Kubernetes Operator

1FlowLinkShieldPolicy (CRD) → ShieldOperator → reconciliation loop
2                                      ↓
3AdmissionWebhook (mutating + validating)
4  ├── ValidatingWebhook → deny violations
5  └── MutatingWebhook  → inject ShieldSidecar
6                              ↓
7                     ShieldSidecar (container)
8                     connects to FlowLink Relay

1# Добавить репозиторий
2helm repo add flowlink https://charts.flowlink.ai
3
4# Установить оператор
5helm install flowlink flowlink/flowlink \
6  --set relay.url=https://flowlink.flow-masters.ru \
7  --set operator.watchNamespaces=default,production \
8  --set shield.mode=enforce \
9  --namespace flowlink-system --create-namespace

1# values.yaml — пример конфигурации
2relay:
3  url: "https://flowlink.flow-masters.ru"
4  apiKeySecret: "flowlink-relay-api-key"
5
6operator:
7  watchNamespaces:
8    - default
9    - production
10  logLevel: info
11
12shield:
13  mode: enforce          # monitor | enforce
14  sidecarImage: "flowlink/flowlink-shield:latest"
15  sidecarResources:
16    requests:
17      cpu: 100m
18      memory: 128Mi
19    limits:
20      cpu: 500m
21      memory: 256Mi
22
23webhook:
24  enabled: true
25  injectSelector:
26    matchLabels:
27      flowlink/inject: "true"
28
29rbac:
30  create: true

1apiVersion: flowlink.io/v1alpha1
2kind: FlowLinkAgent
3metadata:
4  name: production-agent
5  namespace: default
6spec:
7  # Подключение к FlowLink Relay
8  relayUrl: "https://flowlink.flow-masters.ru/api/v1"
9
10  # Идентификатор агента (уникальный в пределах кластера)
11  agentId: "agent-prod-01"
12
13  # Теги для группировки и фильтрации
14  tags:
15    - "production"
16    - "critical"
17    - "k8s"
18
19  # Политики безопасности
20  policies:
21    - name: block-destructive
22      action: deny
23      patterns:
24        - "rm -rf *"
25        - "DROP TABLE"
26        - "chmod 777"
27        - "kubectl delete pod"
28    - name: require-approval
29      action: approval
30      patterns:
31        - "helm uninstall"
32        - "kubectl delete deploy"
33        - "systemctl stop"
34
35  # Настройки Shield
36  shield:
37    enabled: true
38    mode: enforce           # monitor | enforce
39    levels:
40      - L1                 # Command analysis
41      - L2                 # Pattern matching
42      - L3                 # Context awareness
43      - L4                 # Risk scoring
44      - L5                 # Policy engine
45      - L6                 # Compliance check
46      - L7                 # Forensic analysis
47
48  # Настройки Sandbox
49  sandbox:
50    enabled: true
51    networkPolicy: restrict  # restrict | allow
52    filesystem: read-only
53    allowedPaths:
54      - "/app"
55      - "/tmp"
56
57status:
58  phase: Running
59  connected: true
60  lastHeartbeat: "2026-05-15T10:30:00Z"
61  policiesLoaded: 2

1apiVersion: shield.flowlink.ai/v1alpha1
2kind: FlowLinkShieldPolicy
3metadata:
4  name: production-shield
5  namespace: default
6spec:
7  mode: enforce          # monitor | enforce
8  enabled: true
9  rules:
10    - name: block-destructive
11      action: deny
12      patterns:
13        - "rm -rf *"
14        - "DROP TABLE"
15        - "chmod 777"
16    - name: require-approval
17      action: approval
18      patterns:
19        - "kubectl delete"
20        - "helm uninstall"
21  sidecar_image: "flowlink/flowlink-shield:latest"
22  relay_url: "https://flowlink.flow-masters.ru"
23  watch_namespaces: ["default", "production"]

1apiVersion: admissionregistration.k8s.io/v1
2kind: MutatingWebhookConfiguration
3metadata:
4  name: flowlink-injector
5  labels:
6    app.kubernetes.io/name: flowlink-operator
7    app.kubernetes.io/component: webhook
8webhooks:
9  - name: injector.flowlink.io
10    rules:
11      - apiGroups: [""]
12        apiVersions: ["v1"]
13        operations: ["CREATE"]
14        resources: ["pods"]
15    # Внедрять только в поды с меткой
16    objectSelector:
17      matchLabels:
18        flowlink/inject: "true"
19    # Не внедрять в поды flowlink-system namespace
20    namespaceSelector:
21      matchExpressions:
22        - key: kubernetes.io/metadata.name
23          operator: NotIn
24          values: ["flowlink-system", "kube-system"]
25    clientConfig:
26      service:
27        name: flowlink-operator-webhook
28        namespace: flowlink-system
29        path: "/mutate-pod"
30        port: 9443
31      caBundle: <CA_BUNDLE>
32    admissionReviewVersions: ["v1"]
33    sideEffects: None
34    timeoutSeconds: 5
35    reinvocationPolicy: Never

1apiVersion: apps/v1
2kind: Deployment
3metadata:
4  name: my-app
5  labels:
6    flowlink/inject: "true"    # Триггер для Mutation Webhook
7spec:
8  replicas: 3
9  selector:
10    matchLabels:
11      app: my-app
12  template:
13    metadata:
14      labels:
15        app: my-app
16        flowlink/inject: "true"
17    spec:
18      containers:
19        - name: app
20          image: my-app:latest
21          ports:
22            - containerPort: 8080
23          env:
24            - name: FLOWLINK_SIDECAR_HOST
25              value: "localhost"
26            - name: FLOWLINK_SIDECAR_PORT
27              value: "9090"
28        # FlowLink sidecar (автоматически внедряется webhook'ом)
29        # или может быть задан вручную:
30        - name: flowlink-shield
31          image: flowlink/flowlink-shield:latest
32          ports:
33            - containerPort: 9090
34          env:
35            - name: RELAY_URL
36              value: "https://flowlink.flow-masters.ru/api/v1"
37            - name: AGENT_ID
38              valueFrom:
39                fieldRef:
40                  fieldPath: metadata.name
41            - name: SHIELD_MODE
42              value: "enforce"
43          resources:
44            requests:
45              cpu: 100m
46              memory: 128Mi
47            limits:
48              cpu: 500m
49              memory: 256Mi

1apiVersion: apps/v1
2kind: DaemonSet
3metadata:
4  name: flowlink-agent
5  namespace: flowlink-system
6  labels:
7    app.kubernetes.io/name: flowlink-agent
8spec:
9  selector:
10    matchLabels:
11      app: flowlink-agent
12  template:
13    metadata:
14      labels:
15        app: flowlink-agent
16    spec:
17      serviceAccountName: flowlink-agent
18      tolerations:
19        - key: node-role.kubernetes.io/control-plane
20          effect: NoSchedule
21        - key: node-role.kubernetes.io/master
22          effect: NoSchedule
23      containers:
24        - name: flowlink-agent
25          image: flowlink/flowlink-shield:latest
26          securityContext:
27            privileged: false
28            runAsUser: 1000
29            readOnlyRootFilesystem: true
30          env:
31            - name: RELAY_URL
32              valueFrom:
33                configMapKeyRef:
34                  name: flowlink-config
35                  key: relay.url
36            - name: AGENT_ID
37              valueFrom:
38                fieldRef:
39                  fieldPath: spec.nodeName
40            - name: NODE_NAME
41              valueFrom:
42                fieldRef:
43                  fieldPath: spec.nodeName
44            - name: SHIELD_MODE
45              value: "monitor"
46          volumeMounts:
47            - name: config
48              mountPath: /etc/flowlink
49              readOnly: true
50            - name: run
51              mountPath: /var/run
52              readOnly: true
53      volumes:
54        - name: config
55          configMap:
56            name: flowlink-config
57        - name: run
58          hostPath:
59            path: /var/run

1---
2apiVersion: v1
3kind: ServiceAccount
4metadata:
5  name: flowlink-operator
6  namespace: flowlink-system
7  labels:
8    app.kubernetes.io/name: flowlink-operator
9automountServiceAccountToken: true
10
11---
12apiVersion: rbac.authorization.k8s.io/v1
13kind: ClusterRole
14metadata:
15  name: flowlink-operator
16  labels:
17    app.kubernetes.io/name: flowlink-operator
18rules:
19  # Управление собственными CRD
20  - apiGroups: ["flowlink.io"]
21    resources: ["flowlinkagents", "flowlinkagents/status"]
22    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
23  - apiGroups: ["shield.flowlink.ai"]
24    resources: ["flowlinkshieldpolicies", "flowlinkshieldpolicies/status"]
25    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
26
27  # Мониторинг подов для sidecar injection
28  - apiGroups: [""]
29    resources: ["pods", "pods/status"]
30    verbs: ["get", "list", "watch"]
31  - apiGroups: [""]
32    resources: ["namespaces"]
33    verbs: ["get", "list", "watch"]
34
35  # Конфигурация webhook
36  - apiGroups: ["admissionregistration.k8s.io"]
37    resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"]
38    verbs: ["get", "list", "watch", "create", "update", "patch"]
39  - apiGroups: [""]
40    resources: ["secrets"]
41    verbs: ["get", "list", "watch"]   # для TLS сертификатов webhook
42
43  # ConfigMaps и Secrets
44  - apiGroups: [""]
45    resources: ["configmaps", "secrets"]
46    verbs: ["get", "list", "watch"]
47
48---
49apiVersion: rbac.authorization.k8s.io/v1
50kind: ClusterRoleBinding
51metadata:
52  name: flowlink-operator
53  labels:
54    app.kubernetes.io/name: flowlink-operator
55subjects:
56  - kind: ServiceAccount
57    name: flowlink-operator
58    namespace: flowlink-system
59roleRef:
60  kind: ClusterRole
61  name: flowlink-operator
62  apiGroup: rbac.authorization.k8s.io

1apiVersion: apps/v1
2kind: Deployment
3metadata:
4  name: api-server
5  namespace: production
6  labels:
7    flowlink/inject: "true"
8spec:
9  replicas: 3
10  selector:
11    matchLabels:
12      app: api-server
13  template:
14    metadata:
15      labels:
16        app: api-server
17        flowlink/inject: "true"
18    spec:
19      serviceAccountName: app-sa
20      containers:
21        - name: api
22          image: my-company/api-server:v2.1.0
23          env:
24            - name: DATABASE_URL
25              valueFrom:
26                secretKeyRef:
27                  name: db-credentials
28                  key: url
29        # FlowLink sidecar внедряется автоматически через webhook

1# Применить FlowLink DaemonSet
2kubectl apply -f https://raw.githubusercontent.com/flowlink/flowlink-operator/main/config/daemonset.yaml
3
4# Проверить статус агентов на узлах
5kubectl get pods -n flowlink-system -l app=flowlink-agent -o wide
6
7# Просмотреть логи агента на конкретном узле
8kubectl logs -n flowlink-system flowlink-agent-<NODE> -c flowlink-agent --tail=100

1# Создать FlowLinkAgent для production namespace
2kubectl apply -f - <<EOF
3apiVersion: flowlink.io/v1alpha1
4kind: FlowLinkAgent
5metadata:
6  name: production-agent
7  namespace: production
8spec:
9  relayUrl: "https://flowlink.flow-masters.ru/api/v1"
10  agentId: "prod-k8s-agent"
11  tags:
12    - "production"
13    - "api"
14  policies:
15    - name: block-destructive
16      action: deny
17      patterns: ["rm -rf *", "DROP TABLE", "chmod 777"]
18  shield:
19    enabled: true
20    mode: enforce
21  sandbox:
22    enabled: true
23    filesystem: read-only
24EOF
25
26# Проверить статус агента
27kubectl get flowlinkagents -n production
28kubectl describe flowlinkagent production-agent -n production

1apiVersion: v1
2kind: ConfigMap
3metadata:
4  name: flowlink-config
5  namespace: flowlink-system
6data:
7  # Адрес FlowLink Relay
8  relay.url: "https://flowlink.flow-masters.ru/api/v1"
9
10  # Режим работы Shield: monitor | enforce
11  shield.mode: "enforce"
12
13  # Активные уровни анализа (через запятую)
14  shield.levels: "L1,L2,L3,L4,L5,L6,L7"
15
16  # Чувствительность: low | medium | high
17  shield.sensitivity: "medium"
18
19  # Namespace'ы для мониторинга (пусто = все)
20  watch.namespaces: "default,production,staging"
21
22  # Интервал heartbeat к relay (секунды)
23  heartbeat.interval: "30"
24
25  # Размер лог-буфера (MB)
26  log.bufferSize: "50"
27
28  # Включить sandbox по умолчанию
29  sandbox.enabled: "true"
30
31  # Политика сети sandbox: restrict | allow
32  sandbox.networkPolicy: "restrict"

1# 1. Применить CRD
2kubectl apply -f config/crd.yaml
3
4# 2. Создать политику
5kubectl apply -f config/policy.yaml
6
7# 3. Собрать оператор
8cargo build --release -p flowlink-k8s
9
10# 4. Запустить оператор (подключается к relay)
11./flowlink-k8s --relay-url https://flowlink.flow-masters.ru/api/v1