organize deployment configuration

deployments/argocd/README.md

@@ -0,0 +1,41 @@
+# ArgoCD GitOps bootstrap
+
+ArgoCD is installed once into the local cluster; everything after that is
+declared through the root Application. The root uses the app-of-apps pattern:
+it watches `deployments/argocd/apps/`, and each child Application owns one platform or
+workload boundary.
+
+## Bootstrap
+
+1. Push this repository to the configured Git server and use the repository URL
+   in the Application manifests.
+2. Create the local cluster from `local-quickstart/`.
+3. Run:
+
+```bash
+kubectl create namespace argocd --dry-run=client -o yaml | kubectl apply -f -
+kubectl apply --server-side --force-conflicts -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
+kubectl -n argocd rollout status deployment/argocd-server --timeout=180s
+kubectl apply -f deployments/argocd/app-of-apps.yaml
+kubectl get applications -n argocd -w
+```
+
+The first command is idempotent. The official install manifest is fetched at
+bootstrap time rather than vendored into this repository, keeping the repo
+reviewable and making the ArgoCD version choice visible in the command.
+
+For local UI access:
+
+```bash
+kubectl -n argocd port-forward svc/argocd-server 8081:443
+kubectl -n argocd get secret argocd-initial-admin-secret \
+  -o jsonpath='{.data.password}' | base64 -d; echo
+```
+
+The initial admin secret is for local bootstrap only. A later hardening phase
+should replace this with SSO/RBAC and remove the bootstrap credential.
+
+For a kube-proxy-free Cilium cluster, install Cilium before ArgoCD using the
+profile in `local-quickstart/cilium.md` or the Flatcar cloud bootstrap. The
+Cilium Application is stored under `deployments/argocd/optional-apps/` and is not watched
+by the default root app until the cluster is ready for it.

deployments/argocd/app-of-apps.yaml

@@ -0,0 +1,23 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: security-baseline-root
+  namespace: argocd
+  labels:
+    app.kubernetes.io/part-of: kubernetes-security-baseline
+spec:
+  project: default
+  source:
+    # Replace the owner after publishing this repository.
+    repoURL: https://git.swaphb.com/swaphb/kubernetes-security-baseline-lab.git
+    targetRevision: main
+    path: deployments/argocd/apps
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

deployments/argocd/apps/falco.yaml

@@ -0,0 +1,33 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: falco
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+spec:
+  project: default
+  sources:
+    - repoURL: https://falcosecurity.github.io/charts
+      chart: falco-operator
+      # Operator chart 0.3.1 deploys Falco Operator 0.4.1.
+      targetRevision: 0.3.1
+      helm:
+        valueFiles:
+          - $values/deployments/falco/falco-operator-values.yaml
+    - repoURL: https://git.swaphb.com/swaphb/kubernetes-security-baseline-lab.git
+      targetRevision: main
+      ref: values
+    - repoURL: https://git.swaphb.com/swaphb/kubernetes-security-baseline-lab.git
+      targetRevision: main
+      path: deployments/falco/operator-resources
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: falco-operator
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

deployments/argocd/apps/kyverno.yaml

@@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: kyverno
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "-2"
+spec:
+  project: default
+  source:
+    repoURL: https://kyverno.github.io/kyverno/
+    chart: kyverno
+    targetRevision: 3.8.2
+    helm:
+      values: |
+        crds:
+          annotations:
+            # The two policy CRDs exceed client-side apply's annotation limit.
+            argocd.argoproj.io/sync-options: ServerSideApply=true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: kyverno
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

deployments/argocd/apps/policies.yaml

@@ -0,0 +1,23 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: security-policies
+  namespace: argocd
+  annotations:
+    # Policies wait for Kyverno's CRDs/controller to exist.
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  project: default
+  source:
+    repoURL: https://git.swaphb.com/swaphb/kubernetes-security-baseline-lab.git
+    targetRevision: main
+    path: policies/kyverno
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: security-baseline
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

deployments/argocd/apps/test-workloads.yaml

@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: security-test-workloads
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  project: default
+  source:
+    repoURL: https://git.swaphb.com/swaphb/kubernetes-security-baseline-lab.git
+    targetRevision: main
+    path: test-workloads
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: security-baseline
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      # Test Pods are intentionally disposable and their command fields are immutable.
+      - Replace=true

deployments/argocd/optional-apps/cilium.yaml

@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cilium
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "-4"
+spec:
+  project: default
+  sources:
+    - repoURL: https://helm.cilium.io/
+      chart: cilium
+      targetRevision: 1.20.0
+      helm:
+        valueFiles:
+          - $values/deployments/cilium/cilium-values.yaml
+    - repoURL: https://git.swaphb.com/swaphb/kubernetes-security-baseline-lab.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: kube-system
+  # Apply this Application manually only after bootstrapping a kube-proxy-free
+  # cluster and replacing the API endpoint placeholder.