29 lines
1.1 KiB
YAML
29 lines
1.1 KiB
YAML
|
# verification-service dev secret — EXAMPLE ONLY.
|
||
|
|
#
|
||
|
|
# This file is a template. The real cluster Secret MUST be created either
|
||
|
|
# as a SealedSecret (preferred, see deploy/verification-service/README.md)
|
||
|
|
# or applied imperatively with values that never land in the git repo.
|
||
|
|
#
|
||
|
|
# Secret shape (Phase 1):
|
||
|
|
# VERIFICATION_SIGNER_KEYS — comma- / newline-separated keyid=<enc>:<data>
|
||
|
|
# loaded into the in-memory keyring.
|
||
|
|
# Encodings: pem | hex | b64 | b64u.
|
||
|
|
#
|
||
|
|
# The verifier itself does not reach OpenBao Transit in Phase 1; it only
|
||
|
|
# needs the public halves of the approval and transform signers to
|
||
|
|
# validate DSSE envelopes it pulls from the transparency-log.
|
||
|
|
apiVersion: v1
|
||
|
|
kind: Secret
|
||
|
|
metadata:
|
||
|
|
name: verification-service-dev
|
||
|
|
namespace: agent-trust
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: verification-service
|
||
|
|
app.kubernetes.io/part-of: proofedmesh
|
||
|
|
proofedmesh.basicstack.de/mode: dev
|
||
|
|
type: Opaque
|
||
|
|
stringData:
|
||
|
|
VERIFICATION_SIGNER_KEYS: |
|
||
|
|
trust-api/approval-signer-2026-q4=pem:REPLACE_WITH_PEM_PUBLIC_KEY
|
||
|
|
trust-api/agent-testagent-transform-2026-q4=hex:REPLACE_WITH_64_HEX_PUBLIC_KEY
|