security

The security building block provides the cluster’s identity provider integration and its secret management: Keycloak as the single OIDC provider ([CT-005 OpenID Connect only ]), External Secrets Operator and Secrets Store CSI Driver as the bridge to Bitwarden Secrets Manager ([CT-007 Secrets via External Secrets ]), the cert-manager `ClusterIssuer`s used cluster-wide for TLS, and the kubelet CSR approver that auto-approves kubelet serving-certificate rotations.

Applications inside the security building block.
Figure 1. Applications inside the security building block.
Application Chart / Source Namespace Purpose

keycloak

keycloakx 7.2.3 (codecentric.github.io/helm-charts)

keycloak

The organization’s OIDC provider, realm k8s. Runs with 2 replicas behind Traefik at sso.pandur.org, backed by a CloudNativePG-managed PostgreSQL database (secret keycloak-db-app).

external-secret-operator

external-secrets 0.19.2 (charts.external-secrets.io)

credential-store

Reconciles ExternalSecret/ClusterSecretStore CRDs, materializing Bitwarden-held secrets as native Kubernetes `Secret`s.

secrets-store-csi-driver

secrets-store-csi-driver 1.5.3 (kubernetes-sigs.github.io/secrets-store-csi-driver/charts)

kube-system

Mounts Bitwarden-held secrets directly as CSI volumes for workloads that prefer file-based secret consumption over environment variables/Kubernetes `Secret`s.

kubelet-csr-approver

kubelet-csr-approver 1.2.14 (postfinance.github.io/kubelet-csr-approver)

kube-system

Auto-approves kubelet serving CertificateSigningRequest`s for cluster nodes matching `pandur-(control-plane|md--[a-z0-9])-[a-z0-9]+, so kubelets get valid TLS serving certs without manual kubectl certificate approve. Installed once during bootstrap (before Argo CD exists) by create-pandur.sh; the release is then reconciled by this Argo CD Application.

security-resources

raw manifests (pandur/security/resources)

credential-store

The Bitwarden ClusterSecretStore, the letsencrypt-prod ClusterIssuer, the Keycloak bootstrap-admin ExternalSecret, wildcard TLS certificate ExternalSecret`s, and the `oidc-cluster-admin ClusterRoleBinding mapping the Keycloak group oidc:cluster-admin to the built-in cluster-admin ClusterRole.
Naming note

The Argo CD Application file is named credential-store-resources.yml, but its metadata.name is security-resources, and the parent Application manifest is pandur/apps/security.yml. The naming is inconsistent between file and resource name but functionally correct; not changed as part of this documentation update.