Security: Harden GitOps infrastructure#2
Conversation
- Remove ArgoCD --insecure flag, enable TLS certificate generation - Add public_access_cidrs to EKS cluster (default: 10.0.0.0/8) - Restrict ArgoCD project destinations to specific namespaces - Remove untrusted helm chart repo from sourceRepos - Pin GitHub Actions to SHA hashes (checkout@v4, setup-terraform@v3.1.2) - Change tfsec soft_fail from true to false Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Security hardening for the GitOps + Terraform stack by tightening EKS API exposure, improving ArgoCD TLS settings, restricting ArgoCD project scope, and strengthening CI security checks.
Changes:
- Add configurable
public_access_cidrsfor the EKS public API endpoint. - Remove ArgoCD
--insecureusage and set Helm values to run with TLS (server.insecure=false). - Tighten ArgoCD AppProject repo/destination allow-lists, pin some GitHub Actions to SHAs, and make tfsec fail the build.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| terraform/modules/eks/variables.tf | Introduces public_access_cidrs input (with a restrictive default). |
| terraform/modules/eks/main.tf | Applies public_access_cidrs to the EKS cluster vpc_config. |
| terraform/modules/argocd/main.tf | Removes --insecure and enables TLS-related Helm settings. |
| argocd/projects/default-project.yaml | Restricts allowed source repos and destination namespaces for the default AppProject. |
| .github/workflows/ci.yaml | Pins some actions to SHAs and makes tfsec non-soft-fail. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - namespace: 'default' | ||
| server: https://kubernetes.default.svc | ||
| - namespace: 'kube-system' | ||
| server: https://kubernetes.default.svc |
There was a problem hiding this comment.
default AppProject destinations are now limited to argocd, default, and kube-system, but existing ArgoCD Applications/ApplicationSets in this repo deploy into sample-app and sample-app-{dev,staging,production} namespaces. With this change those apps will be rejected as unauthorized destinations. Add the required destination namespaces (or adjust the apps/project strategy) so current manifests continue to sync.
| server: https://kubernetes.default.svc | |
| server: https://kubernetes.default.svc | |
| - namespace: 'sample-app' | |
| server: https://kubernetes.default.svc | |
| - namespace: 'sample-app-dev' | |
| server: https://kubernetes.default.svc | |
| - namespace: 'sample-app-staging' | |
| server: https://kubernetes.default.svc | |
| - namespace: 'sample-app-production' | |
| server: https://kubernetes.default.svc |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 | ||
| - uses: hashicorp/setup-terraform@b9cd54a3c349d3f85571c5fb643da9750e94b949 # v3.1.2 | ||
| with: |
There was a problem hiding this comment.
PR description says GitHub Actions are pinned to SHA hashes, but this workflow still uses version tags for aquasecurity/tfsec-action, azure/setup-helm, and ibiqlik/action-yamllint. Either pin those actions to commit SHAs as well, or update the PR description so expectations match the actual hardening applied.
| variable "public_access_cidrs" { | ||
| description = "List of CIDR blocks that can access the EKS public API endpoint" | ||
| type = list(string) | ||
| default = ["10.0.0.0/8"] |
There was a problem hiding this comment.
Setting public_access_cidrs default to ["10.0.0.0/8"] changes the module's out-of-the-box behavior (and the dev environment doesn’t pass this variable), which can easily lock out kubectl/Terraform access to the public endpoint from typical operator/CI IPs. Consider keeping the module default aligned with AWS’s default behavior (or explicitly disabling public access by default) and pushing the hardened CIDR list down from the environment layer so it’s an intentional, visible choice per environment.
| default = ["10.0.0.0/8"] | |
| default = ["0.0.0.0/0"] |
…#2) - Remove ArgoCD --insecure flag, enable TLS certificate generation - Add public_access_cidrs to EKS cluster (default: 10.0.0.0/8) - Restrict ArgoCD project destinations to specific namespaces - Remove untrusted helm chart repo from sourceRepos - Pin GitHub Actions to SHA hashes (checkout@v4, setup-terraform@v3.1.2) - Change tfsec soft_fail from true to false
Summary
Test plan