ProofedMesh/deploy/approval-service/10-secret-dev.sealed.yaml

apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  creationTimestamp: null
  name: approval-service-dev
  namespace: agent-trust
spec:
  encryptedData:
    APPROVAL_POCKET_ID_CLIENT: AgCOz00SToarJgnN2+ig0CB/Pk2nlPu9GJx7PtDXiWwPCeZ08O7jf+uMRV/HZxAJ8zS3UCKe7oW+x0/v0eY/oSbGk2FL0aYeNb0+Q6ZNBfO52DPzJzd0AqGenAqbR7eN/rkrZIGFQyI2gAtQPCwEYMW9tIdR99tH/OiN3gh6NMV1VHiSz2nrpBLySct5K13OHjIa559nxhgbplnolXjFMEfTKoJUWTG5e0M42uBvg3OGMMDR1rAzw30e7Oc/O5WvB3dZbYps/qQzMooQdlm0rlxCmZdgddIKmDz2qM55qPql48F4Ehwi+H4uIqnjlEMfX9zS8F5SnIqIwVMUOmlon2i7vuWPyK/ndXIVAg/zKUnbAy22lwP3/38gAfLuq8p7d7kUoPyVGTjQTGdHeRr0j3xaMULB5OGGRE4pSZcc9IWmz08yUIAQqamqRavvcGMMjS7alUMUA/710b5S2mFNdjHhr0rfX3JZdFZjTR988J7fqIuzeCF6OK8TbPKmcAH/f1Zup0uxek60enZ0qDA1A9LXej8fjXEZoKaVENr+S29vwhez0hwSvXWBWCd0ClH8/PFzhDye9/aP+myMUElJPqbSDyrnwJL3T+709jUsgyok6k0vYfi7xZbpyNw0ozff7sL43Loim7DTLrMeCFFwXd5z8lmC/VG7LTudSXXgJ//852I8vHGoJIcpU55qJNBhf+AWOVVy+Zl+q27pF7e3ZVyQNI7iQN6knWrqJ8E1TnaA80xvtKw=
    APPROVAL_POCKET_ID_SECRET: AgAnKttGUyDZ1BWt5VReGPFyzlwMYcQdwUyvjUP+cM9U3M9YpizOGcm+8UHFc3cizBwNoS6Sr1WgrNJebq0DuQNWqki/egNn3fhS/RDDIdCei+u9i/e5dns1u+LxBDvNbeBCFii8rQEBc7vyFtxFnKLrPLca7S+Ij4cqZilzgr0oo56yhsvAC1gDtXOgj4KqfEKmKP6Z4q+6YGCuRY69jCLm6kojhXsOBSuJTxYA8mi7qnDlH52FcMidMcyF0HxYiVqDl85shKb2fozGIxQLt/FFQZWBzP7EZPCEvK1+ZCN/k2ttVmfbByqJaUlmRpY8jS+btfTzavJYbApMLZNaw91MyUaeC1NfqkqUqv86NfaZFrOOwrZiUbF32LAMLcXUdH/KHokZdNgB0nan7971ZxM/gQ4m+tQpFovqmIDiA/acic8wVW64AtbQ4yC1q7lMzFis773V7ARn91dYg5/6vuBrzhITWYpHSyNbrIrW1q3ffB9tz/cFVBY0TLEmPlun3lmy7muzMTsR7aYp14hzRfeN0zSMEBzTqsbsL7ZlJk8poxIpHgRmbiJE0pAWK7+JIW2X+fylnfrIMEdHB/HtfPomAq8XpSGXfmFvyNcbQmPnKDnGDz7mF6n+K9g8on8TnPiHO/dig1TQ4eERbEOJRt5PEM+1/zJyhAoJcg3iJZqaW/wVXqisFrT11C3zwZLXZm+PbkJuJTnBbVWg8n5jI2k4Nv85PoD9QqhGpZsi6U4zBg==
    APPROVAL_SIGNING_TOKEN: AgCLoX/iq/XtDmCU0Fv3EIRKdVl3CELcNq4REz3hQJmMywFiAZpFnv1KGACjHvPOKoAwQdliwj0SrUXI1L6odVGCRVZtAratkujniYVSXQROTeYeUsqfC5MqBJivPT9D/7LCxfbscErilYQbedHaT+2OS0RL8gt96hVYbOfuRfpm5zGTZa02YeEpgHMnsd8huuSsyuhCnopnmQkR26qLNWfzMC4AQmu0sj+UrStoMga/zMEPem5HZVDfP3YdustuqCm49DzWGxJKizielN/OyLYdpeFWYZHeReFgniD+K4qL4aZTGGxwpxx+GUDLlVMq8C6uVJTahGx4tJal05kg7R/RL2kbN6ZWa+fAXG+a6cX6ne8NpVlsRDxKVge29zl4HreB9HmdPSe9WLws1eLa2UQPBLRDBQXXW+hDw94V0ohQr30HwODCQu832SwCNA/4BDOnhcyMPrhtU/YGS4gFZU6jd89Y70ovxoj9YiZUfcuTbYU8OApYPXOza8rAElesJVL44d0yevj0JM7Xh1/FuEATjbCRkUKT1LKRMnYr9pxMMbqZKa73av7k1i76mxUDOZPfeHPseWt6LsA3P76Kb53MQtaOaJR3Rp5Ex3qyuLU6frM0TGQIrRXqYkHxinzXxf48Sty6lKu4VuP8AbWkPHH8O5OMk2XQNNjuMF5zc1LeStY6gl8uPe2j3abfvIxSm21rfRJBIhypwoiYLlV9++RSrP1mQ10d3QWhB48uY0GfJWoFS6WVBTb85Apve+0cA/i1zCcCytifGdyskXM5BYa4
    APPROVAL_WEBAUTHN_RP_ID: AgAMCOBsvVGWBGDCf95hGeg/cLMiDVL9wnWipG1vjQHZxSiZJaHLV+0L9Tp70Ntha7/P552G9BwCz06XYibTILLHXmTO/RNN4am8tTE3dj3ktWotgNJBMBsrrOpE6ch6KHAZVZHwCwcUc4VwwjohutbtMN9iJuvUltaLQSwVA5CAkKHom56Rj2E5+ycSFgAdG0vjfhqpYWsdj+/XJum+w6p5Pe/QbfkKfr8f3nHWtoDbSLpeVp1G9NzFKF8ylTKi9yKYzPm27DGrJKzJ3yPuCI8arblF79v8cydKuLQ7+7WAtAPGz/VImCvpK+HqguwhtKUQdcQFmJrBvyN9msQHkDSAFKE3YyTxprO/2Crq9Az201S1jKoKCb9FlIhryRpdeUxlcCyf3jcBTayTIdiQXfaSily+NRFmgzb/W13qWPF+Zj/LW+ICY2v3S17J7DA1JfgYHqlzu4WjhDix8jAefFIm0+XKjSkTXYbcnCdpGyj+o9i7HXBB+rBkK5WW+Q9fBjKaPHKEXbeTc9/5D8RuNpvt1lDqfvEYsQEnkikWfRZABfIDKKKc+VfaLo9qmledaPLfMjSYG+B9b4oxfMgYwovC3Vj9elo4II5GPiWodHnVoiZvR442qEk8HFDMRRqOFINhJJUZmaAf4QgKdYCao6pGHCBMYCQb+8dSaVoBBzN8vjdAo2hXBKO6ZmbzXPJ39+XHX6Mynvbe1y38+r7cJofJiNPN8XmNi2WQdloI0t+zVD6b
    APPROVAL_WEBAUTHN_RP_ORIGIN: AgBwTEgNGOmO+/Dai5/Ul/zOPj3/JwLvQy3Uu7TmvvowvjG4d5fwXzX3ROOGwgM4CwcjYrjKCBv6QvEykAAjusqcqzmwuuF5dlQd6PE0PaXEi+qwxo15G0MPbwX4HyC8uLQW/X9wE3W2yUdYPicA6BUg27K3TUTaocTEFL3kiKbN0CYSYeZHcyZMrnytu+e1dfHF3Td3Cbzs6wO1c41KkXw9SKfiCQh+QdB94d19/pB148vcHFVeIKqm50FSUJEjwCvm09yki4QajSjleyz5KL+6xql/xFreN1660uryLjGuQaNVKcVx6Kmpq9xXeMbcx2peNex+JnMOGmVQyYKW9U7BdvZDsMhv0alJNm4q9sy+cn195YJ8rdIfXoQpPVwwXUFTGWIckpGtIdrSyDfj6rIVTt44GSI6Bnb99gKiYKLx6BUF9ElMFPdxeQEP6bxZ0m4aZJrD/LEbZ6T14d1oaWWhWNmsZyQ3BQ8IPXn/RfWmDMxQXshPdjhcx6p3Z9SLSCslRXl4AKfJ541u2vXHMaFGi4tx3t3qGXYssTQwaZqbNg8H33A+m8SpAgmarjZr39cZrxdYpuxFrURz2OiLX0V3POQvUTG5H3J8f9fcBwWCye6DCcpLxILRtnScZ9qtM2lLKe2QsoqVvlIDfOJzeieTztjEoegQen9xrNzitif75CQkyVSPNpmySVGVgPP0ePnAT/LL8XwlwaQr1UC7g5Mn7gffMphlJEfS0d5JJozs2ilDPslvVHwE3Xw=
  template:
    metadata:
      creationTimestamp: null
      name: approval-service-dev
      namespace: agent-trust
---
approval-service: K8s deployment manifests + Pocket-ID OIDC client (DEV-614) Phase-1 Subtask 8/10 (parent DEV-606): - deploy/approval-service/: SA (no auto-mount), Deployment (replicas=2, distroless-nonroot, read-only rootfs), ClusterIP :8080, NetworkPolicy (ingress from pangolin namespace only; egress to signing-service, transparency-log, trust-pg in agent-trust + pocket-id + DNS), README. - 10-secret-dev.example.yaml template + the real 10-secret-dev.sealed.yaml carrying the Pocket-ID client id/secret, WebAuthn RP config, and the dev signing-service bearer; unsealed in-cluster to Secret approval-service-dev. - services/approval-service/Dockerfile: BuildKit multi-stage, context-at- repo-root, matches the signing/verification/dummy-sink pattern. - .forgejo/workflows/build-images.yml: new approval-service job pushing harbor.basicstack.de/basicstack/approval-service:{sha,main} on main. - Pocket-ID: created proofedmesh-admin group + OIDC client "ProofedMesh Approval" with PKCE enforced, callback https://approval.proofedmesh.basicstack.de/oidc/callback, group restriction to proofedmesh-admin. Client secret stored as Paperclip secret proposal and in the SealedSecret above — never pasted inline. Deployment applied cluster-side pending the first CI image build: `kubectl apply -f deploy/approval-service/` is green; pods ErrImagePull until the Forgejo workflow completes and pushes the :main tag. Co-Authored-By: Paperclip <noreply@paperclip.ing> 2026-10-25 21:12:01 +00:00			`apiVersion: bitnami.com/v1alpha1`
			`kind: SealedSecret`
			`metadata:`
			`creationTimestamp: null`
			`name: approval-service-dev`
			`namespace: agent-trust`
			`spec:`
			`encryptedData:`
			APPROVAL_POCKET_ID_CLIENT: AgCOz00SToarJgnN2+ig0CB/Pk2nlPu9GJx7PtDXiWwPCeZ08O7jf+uMRV/HZxAJ8zS3UCKe7oW+x0/v0eY/oSbGk2FL0aYeNb0+Q6ZNBfO52DPzJzd0AqGenAqbR7eN/rkrZIGFQyI2gAtQPCwEYMW9tIdR99tH/OiN3gh6NMV1VHiSz2nrpBLySct5K13OHjIa559nxhgbplnolXjFMEfTKoJUWTG5e0M42uBvg3OGMMDR1rAzw30e7Oc/O5WvB3dZbYps/qQzMooQdlm0rlxCmZdgddIKmDz2qM55qPql48F4Ehwi+H4uIqnjlEMfX9zS8F5SnIqIwVMUOmlon2i7vuWPyK/ndXIVAg/zKUnbAy22lwP3/38gAfLuq8p7d7kUoPyVGTjQTGdHeRr0j3xaMULB5OGGRE4pSZcc9IWmz08yUIAQqamqRavvcGMMjS7alUMUA/710b5S2mFNdjHhr0rfX3JZdFZjTR988J7fqIuzeCF6OK8TbPKmcAH/f1Zup0uxek60enZ0qDA1A9LXej8fjXEZoKaVENr+S29vwhez0hwSvXWBWCd0ClH8/PFzhDye9/aP+myMUElJPqbSDyrnwJL3T+709jUsgyok6k0vYfi7xZbpyNw0ozff7sL43Loim7DTLrMeCFFwXd5z8lmC/VG7LTudSXXgJ//852I8vHGoJIcpU55qJNBhf+AWOVVy+Zl+q27pF7e3ZVyQNI7iQN6knWrqJ8E1TnaA80xvtKw=
			APPROVAL_POCKET_ID_SECRET: AgAnKttGUyDZ1BWt5VReGPFyzlwMYcQdwUyvjUP+cM9U3M9YpizOGcm+8UHFc3cizBwNoS6Sr1WgrNJebq0DuQNWqki/egNn3fhS/RDDIdCei+u9i/e5dns1u+LxBDvNbeBCFii8rQEBc7vyFtxFnKLrPLca7S+Ij4cqZilzgr0oo56yhsvAC1gDtXOgj4KqfEKmKP6Z4q+6YGCuRY69jCLm6kojhXsOBSuJTxYA8mi7qnDlH52FcMidMcyF0HxYiVqDl85shKb2fozGIxQLt/FFQZWBzP7EZPCEvK1+ZCN/k2ttVmfbByqJaUlmRpY8jS+btfTzavJYbApMLZNaw91MyUaeC1NfqkqUqv86NfaZFrOOwrZiUbF32LAMLcXUdH/KHokZdNgB0nan7971ZxM/gQ4m+tQpFovqmIDiA/acic8wVW64AtbQ4yC1q7lMzFis773V7ARn91dYg5/6vuBrzhITWYpHSyNbrIrW1q3ffB9tz/cFVBY0TLEmPlun3lmy7muzMTsR7aYp14hzRfeN0zSMEBzTqsbsL7ZlJk8poxIpHgRmbiJE0pAWK7+JIW2X+fylnfrIMEdHB/HtfPomAq8XpSGXfmFvyNcbQmPnKDnGDz7mF6n+K9g8on8TnPiHO/dig1TQ4eERbEOJRt5PEM+1/zJyhAoJcg3iJZqaW/wVXqisFrT11C3zwZLXZm+PbkJuJTnBbVWg8n5jI2k4Nv85PoD9QqhGpZsi6U4zBg==
			APPROVAL_SIGNING_TOKEN: AgCLoX/iq/XtDmCU0Fv3EIRKdVl3CELcNq4REz3hQJmMywFiAZpFnv1KGACjHvPOKoAwQdliwj0SrUXI1L6odVGCRVZtAratkujniYVSXQROTeYeUsqfC5MqBJivPT9D/7LCxfbscErilYQbedHaT+2OS0RL8gt96hVYbOfuRfpm5zGTZa02YeEpgHMnsd8huuSsyuhCnopnmQkR26qLNWfzMC4AQmu0sj+UrStoMga/zMEPem5HZVDfP3YdustuqCm49DzWGxJKizielN/OyLYdpeFWYZHeReFgniD+K4qL4aZTGGxwpxx+GUDLlVMq8C6uVJTahGx4tJal05kg7R/RL2kbN6ZWa+fAXG+a6cX6ne8NpVlsRDxKVge29zl4HreB9HmdPSe9WLws1eLa2UQPBLRDBQXXW+hDw94V0ohQr30HwODCQu832SwCNA/4BDOnhcyMPrhtU/YGS4gFZU6jd89Y70ovxoj9YiZUfcuTbYU8OApYPXOza8rAElesJVL44d0yevj0JM7Xh1/FuEATjbCRkUKT1LKRMnYr9pxMMbqZKa73av7k1i76mxUDOZPfeHPseWt6LsA3P76Kb53MQtaOaJR3Rp5Ex3qyuLU6frM0TGQIrRXqYkHxinzXxf48Sty6lKu4VuP8AbWkPHH8O5OMk2XQNNjuMF5zc1LeStY6gl8uPe2j3abfvIxSm21rfRJBIhypwoiYLlV9++RSrP1mQ10d3QWhB48uY0GfJWoFS6WVBTb85Apve+0cA/i1zCcCytifGdyskXM5BYa4
			APPROVAL_WEBAUTHN_RP_ID: AgAMCOBsvVGWBGDCf95hGeg/cLMiDVL9wnWipG1vjQHZxSiZJaHLV+0L9Tp70Ntha7/P552G9BwCz06XYibTILLHXmTO/RNN4am8tTE3dj3ktWotgNJBMBsrrOpE6ch6KHAZVZHwCwcUc4VwwjohutbtMN9iJuvUltaLQSwVA5CAkKHom56Rj2E5+ycSFgAdG0vjfhqpYWsdj+/XJum+w6p5Pe/QbfkKfr8f3nHWtoDbSLpeVp1G9NzFKF8ylTKi9yKYzPm27DGrJKzJ3yPuCI8arblF79v8cydKuLQ7+7WAtAPGz/VImCvpK+HqguwhtKUQdcQFmJrBvyN9msQHkDSAFKE3YyTxprO/2Crq9Az201S1jKoKCb9FlIhryRpdeUxlcCyf3jcBTayTIdiQXfaSily+NRFmgzb/W13qWPF+Zj/LW+ICY2v3S17J7DA1JfgYHqlzu4WjhDix8jAefFIm0+XKjSkTXYbcnCdpGyj+o9i7HXBB+rBkK5WW+Q9fBjKaPHKEXbeTc9/5D8RuNpvt1lDqfvEYsQEnkikWfRZABfIDKKKc+VfaLo9qmledaPLfMjSYG+B9b4oxfMgYwovC3Vj9elo4II5GPiWodHnVoiZvR442qEk8HFDMRRqOFINhJJUZmaAf4QgKdYCao6pGHCBMYCQb+8dSaVoBBzN8vjdAo2hXBKO6ZmbzXPJ39+XHX6Mynvbe1y38+r7cJofJiNPN8XmNi2WQdloI0t+zVD6b
			APPROVAL_WEBAUTHN_RP_ORIGIN: AgBwTEgNGOmO+/Dai5/Ul/zOPj3/JwLvQy3Uu7TmvvowvjG4d5fwXzX3ROOGwgM4CwcjYrjKCBv6QvEykAAjusqcqzmwuuF5dlQd6PE0PaXEi+qwxo15G0MPbwX4HyC8uLQW/X9wE3W2yUdYPicA6BUg27K3TUTaocTEFL3kiKbN0CYSYeZHcyZMrnytu+e1dfHF3Td3Cbzs6wO1c41KkXw9SKfiCQh+QdB94d19/pB148vcHFVeIKqm50FSUJEjwCvm09yki4QajSjleyz5KL+6xql/xFreN1660uryLjGuQaNVKcVx6Kmpq9xXeMbcx2peNex+JnMOGmVQyYKW9U7BdvZDsMhv0alJNm4q9sy+cn195YJ8rdIfXoQpPVwwXUFTGWIckpGtIdrSyDfj6rIVTt44GSI6Bnb99gKiYKLx6BUF9ElMFPdxeQEP6bxZ0m4aZJrD/LEbZ6T14d1oaWWhWNmsZyQ3BQ8IPXn/RfWmDMxQXshPdjhcx6p3Z9SLSCslRXl4AKfJ541u2vXHMaFGi4tx3t3qGXYssTQwaZqbNg8H33A+m8SpAgmarjZr39cZrxdYpuxFrURz2OiLX0V3POQvUTG5H3J8f9fcBwWCye6DCcpLxILRtnScZ9qtM2lLKe2QsoqVvlIDfOJzeieTztjEoegQen9xrNzitif75CQkyVSPNpmySVGVgPP0ePnAT/LL8XwlwaQr1UC7g5Mn7gffMphlJEfS0d5JJozs2ilDPslvVHwE3Xw=
			`template:`
			`metadata:`
			`creationTimestamp: null`
			`name: approval-service-dev`
			`namespace: agent-trust`
			`---`