rcourtman ae70d9e423 feat: add --kube-include-all-deployments flag for Kubernetes agent

Adds IncludeAllDeployments option to show all deployments, not just
problem ones (where replicas don't match desired). This provides parity
with the existing --kube-include-all-pods flag.

- Add IncludeAllDeployments to kubernetesagent.Config
- Add --kube-include-all-deployments flag and PULSE_KUBE_INCLUDE_ALL_DEPLOYMENTS env var
- Update collectDeployments to respect the new flag
- Add test for IncludeAllDeployments functionality
- Update UNIFIED_AGENT.md documentation

Addresses feedback from PR #855

2025-12-18 20:58:30 +00:00

2.1 KiB

Raw Permalink Blame History

🛡️ Sensor Proxy Hardening

Deprecated in v5: pulse-sensor-proxy is deprecated and not recommended for new deployments. Use pulse-agent --enable-proxmox for temperature monitoring. This document is retained for existing installations during the migration window.

The pulse-sensor-proxy runs on the host to securely collect temperatures, keeping SSH keys out of containers.

🏗️ Architecture

Host: Runs pulse-sensor-proxy (unprivileged user).
Container: Connects via Unix socket (/run/pulse-sensor-proxy/pulse-sensor-proxy.sock).
Auth: Uses SO_PEERCRED to verify container UID/PID.

🔒 Host Hardening

Service Account

Runs as pulse-sensor-proxy (no shell, no home).

id pulse-sensor-proxy # uid=XXX(pulse-sensor-proxy)

Systemd Security

The service unit uses:

User=pulse-sensor-proxy
NoNewPrivileges=true
ProtectSystem=strict
PrivateTmp=true

File Permissions

Path	Owner	Mode
`/var/lib/pulse-sensor-proxy/`	`pulse-sensor-proxy`	`0750`
`/var/lib/pulse-sensor-proxy/ssh/`	`pulse-sensor-proxy`	`0700`
`/run/pulse-sensor-proxy/`	`pulse-sensor-proxy`	`0775`

📦 LXC Configuration

Required for the container to access the proxy socket.

/etc/pve/lxc/<VMID>.conf:

unprivileged: 1
lxc.apparmor.profile: generated
lxc.mount.entry: /run/pulse-sensor-proxy mnt/pulse-proxy none bind,create=dir 0 0

🔑 Key Management

SSH keys are restricted to sensors -j only.

Rotation:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/rcourtman/Pulse/main/scripts/pulse-proxy-rotate-keys.sh)"

Dry Run: Add --dry-run.
Rollback: Add --rollback.

🚨 Incident Response

If compromised:

Stop Proxy: systemctl stop pulse-sensor-proxy.
Rotate Keys: Remove old keys from nodes manually or use the rotation helper above.
Audit Logs: Check journalctl -u pulse-sensor-proxy.

Reinstall:

curl -fsSL https://github.com/rcourtman/Pulse/releases/latest/download/install-sensor-proxy.sh | sudo bash

2.1 KiB Raw Permalink Blame History