Erich Blume
35705faca2
## Summary - Deploys MongoDB Kingfisher as a weekly CronJob on minikube-indri - Scans all Forgejo repos (eblume + all orgs) for leaked secrets with live validation - Produces timestamped HTML and JSON reports on sifaka NFS (`/volume1/reports/kingfisher/`) - Forgejo API token sourced from 1Password via ExternalSecret - Uses official `ghcr.io/mongodb/kingfisher:1.91.0` container image - Runs Sunday 4am (after Prowler's 3am k8s scan) ## Resources - CronJob, PV/PVC (sifaka NFS), ExternalSecret - ArgoCD Application with manual sync + CreateNamespace ## Test plan - [x] Sync ArgoCD `apps` app to pick up new kingfisher Application - [x] Set `--revision feature/kingfisher-cronjob` on kingfisher app - [x] Verify ExternalSecret creates the `kingfisher-forgejo-token` Secret - [x] Trigger manual job: `kubectl create job --from=cronjob/kingfisher kingfisher-manual -n kingfisher --context=minikube-indri` - [ ] Verify reports appear on sifaka at `/volume1/reports/kingfisher/` - [ ] After merge: set `--revision main` and re-sync Reviewed-on: #317 |
||
|---|---|---|
| .. | ||
| 1password-connect-ringtail.yaml | ||
| 1password-connect.yaml | ||
| alloy-k8s.yaml | ||
| alloy-ringtail.yaml | ||
| alloy-tracing-ringtail.yaml | ||
| apps.yaml | ||
| argocd.yaml | ||
| authentik.yaml | ||
| blumeops-pg.yaml | ||
| cloudnative-pg.yaml | ||
| cv.yaml | ||
| devpi.yaml | ||
| docs.yaml | ||
| external-secrets-crds-ringtail.yaml | ||
| external-secrets-crds.yaml | ||
| external-secrets-ringtail.yaml | ||
| external-secrets.yaml | ||
| forgejo-runner.yaml | ||
| frigate.yaml | ||
| grafana-config.yaml | ||
| grafana.yaml | ||
| homepage.yaml | ||
| immich-storage.yaml | ||
| immich.yaml | ||
| kingfisher.yaml | ||
| kiwix.yaml | ||
| kube-state-metrics-ringtail.yaml | ||
| kube-state-metrics.yaml | ||
| loki.yaml | ||
| mealie.yaml | ||
| miniflux.yaml | ||
| navidrome.yaml | ||
| ntfy.yaml | ||
| nvidia-device-plugin.yaml | ||
| ollama.yaml | ||
| prometheus.yaml | ||
| prowler.yaml | ||
| tailscale-operator-ringtail.yaml | ||
| tailscale-operator.yaml | ||
| tempo.yaml | ||
| teslamate.yaml | ||
| torrent.yaml | ||
| unpoller.yaml | ||