helmrelease.yaml diff --git a/kubernetes/infrastructure/ingress-nginx/bouncer-secret.yaml b/kubernetes/infrastructure/ingress-nginx/bouncer-secret.yaml new file mode 100644 index 00000000..dea612bc --- /dev/null +++ b/kubernetes/infrastructure/ingress-nginx/bouncer-secret.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + creationTimestamp: null + name: crowdsec-bouncer-key + namespace: ingress +spec: + encryptedData: + key: AgCjzQ1q7CUPl48Q/ypEBdpG8aEKHqnkc1rC9eWBxIRi82BaYFPTLmADgItjE2iPxLO8j5NzCr35zO+6IxhcMhD4Bz8KL17fE7UwLfe0wosy/a7g8x7XOCAbW5V6mF6E79i2C+QQ0sVyqIcv4Umz8/vCZHJKJW/muAcU/sLGeT1+Flvw+MkCWegFyfDzgcgyK2k+p7dsJ66uOfZA9CKwBC49PhSAeM1UdTT+OhpI11bw9VhPlG6Qdx9Tf/717nkXHEjZH95LyWXgdL+UOywdYvUp1bHBBqgkR5j1kaOi19TzUK3odN50FPQpHKJmOjC5tVLSWPLlQ58csn3KmHARPuAj234iolZoLcnA7BNlYK6KXpPYygRwfahUx0jx2jdnBvt2LNvl2rQHVKW+CUrhKeIhvPq0SzaCv3yMrMe0SvmT+3KMFwKzOdoxVjQYy0gGSp6TqK0qeqAQwWftrMCS2syEOehJAbmLYWdj6Guj7QccBnXY98YIL7EU+CCD0KWdsySYfOlXostRTObD4D0U0IVo6zKx70X+JyANNaNoW3mvg7PktA45ZdqjY3FeHRaBlc5ioPiNrZY40cgoBlETo9gI9Mw61D/agvIx9fL3nUfNh+GBenpMkYlXDWZvRfRTLGd5hsawFgyFrD0p1yg+gAmWtRPUZr0wKDP7v4dj7Ali/a+DTjqWY26aBm5OPe3VreONqUvNb2CC1phukDId3whOKx4bw7PDOir+Lb73nvc2xSw9djaiSGeDCV7hlQ== + template: + metadata: + creationTimestamp: null + name: crowdsec-bouncer-key + namespace: ingress diff --git a/kubernetes/infrastructure/ingress-nginx/helmrelease.yaml b/kubernetes/infrastructure/ingress-nginx/helmrelease.yaml index 1365fad1..863b8830 100644 --- a/kubernetes/infrastructure/ingress-nginx/helmrelease.yaml +++ b/kubernetes/infrastructure/ingress-nginx/helmrelease.yaml @@ -57,7 +57,10 @@ spec: - name: API_URL value: "http://crowdsec-service.crowdsec.svc.cluster.local:8080" - name: API_KEY - value: "bbIE6wveGukLm+o9c2Tee9fx1+R6GHXyRxv7Se1xwtw" + valueFrom: + secretKeyRef: + name: crowdsec-bouncer-key + key: key - name: BOUNCER_CONFIG value: "/crowdsec/crowdsec-bouncer.conf" volumeMounts: diff --git a/kubernetes/infrastructure/ingress-nginx/kustomization.yaml b/kubernetes/infrastructure/ingress-nginx/kustomization.yaml index d405e370..666fd858 100644 --- a/kubernetes/infrastructure/ingress-nginx/kustomization.yaml +++ b/kubernetes/infrastructure/ingress-nginx/kustomization.yaml @@ -2,4 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: ingress resources: + - bouncer-secret.yaml - helmrelease.yaml