Skip to content
fzymgc-house Cluster Docs

Expression-policy audit alerts excluding the GitOps automation actor

Date: 2026-06-26 Status: Accepted Decision: hl-osb5 Deciders: sean

Context

Section titled “Context”

Authentik fires model_created / model_updated / model_deleted events for every object touched by terraform apply. The tf/authentik GitOps service account (akadmin / fzy_akadmin) triggers dozens of these events per automated deploy. A blunt authentik_policy_event_matcher on model_* actions would alert the security-alerts group on every GitOps run, making the alerts meaningless within hours of first deploy.

Decision

Section titled “Decision”

The config/audit notification rule uses an Authentik expression policy (tf/authentik/policies/match_sensitive_audit.py) that filters on a curated SENSITIVE_MODELS set and excludes known AUTOMATION_ACTORS usernames, rather than a simple model_* event matcher.

Rationale

Section titled “Rationale”
  • Every terraform apply against tf/authentik generates model_updated events from the service account — a blunt matcher would email on every GitOps merge.
  • An expression policy enables two-axis filtering unavailable in event matchers: model-type sensitivity AND actor identity.
  • AUTOMATION_ACTORS is a named, maintainable set — new service accounts can be added without restructuring the rule.
  • The pattern reuses the event/model filtering idiom already established in send_invitation_email.py.

Alternatives Considered

Section titled “Alternatives Considered”
  • Expression policy with actor exclusion + model curation (chosen): filters on sensitive model types and non-automation actors; eliminates GitOps noise while preserving human-initiated change alerts.
  • Blunt authentik_policy_event_matcher for model_created/updated/deleted (rejected): declarative and simple with no Python body, but fires on every terraform apply, producing immediate alert fatigue.

Consequences

Section titled “Consequences”
  • Positive: the security-alerts group receives alerts only for human-initiated changes to sensitive resources; GitOps automation noise is eliminated at the policy level rather than filtered downstream.
  • Negative: AUTOMATION_ACTORS must be updated whenever a GitOps service account is added or renamed (omission silently re-enables alert spam); SENSITIVE_MODELS and exact model_name strings must be confirmed against the live event log on first deploy — wrong values silently never match.
  • Neutral: the expression-policy body is stored as policies/match_sensitive_audit.py and referenced via file() in Terraform, following the existing policy-file convention.