ServiceAccount, Deployment, Service, and NetworkPolicy per
sub-directory, matching the signing-service template (non-root,
read-only rootfs, distroless, agent-trust namespace).
verification-service — NetworkPolicy allows ingress only from
approval-service, testagent-transform, and dummy-sink, and egress
only to transparency-log, trust-pg, Pocket-ID JWKS (HTTPS/443),
and kube-dns.
dummy-sink — adds a 1Gi longhorn PVC `dummy-sink-data` mounted at
/data/dummy-sink, projected trust-api SA token at
/var/run/secrets/tokens/trust-api, Pocket-ID client creds from a
dev Secret, strategy Recreate (RWO PVC). NetworkPolicy allows
ingress from testagent-transform and egress to verification-service,
signing-service, transparency-log, HTTPS/443 (Pocket-ID OIDC), and
kube-dns.
build-images workflow — adds verification-service and dummy-sink
jobs mirroring signing-service's BuildKit + Harbor pipeline.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
