k3s Security Lab · kosar.sk

The Security Stack

🛡️

Kyverno

admission control

PSS baseline policy (Audit)
Disallow :latest image tag (Enforce)
Require CPU & memory limits
Disallow privileged containers

👁️

Falco

runtime detection · eBPF

modern_ebpf driver (kernel 6.8+)
Shell spawn in container detection
Unexpected K8s API connections
→ Falcosidekick → Loki

🔍

Trivy Operator

vulnerability scanning

Image CVE scanning (built-in server)
Config audit reports (60+ generated)
RBAC assessment reports
Infra assessment reports

📊

Grafana

+ Loki stack

Falco alert dashboards
7-day log retention

grafana.kosar.sk ↗

📋

Policy Reporter

Kyverno UI

PolicyReport CRD viewer
Pass/fail per policy

kyverno.kosar.sk ↗

🔀

ArgoCD

GitOps engine

App-of-apps pattern
Self-managed via Helm

argocd.kosar.sk ↗

🔒

TLS / Ingress

cert-manager + Traefik

Let's Encrypt production
*.kosar.sk wildcard domains

auto-renewed

GitOps Flow

① GitHub git push main

webhook

② ArgoCD detects diff

sync

③ Helm renders charts

apply

④ K3s cluster state updated ✓

sync-wave order: cert-manager (1) → kyverno (5) → kyverno-policies (10) → trivy (15) → falco + loki + policy-reporter (20)

KubernetesSecurity Lab