update

terraform/crowdsec.tf

@@ -69,6 +69,26 @@ resource "kubernetes_persistent_volume" "crowdsec_lapi_data" {
   }
 }
 
+# ConfigMap for GitHub IP whitelist — mounted into the LAPI pod as a parser whitelist file.
+# This survives CrowdSec upgrades/restarts because it comes from a ConfigMap, not the ephemeral container FS.
+resource "kubernetes_config_map" "crowdsec_github_whitelist" {
+  metadata {
+    name      = "crowdsec-github-whitelist"
+    namespace = kubernetes_namespace.crowdsec.metadata[0].name
+  }
+
+  data = {
+    "github-whitelist.yaml" = <<-EOT
+      name: whitelist-github-ips
+      description: "Whitelist GitHub Actions/Services IPs (140.82.115.0/24)"
+      whitelist:
+        reason: "GitHub Actions and Services"
+        cidr:
+          - "140.82.115.0/24"
+    EOT
+  }
+}
+
 resource "helm_release" "crowdsec" {
   name       = "crowdsec"
   repository = "https://crowdsecurity.github.io/helm-charts"
@@ -123,6 +143,24 @@ resource "helm_release" "crowdsec" {
           enabled = true
         }
 
+        # Mount the GitHub IP whitelist ConfigMap into the LAPI parser directory
+        extraVolumes = [
+          {
+            name = "github-whitelist"
+            configMap = {
+              name = kubernetes_config_map.crowdsec_github_whitelist.metadata[0].name
+            }
+          }
+        ]
+
+        extraVolumeMounts = [
+          {
+            name      = "github-whitelist"
+            mountPath = "/etc/crowdsec/parsers/s02-enrich/github-whitelist.yaml"
+            subPath   = "github-whitelist.yaml"
+          }
+        ]
+
         env = [
           {
             name  = "ENROLL_KEY"
@@ -241,7 +279,8 @@ resource "helm_release" "crowdsec" {
   depends_on = [
     kubernetes_namespace.crowdsec,
     kubernetes_persistent_volume.crowdsec_lapi_config,
-    kubernetes_persistent_volume.crowdsec_lapi_data
+    kubernetes_persistent_volume.crowdsec_lapi_data,
+    kubernetes_config_map.crowdsec_github_whitelist,
   ]
 }
 
@@ -334,6 +373,26 @@ resource "null_resource" "crowdsec_bouncer_setup" {
 #   ]
 # }
 
+# Remove any existing CrowdSec ban decisions for GitHub IPs (140.82.115.0/24)
+# Re-runs whenever the whitelist CIDR changes or after a helm upgrade.
+resource "null_resource" "crowdsec_github_unban" {
+  depends_on = [null_resource.crowdsec_bouncer_setup]
+
+  provisioner "local-exec" {
+    command = <<-EOT
+      echo "Removing any existing bans for GitHub IPs (140.82.115.0/24)..."
+      kubectl exec -n crowdsec deployment/crowdsec-lapi -- \
+        cscli decisions delete --range 140.82.115.0/24 || true
+      echo "Done. GitHub IPs are cleared from the ban list."
+    EOT
+  }
+
+  triggers = {
+    github_cidr      = "140.82.115.0/24"
+    crowdsec_version = helm_release.crowdsec.version
+  }
+}
+
 output "crowdsec_info" {
   value = <<-EOT
     CrowdSec deployed successfully!