Skip to content

Commit c74b4b8

Browse files
mayurkrclaude
mayurkr
and
claude
authored
Add Gateway API HTTPRoute and simplify installation (#71)
* refactor: convert ZelyoConfig from Helm hook to regular template ZelyoConfig was deployed as a post-install/post-upgrade Helm hook, which meant it was not tracked in the release manifest — helm upgrade could not update it, helm rollback could not restore it, and helm get manifest did not show it. Converting to a regular template fixes all three issues. Also streamlines onboarding: removes cert-manager as a required prerequisite (self-signed is the default), reduces quickstart from 5 steps to 3, and adds ZelyoConfig status messaging to NOTES.txt. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: add Gateway API HTTPRoute for dashboard exposure Adds an HTTPRoute template alongside the existing Ingress, so users on Gateway API can expose the dashboard without annotations hacks. Configured via httpRoute.parentRefs and httpRoute.hostnames in values. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent fd61deb commit c74b4b8

7 files changed

Lines changed: 243 additions & 167 deletions

File tree

‎README.md‎

Lines changed: 107 additions & 108 deletions
Large diffs are not rendered by default.

‎deploy/helm/zelyo-operator/templates/NOTES.txt‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,10 @@
4848
{{- range .Values.ingress.hosts }}
4949
https://{{ .host }}{{ (index .paths 0).path }}
5050
{{- end }}
51+
{{- else if .Values.httpRoute.enabled }}
52+
{{- range .Values.httpRoute.hostnames }}
53+
https://{{ . }}{{ $.Values.httpRoute.path | default "/" }}
54+
{{- end }}
5155
{{- else }}
5256
kubectl port-forward -n {{ include "zelyo-operator.namespace" . }} svc/{{ include "zelyo-operator.fullname" . }} {{ .Values.service.port }}:{{ .Values.service.port }}
5357
open http://localhost:{{ .Values.service.port }}
@@ -63,11 +67,24 @@
6367

6468
{{- end }}
6569

70+
{{- if .Values.config.llm.provider }}
71+
72+
── ZelyoConfig ──────────────────────────────────────────────────
73+
74+
ZelyoConfig CR "zelyo" has been created automatically.
75+
76+
Mode: {{ .Values.config.mode }}
77+
Provider: {{ .Values.config.llm.provider }}
78+
Model: {{ .Values.config.llm.model }}
79+
80+
{{- end }}
81+
6682
{{- if and .Values.config.llm.apiKeySecret (ne .Values.config.llm.apiKeySecret "") }}
6783

68-
── LLM Configuration ─────────────────────────────────────────────
84+
── LLM API Key ───────────────────────────────────────────────────
6985

70-
⚠️ Create the LLM API key secret before the operator can use AI features:
86+
The operator will enter Degraded phase until the LLM API key secret exists.
87+
Create it now — the operator auto-activates within seconds:
7188

7289
kubectl create secret generic {{ .Values.config.llm.apiKeySecret }} \
7390
--from-literal=api-key=YOUR_API_KEY \

‎deploy/helm/zelyo-operator/templates/httproute.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
{{- if .Values.httpRoute.enabled -}}
2+
apiVersion: gateway.networking.k8s.io/v1
3+
kind: HTTPRoute
4+
metadata:
5+
name: {{ include "zelyo-operator.fullname" . }}
6+
namespace: {{ include "zelyo-operator.namespace" . }}
7+
labels:
8+
{{- include "zelyo-operator.labels" . | nindent 4 }}
9+
{{- with .Values.httpRoute.annotations }}
10+
annotations:
11+
{{- toYaml . | nindent 4 }}
12+
{{- end }}
13+
spec:
14+
{{- with .Values.httpRoute.parentRefs }}
15+
parentRefs:
16+
{{- toYaml . | nindent 4 }}
17+
{{- end }}
18+
{{- if .Values.httpRoute.hostnames }}
19+
hostnames:
20+
{{- range .Values.httpRoute.hostnames }}
21+
- {{ . | quote }}
22+
{{- end }}
23+
{{- end }}
24+
rules:
25+
- matches:
26+
- path:
27+
type: PathPrefix
28+
value: {{ .Values.httpRoute.path | default "/" }}
29+
backendRefs:
30+
- name: {{ include "zelyo-operator.fullname" . }}
31+
port: {{ .Values.service.port }}
32+
{{- end }}

‎deploy/helm/zelyo-operator/templates/zelyoconfig.yaml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,6 @@ metadata:
55
name: zelyo
66
labels:
77
{{- include "zelyo-operator.labels" . | nindent 4 }}
8-
annotations:
9-
helm.sh/hook: post-install,post-upgrade
10-
helm.sh/hook-weight: "10"
118
spec:
129
mode: {{ .Values.config.mode | default "audit" }}
1310
llm:

‎deploy/helm/zelyo-operator/values.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -301,6 +301,23 @@ ingress:
301301
pathType: Prefix
302302
tls: []
303303

304+
# ── HTTPRoute (Gateway API) ───────────────────────────────────
305+
httpRoute:
306+
# -- Enable Gateway API HTTPRoute for dashboard access
307+
enabled: false
308+
# -- HTTPRoute annotations
309+
annotations: {}
310+
# -- Parent gateway references
311+
parentRefs: []
312+
# - name: my-gateway
313+
# namespace: gateway-system
314+
# sectionName: https
315+
# -- Hostnames to match
316+
hostnames: []
317+
# - zelyo-operator.example.com
318+
# -- Path prefix for the route
319+
path: "/"
320+
304321
# ── Pod Disruption Budget ──────────────────────────────────────────────
305322
podDisruptionBudget:
306323
# -- Create a PodDisruptionBudget

‎deploy/helm/zelyo-policies/templates/NOTES.txt‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
Prerequisite: zelyo-operator must be installed first.
2+
If this install failed with "no matches for kind", run:
3+
helm install zelyo-operator oci://ghcr.io/zelyo-ai/charts/zelyo-operator \
4+
--namespace {{ include "zelyo-policies.namespace" . }} --create-namespace
15

26
=============================================================
37
Zelyo Policies deployed successfully!

‎docs/quickstart.md‎

Lines changed: 64 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Quickstart
22

3-
Get Zelyo Operator running on your Kubernetes cluster and scanning workloads in under 10 minutes.
3+
Get Zelyo Operator running on your Kubernetes cluster and scanning workloads in under 5 minutes.
44

55
Zelyo Operator is an open-source CNAPP that detects security misconfigurations across Kubernetes and cloud infrastructure, correlates them with an LLM, and opens GitOps PRs to fix them.
66

@@ -14,36 +14,21 @@ Zelyo Operator is an open-source CNAPP that detects security misconfigurations a
1414
kubectl cluster-info && helm version
1515
```
1616

17-
---
18-
19-
## 1. Install cert-manager
20-
21-
Required for webhook TLS certificates.
22-
23-
```bash
24-
helm install cert-manager oci://quay.io/jetstack/charts/cert-manager \
25-
--namespace cert-manager \
26-
--create-namespace \
27-
--set crds.enabled=true
17+
> **Note:** Webhook TLS certificates are self-signed by default. If you prefer cert-manager managed certificates, see [Optional: cert-manager for Webhook TLS](#optional-cert-manager-for-webhook-tls) below.
2818
29-
kubectl wait --for=condition=Ready pods --all -n cert-manager --timeout=120s
30-
```
19+
---
3120

32-
## 2. Install Zelyo Operator
21+
## 1. Install Zelyo Operator
3322

3423
```bash
3524
helm install zelyo-operator oci://ghcr.io/zelyo-ai/charts/zelyo-operator \
3625
--namespace zelyo-system \
37-
--create-namespace \
38-
--set config.llm.provider=openrouter \
39-
--set config.llm.model=anthropic/claude-sonnet-4-20250514 \
40-
--set config.llm.apiKeySecret=zelyo-llm \
41-
--set webhook.certManager.enabled=true
42-
43-
kubectl get pods -n zelyo-system
26+
--create-namespace
4427
```
4528

46-
## 3. Add Your LLM API Key
29+
This installs the operator, CRDs, and creates the `ZelyoConfig` CR automatically. The operator starts in Degraded phase until the LLM API key is provided.
30+
31+
## 2. Add Your LLM API Key
4732

4833
Get a key from [openrouter.ai/keys](https://openrouter.ai/keys) (or any supported provider -- see table below), then:
4934

@@ -53,15 +38,17 @@ kubectl create secret generic zelyo-llm \
5338
--from-literal=api-key=<YOUR_API_KEY>
5439
```
5540

56-
| Provider | Config value | Get a key |
57-
|---|---|---|
58-
| OpenRouter | `openrouter` | [openrouter.ai/keys](https://openrouter.ai/keys) |
59-
| OpenAI | `openai` | [platform.openai.com/api-keys](https://platform.openai.com/api-keys) |
60-
| Anthropic | `anthropic` | [console.anthropic.com](https://console.anthropic.com) |
61-
| Azure OpenAI | `azure-openai` | [Azure Portal](https://portal.azure.com) |
62-
| Ollama (self-hosted) | `ollama` | [ollama.ai](https://ollama.ai) |
41+
The operator auto-activates within seconds once the secret is created.
6342

64-
## 4. Deploy Default Policies (Recommended)
43+
| Provider | Config value | Get a key |
44+
| -------------------- | ---------------- | ----------------------------------------------------------------- |
45+
| OpenRouter | `openrouter` | [openrouter.ai/keys](https://openrouter.ai/keys) |
46+
| OpenAI | `openai` | [platform.openai.com/api-keys](https://platform.openai.com/api-keys) |
47+
| Anthropic | `anthropic` | [console.anthropic.com](https://console.anthropic.com) |
48+
| Azure OpenAI | `azure-openai` | [Azure Portal](https://portal.azure.com) |
49+
| Ollama (self-hosted) | `ollama` | [ollama.ai](https://ollama.ai) |
50+
51+
## 3. Deploy Default Policies (Recommended)
6552

6653
The `zelyo-policies` Helm chart deploys production-ready security policies covering all 56 scanners in one command:
6754

@@ -71,6 +58,7 @@ helm install zelyo-policies oci://ghcr.io/zelyo-ai/charts/zelyo-policies \
7158
```
7259

7360
This creates:
61+
7462
- **3 SecurityPolicies** -- production (strict), staging (standard), default (standard) with per-environment namespace targeting
7563
- **2 ClusterScans** -- nightly full scan + weekly compliance evaluation with CIS Kubernetes Benchmark
7664
- **1 MonitoringPolicy** -- anomaly detection, warning events, log patterns for auth failures and secret exposure
@@ -90,11 +78,11 @@ helm install zelyo-policies oci://ghcr.io/zelyo-ai/charts/zelyo-policies \
9078
--set compliance.presets.hipaa=true
9179
```
9280

93-
| Profile | Severity Floor | Rules | Enforcement |
94-
|---|---|---|---|
95-
| `starter` | high | 4 core rules | warn only |
96-
| `standard` | medium | all 8 rules | enforce critical+high |
97-
| `strict` | low | all 8 rules | enforce all |
81+
| Profile | Severity Floor | Rules | Enforcement |
82+
| ------------ | -------------- | ------------ | --------------------- |
83+
| `starter` | high | 4 core rules | warn only |
84+
| `standard` | medium | all 8 rules | enforce critical+high |
85+
| `strict` | low | all 8 rules | enforce all |
9886

9987
Verify:
10088

@@ -244,23 +232,23 @@ kubectl get cloudaccountconfigs -n zelyo-system
244232
kubectl get scanreports -n zelyo-system -l zelyo.ai/scan-type=cloud
245233
```
246234

247-
| Scan category | Count | Examples |
248-
|---|---|---|
249-
| `cspm` | 8 | Public S3, unencrypted EBS, CloudTrail disabled |
250-
| `ciem` | 8 | Overprivileged IAM, unused keys, MFA not enforced |
251-
| `network` | 8 | Open SSH/RDP, exposed DB ports, ALB without HTTPS |
252-
| `dspm` | 8 | Public S3 ACLs, unencrypted DynamoDB, public RDS |
253-
| `supply-chain` | 8 | ECR CVEs, stale images, unsigned images |
254-
| `cicd-pipeline` | 8 | Hardcoded secrets, overprivileged CodeBuild |
255-
256-
| Compliance framework | Config value |
257-
|---|---|
258-
| SOC 2 | `soc2` |
259-
| PCI-DSS | `pci-dss` |
260-
| HIPAA | `hipaa` |
261-
| CIS AWS | `cis-aws` |
262-
| NIST 800-53 | `nist-800-53` |
263-
| ISO 27001 | `iso-27001` |
235+
| Scan category | Count | Examples |
236+
| ----------------- | ----- | ------------------------------------------------- |
237+
| `cspm` | 8 | Public S3, unencrypted EBS, CloudTrail disabled |
238+
| `ciem` | 8 | Overprivileged IAM, unused keys, MFA not enforced |
239+
| `network` | 8 | Open SSH/RDP, exposed DB ports, ALB without HTTPS |
240+
| `dspm` | 8 | Public S3 ACLs, unencrypted DynamoDB, public RDS |
241+
| `supply-chain` | 8 | ECR CVEs, stale images, unsigned images |
242+
| `cicd-pipeline` | 8 | Hardcoded secrets, overprivileged CodeBuild |
243+
244+
| Compliance framework | Config value |
245+
| -------------------- | --------------- |
246+
| SOC 2 | `soc2` |
247+
| PCI-DSS | `pci-dss` |
248+
| HIPAA | `hipaa` |
249+
| CIS AWS | `cis-aws` |
250+
| NIST 800-53 | `nist-800-53` |
251+
| ISO 27001 | `iso-27001` |
264252

265253
---
266254

@@ -406,10 +394,32 @@ kubectl port-forward -n zelyo-system svc/zelyo-operator 8080:8080
406394

407395
---
408396

397+
## Optional: cert-manager for Webhook TLS
398+
399+
By default, Zelyo Operator uses self-signed certificates for webhook TLS. If you prefer cert-manager managed certificates:
400+
401+
```bash
402+
# Install cert-manager first
403+
helm install cert-manager oci://quay.io/jetstack/charts/cert-manager \
404+
--namespace cert-manager \
405+
--create-namespace \
406+
--set crds.enabled=true
407+
408+
# Then install Zelyo Operator with cert-manager enabled
409+
helm install zelyo-operator oci://ghcr.io/zelyo-ai/charts/zelyo-operator \
410+
--namespace zelyo-system \
411+
--create-namespace \
412+
--set webhook.certManager.enabled=true \
413+
--set webhook.selfSigned=false
414+
```
415+
416+
---
417+
409418
## Teardown
410419

411420
```bash
412421
helm uninstall zelyo-policies -n zelyo-system 2>/dev/null
413422
helm uninstall zelyo-operator -n zelyo-system
414-
helm uninstall cert-manager -n cert-manager
423+
# Only if you installed cert-manager:
424+
# helm uninstall cert-manager -n cert-manager
415425
```

0 commit comments

Comments
 (0)