5d2bf73d84
Some checks failed
build-images / signing-service image (push) Successful in 23s
build-images / verification-service image (push) Successful in 48s
build-images / dummy-sink image (push) Successful in 49s
validate / JSON Schema (ajv) (push) Successful in 23s
validate / Rego (opa fmt + opa test) (push) Successful in 15s
phase1-smoke / Phase 1 end-to-end smoke (push) Successful in 1m0s
validate / DB (migrate up/down dry-run) (push) Successful in 24s
validate / Go (vet + test) (push) Has been cancelled
ServiceAccount, Deployment, Service, and NetworkPolicy per sub-directory, matching the signing-service template (non-root, read-only rootfs, distroless, agent-trust namespace). verification-service — NetworkPolicy allows ingress only from approval-service, testagent-transform, and dummy-sink, and egress only to transparency-log, trust-pg, Pocket-ID JWKS (HTTPS/443), and kube-dns. dummy-sink — adds a 1Gi longhorn PVC `dummy-sink-data` mounted at /data/dummy-sink, projected trust-api SA token at /var/run/secrets/tokens/trust-api, Pocket-ID client creds from a dev Secret, strategy Recreate (RWO PVC). NetworkPolicy allows ingress from testagent-transform and egress to verification-service, signing-service, transparency-log, HTTPS/443 (Pocket-ID OIDC), and kube-dns. build-images workflow — adds verification-service and dummy-sink jobs mirroring signing-service's BuildKit + Harbor pipeline. Co-Authored-By: Paperclip <noreply@paperclip.ing>
30 lines
1.2 KiB
YAML
30 lines
1.2 KiB
YAML
# dummy-sink dev secret — EXAMPLE ONLY.
|
|
#
|
|
# This file is a template. The real cluster Secret MUST be created either
|
|
# as a SealedSecret (preferred, see deploy/dummy-sink/README.md) or
|
|
# applied imperatively with values that never land in the git repo.
|
|
#
|
|
# Secret shape (Phase 1):
|
|
# POCKET_ID_ISSUER — Pocket-ID OIDC issuer URL.
|
|
# POCKET_ID_CLIENT_ID — client id for this agent.
|
|
# POCKET_ID_CLIENT_SECRET — client secret for this agent.
|
|
# POCKET_ID_AUDIENCE — expected `aud` claim (defaults to trust-api).
|
|
#
|
|
# The projected SA token for the X-Workload-Token side is mounted from
|
|
# the pod's own ServiceAccount via a projected volume — no Secret
|
|
# required for that half of the double-identity contract.
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: dummy-sink-dev
|
|
namespace: agent-trust
|
|
labels:
|
|
app.kubernetes.io/name: dummy-sink
|
|
app.kubernetes.io/part-of: proofedmesh
|
|
proofedmesh.basicstack.de/mode: dev
|
|
type: Opaque
|
|
stringData:
|
|
POCKET_ID_ISSUER: "https://auth.basicstack.de"
|
|
POCKET_ID_CLIENT_ID: "REPLACE_WITH_POCKET_ID_CLIENT_ID"
|
|
POCKET_ID_CLIENT_SECRET: "REPLACE_WITH_POCKET_ID_CLIENT_SECRET"
|
|
POCKET_ID_AUDIENCE: "trust-api"
|