Skip to main content

Security Overview

This slice covers the active security control-plane applications declared under lumie-infra/security/**. These workloads provide operator access, admission policy, and runtime detection. They are managed as a separate ArgoCD app-of-apps from the application layer under lumie-infra/applications/**.

Scope and ownership​

Source paths​

PathRole
lumie-infra/security/application.yamlArgoCD app-of-apps entrypoint for the security slice
lumie-infra/security/kustomization.yamlEnumerates the security applications
lumie-infra/security/teleport/**Access plane and Teleport app proxying
lumie-infra/security/kyverno/**Admission policies and mutate guardrails
lumie-infra/security/falco/**Runtime threat detection

Boundaries​

  • This slice owns the security applications only; Vault and cert-manager are called out in security/kustomization.yaml as moved elsewhere.
  • External Secrets is no longer part of this slice; the repo uses Vault Secrets Operator instead.
  • Teleport app access is part of the security slice even when it exposes tools documented under Operations Applications or other platform areas.

Runtime map​

Security roles in the platform​

  • Teleport is the operator access plane for browser apps and Kubernetes access.
  • Kyverno applies admission-time mutation and audit-mode validation policies.
  • Falco detects node and container runtime behavior and forwards events to Loki.

Common operational patterns​

  • Every security Application enables automated sync, pruning, and self-healing.
  • Some historical namespace metadata still carries Goldilocks labels, but Goldilocks and VPA are no longer deployed.
  • Several components rely on external upstream charts, with Lumie-specific contracts expressed only in local values and manifest overlays.
  • The most important cross-slice dependencies are Vault Static Secrets, the shared infra-db cluster, and Teleport access paths declared for non-security apps.

Common failure modes​

  • The ArgoCD app stays healthy while a cross-slice dependency is broken, such as a missing Vault secret or bad database credential.
  • Upstream chart upgrades can change security defaults or generated object names without a visible diff in local manifests.
  • Some security controls are intentionally audit-only, so policy violations remain possible even when the control plane is healthy.
  • Some disabled app folders remain in the repository as historical artifacts; security/kustomization.yaml is the source of truth for what is deployed.

Verification​

kubectl get applications.argoproj.io -n argocd teleport teleport-agent kyverno falco
kubectl get pods -n teleport
kubectl get pods -n kyverno
kubectl get pods -n falco

Pages in this slice​