diff --git a/kubernetes/main/apps/kyverno/kyverno/policies/flux-verify.yaml b/kubernetes/main/apps/kyverno/kyverno/policies/flux-verify.yaml deleted file mode 100644 index 8a00d45cc..000000000 --- a/kubernetes/main/apps/kyverno/kyverno/policies/flux-verify.yaml +++ /dev/null @@ -1,43 +0,0 @@ ---- -# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kyverno.io/clusterpolicy_v1.json -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: verify-flux-images - annotations: - policies.kyverno.io/title: Verify Flux Images - policies.kyverno.io/category: Flux - policies.kyverno.io/severity: medium - policies.kyverno.io/subject: GitRepository - policies.kyverno.io/description: >- - Ensures that container images used to run Flux controllers in the cluster - are signed with valid Cosign signatures. Prevents the deployment of untrusted - or potentially compromised Flux images. Protects the integrity and security - of the Flux deployment process. -spec: - validationFailureAction: enforce - background: false - webhookTimeoutSeconds: 30 - failurePolicy: Fail - rules: - - name: verify-cosign-signature - match: - any: - - resources: - kinds: - - Pod - verifyImages: - - imageReferences: - - "ghcr.io/fluxcd/source-controller:*" - - "ghcr.io/fluxcd/kustomize-controller:*" - - "ghcr.io/fluxcd/helm-controller:*" - - "ghcr.io/fluxcd/notification-controller:*" - - "ghcr.io/fluxcd/image-reflector-controller:*" - - "ghcr.io/fluxcd/image-automation-controller:*" - attestors: - - entries: - - keyless: - subject: "https://github.com/fluxcd/*" - issuer: "https://token.actions.githubusercontent.com" - rekor: - url: https://rekor.sigstore.dev diff --git a/kubernetes/main/apps/kyverno/kyverno/policies/kustomization.yaml b/kubernetes/main/apps/kyverno/kyverno/policies/kustomization.yaml index e6b678561..b03fe4603 100644 --- a/kubernetes/main/apps/kyverno/kyverno/policies/kustomization.yaml +++ b/kubernetes/main/apps/kyverno/kyverno/policies/kustomization.yaml @@ -4,5 +4,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./dns-config.yaml - - ./flux-verify.yaml - ./hostpath-readonly.yaml diff --git a/kubernetes/main/flux/config/flux.yaml b/kubernetes/main/flux/config/flux.yaml index 79542dcbe..b0694a523 100644 --- a/kubernetes/main/flux/config/flux.yaml +++ b/kubernetes/main/flux/config/flux.yaml @@ -10,7 +10,6 @@ spec: url: oci://ghcr.io/fluxcd/flux-manifests ref: tag: v2.4.0 - digest: sha256:456f82fce9bce6dbfbca1ad9f21a4c6f33ee0a35c846de1fac4a1b9bcdea98a7 --- # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json apiVersion: kustomize.toolkit.fluxcd.io/v1