94 lines
3.3 KiB
YAML
94 lines
3.3 KiB
YAML
|
# NetworkPolicy for verification-service.
|
||
|
|
#
|
||
|
|
# Cluster-wide NetworkPolicy enforcement is active on BasicStack (see
|
||
|
|
# cluster memory on NetworkPolicy activation). Pods in agent-trust
|
||
|
|
# without an explicit allow-list are isolated; this file is the
|
||
|
|
# explicit allow-list for verification-service per DEV-615.
|
||
|
|
#
|
||
|
|
# Ingress callers (per Phase-1 architecture V1.1 §7):
|
||
|
|
# - approval-service — supplies the approval predicate when a
|
||
|
|
# fast chain pre-check is needed.
|
||
|
|
# - testagent-transform — the transformation agent that submits
|
||
|
|
# a chain to vet before shipping to the sink.
|
||
|
|
# - dummy-sink — the Phase-1 sink that calls back into
|
||
|
|
# verify/chain before persisting a payload.
|
||
|
|
#
|
||
|
|
# Egress reachable targets:
|
||
|
|
# - transparency-log — pulls DSSE envelopes + inclusion proofs
|
||
|
|
# (agent-trust/transparency-log, port 80).
|
||
|
|
# - trust-pg — Postgres backing the replay-store
|
||
|
|
# `verification_decisions` table (store=postgres).
|
||
|
|
# - Pocket-ID JWKS — out-of-cluster `auth.basicstack.de` JWKS
|
||
|
|
# fetch for OIDC validators (HTTPS/443).
|
||
|
|
# - DNS — kube-dns in kube-system for service name
|
||
|
|
# resolution.
|
||
|
|
---
|
||
|
|
apiVersion: networking.k8s.io/v1
|
||
|
|
kind: NetworkPolicy
|
||
|
|
metadata:
|
||
|
|
name: verification-service
|
||
|
|
namespace: agent-trust
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: verification-service
|
||
|
|
app.kubernetes.io/part-of: proofedmesh
|
||
|
|
spec:
|
||
|
|
podSelector:
|
||
|
|
matchLabels:
|
||
|
|
app.kubernetes.io/name: verification-service
|
||
|
|
policyTypes:
|
||
|
|
- Ingress
|
||
|
|
- Egress
|
||
|
|
ingress:
|
||
|
|
- from:
|
||
|
|
- podSelector:
|
||
|
|
matchLabels:
|
||
|
|
app.kubernetes.io/name: approval-service
|
||
|
|
- podSelector:
|
||
|
|
matchLabels:
|
||
|
|
app.kubernetes.io/name: testagent-transform
|
||
|
|
- podSelector:
|
||
|
|
matchLabels:
|
||
|
|
app.kubernetes.io/name: dummy-sink
|
||
|
|
ports:
|
||
|
|
- port: 8084
|
||
|
|
protocol: TCP
|
||
|
|
egress:
|
||
|
|
# transparency-log (in-cluster, agent-trust namespace, port 80).
|
||
|
|
- to:
|
||
|
|
- podSelector:
|
||
|
|
matchLabels:
|
||
|
|
app.kubernetes.io/name: transparency-log
|
||
|
|
ports:
|
||
|
|
- port: 8080
|
||
|
|
protocol: TCP
|
||
|
|
# trust-api Postgres (replay-store backend). Reached via the
|
||
|
|
# `trust-pg` Service in the same namespace.
|
||
|
|
- to:
|
||
|
|
- podSelector:
|
||
|
|
matchLabels:
|
||
|
|
app.kubernetes.io/name: trust-pg
|
||
|
|
ports:
|
||
|
|
- port: 5432
|
||
|
|
protocol: TCP
|
||
|
|
# Pocket-ID JWKS discovery is served from the public ingress
|
||
|
|
# (`auth.basicstack.de`). Egress is cluster-external HTTPS; no
|
||
|
|
# cluster selector will match, so this is an unrestricted
|
||
|
|
# TCP/443 egress rule.
|
||
|
|
- ports:
|
||
|
|
- port: 443
|
||
|
|
protocol: TCP
|
||
|
|
# DNS egress to kube-dns (cluster hostname resolution + out-of-
|
||
|
|
# cluster CNAME lookups for Pocket-ID JWKS).
|
||
|
|
- to:
|
||
|
|
- namespaceSelector:
|
||
|
|
matchLabels:
|
||
|
|
kubernetes.io/metadata.name: kube-system
|
||
|
|
podSelector:
|
||
|
|
matchLabels:
|
||
|
|
k8s-app: kube-dns
|
||
|
|
ports:
|
||
|
|
- port: 53
|
||
|
|
protocol: UDP
|
||
|
|
- port: 53
|
||
|
|
protocol: TCP
|