pip3 install checkov

checkov --download-external-modules true -d .

Check: CKV_SECRET_6: "Base64 High Entropy String"

variable "redis_password" {
  sensitive = true
}

export TF_VAR_redis_password="your_password"

Check: CKV_YC_11: "Ensure security group is assigned to network interface."

resource "yandex_vpc_security_group" "vm-access" {
  <...>
  ingress {
    protocol       = "TCP"
    description    = "Правило разрешает доступ к VM по SSH из приватной сети."
    v4_cidr_blocks = ["172.16.0.0/12", "10.0.0.0/8", "192.168.0.0/16"]
    port           = 22
  }

  ingress {
    protocol       = "TCP"
    description    = "Правило разрешает доступ к VM по HTTPS для любых адресов."
    v4_cidr_blocks = ["0.0.0.0/0"]
    port           = 443
  }
}

resource "yandex_compute_instance" "vm" {
   <...>
  network_interface {
    <...>
    security_group_ids = [
      yandex_vpc_security_group.vm-access.id
    ]
  }
}

Check: CKV_YC_23: "Ensure folder member does not have elevated access."

resource "yandex_resourcemanager_folder_iam_binding" "editor" {
  folder_id = var.folder_id
  members = [
    "serviceAccount:${yandex_iam_service_account.k8s-resource.id}"
  ]
  role = "editor"
}

checkov --skip-check CKV_YC_23 -d .

<...>
# checkov:skip=CKV_YC_23:These service account should have primitive roles
role = "editor"

helm repo add cnpg https://cloudnative-pg.github.io/charts
helm --kubeconfig ~/.kube/k3s upgrade --install cnpg \
   --namespace cnpg-system \
   --create-namespace \
   cnpg/cloudnative-pg

apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
 name: postgresql
 namespace: default
spec:
 instances: 3
 imageName: ghcr.io/cloudnative-pg/postgresql:16.2-14
 storage:
   pvcTemplate:
     resources:
       requests:
         storage: 5Gi
 resources:
   requests:
     memory: "1Gi"
     cpu: 1
   limits:
     memory: "1Gi"
     cpu: 1

# k_k3s get secret/postgresql-app -o json | jq -r .data.password | base64 -d
UVWVz78DLD5Nc0M0nq6HKFyUUYjoN9Z2KdKjzxKp8adnzFVyUiA8lxeqGANVhpmz
# k_k3s get secret/postgresql-app -o json | jq -r .data.dbname | base64 -d
app
# k_k3s get secret/postgresql-app -o json | jq -r .data.user | base64 -d
app

k_k3s run -it --rm psql-client --image=postgres:16.3-alpine --restart=Never --command bash

# psql \
         --host=postgresql-ro \
         --port=5432 \
         --username=app \
         --password \
         app
app=> select count(*) from users;
 count 
-------
    14
(1 row)

app=> insert into users (username, age) values ('A', 5);
ERROR:  cannot execute INSERT in a read-only transaction

docker compose up -d

pg_dump \   
        --host=localhost \
        --port=5432 \
        --username=dev_user \
        --password \
        users > users_dump.sql

psql \
        --host=localhost \
        --port=5433 \
        --username=dev_user \
        --password \
        users < users_dump.sql

users=# select count(*) from users;
 count 
-------
    14
(1 row)

users=# create database replication;
CREATE DATABASE
users=# grant all privileges on database replication to dev_user;
GRANT

host    replication           dev_user        0.0.0.0/0               password

pg_basebackup --host=localhost --port=5432 --username=dev_user -D ./main-postgres-data

services:
  main:
    [...]
 
  restored:
    [...]
    volumes:
      - ./main-postgres-data:/var/lib/postgresql/data

psql \
        --host=localhost \
        --port=5433 \
        --username=dev_user \
        --password \
        users
Password: 
psql (14.11 (Ubuntu 14.11-0ubuntu0.22.04.1), server 14.1)
Type "help" for help.

users=# select count(*) from users;
 count 
-------
    14
(1 row)

sudo apt install s3fs
export ACCESS_KEY=YCAJENkZCs1eLXRWlkUzWcNpE
export SECRET_KEY=YCNVDcOukw3aIFvobPe_qnFOVv-P65EBrxn3x671
echo "$ACCESS_KEY:$SECRET_KEY" > ~/.passwd-s3fs && chmod 600 ~/.passwd-s3fs
s3fs azamat-komaev-file-system /mnt/ -o passwd_file=$HOME/.passwd-s3fs \
    -o url=https://storage.yandexcloud.net -o use_path_request_style

listeners=SSL://0.0.0.0:9092,PLAINTEXT://192.168.135.1:9093

security.inter.broker.protocol=PLAINTEXT

fdisk -l
mount /dev/sda1 /mnt
arch-chroot /mnt
passwd azamat