k8-bunny-acl: Instructions file for Claude Code

CLAUDE.md

This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

Project Overview

This is a Kubernetes-based security tool that automatically fetches and manages Bunny CDN edge server IP addresses for trusted proxy configurations. The system operates as a CronJob that updates a ConfigMap daily with current IP addresses, which applications can consume for security configurations.

Key Commands

Deployment and Setup

# Deploy the complete system
kubectl apply -f bunny-ip-updater.yaml

# Setup with interactive confirmation
./scripts/setup.sh

# Monitor system status
./scripts/monitor.sh status

# Compare ConfigMap with live API data
./scripts/monitor.sh compare

# Trigger manual update
./scripts/monitor.sh trigger

# View recent job logs
./scripts/monitor.sh logs

Verification Commands

# Check CronJob status
kubectl get cronjob bunny-ip-updater

# Verify ConfigMap population
kubectl get configmap bunny-trusted-ips -o jsonpath='{.data.TRUSTED_PROXY_IP}' | tr ',' '\n' | wc -l

# View sample IPs
kubectl get configmap bunny-trusted-ips -o jsonpath='{.data.TRUSTED_PROXY_IP}' | tr ',' '\n' | head -5

# Check recent job runs
kubectl get jobs -l job-name=bunny-ip-updater --sort-by=.metadata.creationTimestamp

# View job logs
kubectl logs -l job-name=bunny-ip-updater --tail=50

Architecture

Core Components

• CronJob: bunny-ip-updater runs daily at 2 AM UTC
• ConfigMap: bunny-trusted-ips stores comma-separated IP list
• RBAC: ServiceAccount, Role, and RoleBinding with minimal permissions
• Job Container: Uses alpine/curl:latest with security hardening

Security Model

• Namespace-scoped RBAC with minimal required permissions:
  • ConfigMap access: get, list, create, update, patch for bunny-trusted-ips
  • ConfigMap read access: get, list for Mastodon environment ConfigMaps
  • Deployment access: get, list, patch for Mastodon deployments (restart capability)
• Root containers with writable filesystem (required for package installation)
• Resource limits and security contexts enforced
• No privileged access or capability escalation