# verification-service — deployment

Kubernetes manifests for the ADR-0006 verification-service in the
`agent-trust` namespace. The namespace itself is created by
[`deploy/trillian/00-namespace.yaml`](../trillian/00-namespace.yaml);
this directory assumes that file (or an equivalent) is already applied.

## Layout

```
deploy/verification-service/
├── 00-serviceaccount.yaml       — ServiceAccount (auto-mount off)
├── 10-secret-dev.example.yaml   — TEMPLATE for the dev-mode Secret
├── 20-deployment.yaml           — Deployment (non-root, read-only rootfs, distroless)
├── 30-service.yaml              — ClusterIP Service on :8084
├── 40-networkpolicy.yaml        — ingress from approval-service / testagent-transform / dummy-sink,
│                                  egress to TLog + trust-pg + Pocket-ID JWKS
└── README.md                    — this file
```

## Apply order

```bash
kubectl apply -f deploy/trillian/00-namespace.yaml  # if not yet applied
kubectl apply -f deploy/verification-service/00-serviceaccount.yaml
# Create the dev Secret separately (see "Secret convention" below) — DO NOT
# commit the real values. The .example file is a template, not a secret.
kubectl apply -f deploy/verification-service/20-deployment.yaml
kubectl apply -f deploy/verification-service/30-service.yaml
kubectl apply -f deploy/verification-service/40-networkpolicy.yaml
```

Reach the service in-cluster at:

```
http://verification-service.agent-trust.svc.cluster.local:8084
```

Health check (also used by Deployment probes):

```
GET /healthz → 200 {"status":"ok"}
```

Verify endpoint (per ADR-0006 / DEV-612):

```
POST /api/v1/verify/chain
Content-Type: application/json
```

## K8s secret convention

The verification-service only reads one Secret — `verification-service-dev`
(or `verification-service-prod` when the key rotation uses production
material). The Secret shape is a single key, `VERIFICATION_SIGNER_KEYS`,
whose value is the comma- or newline-separated keyid=`<enc>:<data>` spec
documented in `services/verification-service/README.md`.

For the GitOps path, convert the created Secret to a SealedSecret with
`kubeseal` and commit the sealed form under the same filename as the
example:

```bash
kubectl create secret generic verification-service-dev -n agent-trust \
  --from-file=VERIFICATION_SIGNER_KEYS=./signer-keys.spec \
  --dry-run=client -o yaml | \
  kubeseal --controller-namespace=sealed-secrets --format=yaml \
    > deploy/verification-service/10-secret-dev.sealed.yaml
```

## NetworkPolicy

See `40-networkpolicy.yaml`. In short:

- **Ingress:** `approval-service`, `testagent-transform`, `dummy-sink`
  pods (matched by `app.kubernetes.io/name`).
- **Egress:** `transparency-log` (:8080), `trust-pg` (:5432), external
  HTTPS/443 for the Pocket-ID JWKS, DNS to `kube-dns`.

## Image

Images are built by `.forgejo/workflows/build-images.yml` on every push
to `main` and pushed to:

```
harbor.basicstack.de/basicstack/verification-service:<git-sha>
harbor.basicstack.de/basicstack/verification-service:main      (floating)
```

The Deployment currently references `:dev`; a GitOps apply will pin it
to a `:<git-sha>` once the image build pipeline has produced one.