5d2bf73d84
Some checks failed
build-images / signing-service image (push) Successful in 23s
build-images / verification-service image (push) Successful in 48s
build-images / dummy-sink image (push) Successful in 49s
validate / JSON Schema (ajv) (push) Successful in 23s
validate / Rego (opa fmt + opa test) (push) Successful in 15s
phase1-smoke / Phase 1 end-to-end smoke (push) Successful in 1m0s
validate / DB (migrate up/down dry-run) (push) Successful in 24s
validate / Go (vet + test) (push) Has been cancelled
ServiceAccount, Deployment, Service, and NetworkPolicy per sub-directory, matching the signing-service template (non-root, read-only rootfs, distroless, agent-trust namespace). verification-service — NetworkPolicy allows ingress only from approval-service, testagent-transform, and dummy-sink, and egress only to transparency-log, trust-pg, Pocket-ID JWKS (HTTPS/443), and kube-dns. dummy-sink — adds a 1Gi longhorn PVC `dummy-sink-data` mounted at /data/dummy-sink, projected trust-api SA token at /var/run/secrets/tokens/trust-api, Pocket-ID client creds from a dev Secret, strategy Recreate (RWO PVC). NetworkPolicy allows ingress from testagent-transform and egress to verification-service, signing-service, transparency-log, HTTPS/443 (Pocket-ID OIDC), and kube-dns. build-images workflow — adds verification-service and dummy-sink jobs mirroring signing-service's BuildKit + Harbor pipeline. Co-Authored-By: Paperclip <noreply@paperclip.ing>
115 lines
4.2 KiB
Markdown
115 lines
4.2 KiB
Markdown
# dummy-sink — deployment
|
|
|
|
Kubernetes manifests for the ADR-0007 dummy-sink in the `agent-trust`
|
|
namespace. The namespace itself is created by
|
|
[`deploy/trillian/00-namespace.yaml`](../trillian/00-namespace.yaml);
|
|
this directory assumes that file (or an equivalent) is already applied.
|
|
|
|
## Layout
|
|
|
|
```
|
|
deploy/dummy-sink/
|
|
├── 00-serviceaccount.yaml — ServiceAccount (auto-mount off, projected token used)
|
|
├── 10-pvc.yaml — PVC dummy-sink-data (1Gi, longhorn, RWO)
|
|
├── 11-secret-dev.example.yaml — TEMPLATE for the dev-mode Secret
|
|
├── 20-deployment.yaml — Deployment (non-root, read-only rootfs, distroless)
|
|
├── 30-service.yaml — ClusterIP Service on :8083
|
|
├── 40-networkpolicy.yaml — ingress from testagent-transform,
|
|
│ egress to verification-service / signing-service / transparency-log
|
|
└── README.md — this file
|
|
```
|
|
|
|
## Apply order
|
|
|
|
```bash
|
|
kubectl apply -f deploy/trillian/00-namespace.yaml # if not yet applied
|
|
kubectl apply -f deploy/dummy-sink/00-serviceaccount.yaml
|
|
kubectl apply -f deploy/dummy-sink/10-pvc.yaml
|
|
# Create the dev Secret separately (see "Secret convention" below) — DO NOT
|
|
# commit the real values. The .example file is a template, not a secret.
|
|
kubectl apply -f deploy/dummy-sink/20-deployment.yaml
|
|
kubectl apply -f deploy/dummy-sink/30-service.yaml
|
|
kubectl apply -f deploy/dummy-sink/40-networkpolicy.yaml
|
|
```
|
|
|
|
Reach the sink in-cluster at:
|
|
|
|
```
|
|
http://dummy-sink.agent-trust.svc.cluster.local:8083
|
|
```
|
|
|
|
Health check (also used by Deployment probes):
|
|
|
|
```
|
|
GET /healthz → 200 {"status":"ok"}
|
|
```
|
|
|
|
Deliver endpoint (per ADR-0007 / DEV-611):
|
|
|
|
```
|
|
POST /api/v1/sink/dummy/deliver
|
|
Content-Type: application/json
|
|
```
|
|
|
|
## PVC
|
|
|
|
`dummy-sink-data` is a 1 Gi Longhorn RWO claim mounted at
|
|
`/data/dummy-sink`. The Deployment uses `strategy.type: Recreate`
|
|
because the PVC is `ReadWriteOnce` — a rolling update would try to
|
|
schedule a second pod against the same volume. Scaling past a single
|
|
replica requires an RWX storage class or per-pod PVCs; neither is in
|
|
Phase-1 scope.
|
|
|
|
## K8s secret convention
|
|
|
|
The dummy-sink reads one Secret, `dummy-sink-dev` (or
|
|
`dummy-sink-prod` for production), with the Pocket-ID client
|
|
credentials. Shape:
|
|
|
|
| Env key | Purpose |
|
|
| ------------------------- | ---------------------------------------------- |
|
|
| `POCKET_ID_ISSUER` | Pocket-ID OIDC issuer URL |
|
|
| `POCKET_ID_CLIENT_ID` | Pocket-ID client id for this agent |
|
|
| `POCKET_ID_CLIENT_SECRET` | Pocket-ID client secret for this agent |
|
|
| `POCKET_ID_AUDIENCE` | Expected `aud` claim (default `trust-api`) |
|
|
|
|
The second half of the double-identity contract (the projected
|
|
ServiceAccount token at `/var/run/secrets/tokens/trust-api`) is wired
|
|
by the Deployment's `projected` volume and does not require a Secret.
|
|
|
|
For the GitOps path, convert the created Secret to a SealedSecret and
|
|
commit the sealed form under the same filename as the example:
|
|
|
|
```bash
|
|
kubectl create secret generic dummy-sink-dev -n agent-trust \
|
|
--from-literal="POCKET_ID_ISSUER=https://auth.basicstack.de" \
|
|
--from-literal="POCKET_ID_CLIENT_ID=<id>" \
|
|
--from-literal="POCKET_ID_CLIENT_SECRET=<secret>" \
|
|
--from-literal="POCKET_ID_AUDIENCE=trust-api" \
|
|
--dry-run=client -o yaml | \
|
|
kubeseal --controller-namespace=sealed-secrets --format=yaml \
|
|
> deploy/dummy-sink/11-secret-dev.sealed.yaml
|
|
```
|
|
|
|
## NetworkPolicy
|
|
|
|
See `40-networkpolicy.yaml`. In short:
|
|
|
|
- **Ingress:** `testagent-transform` pods only (matched by
|
|
`app.kubernetes.io/name`).
|
|
- **Egress:** `verification-service` (:8084), `signing-service`
|
|
(:8081), `transparency-log` (:8080), external HTTPS/443 for the
|
|
Pocket-ID OIDC endpoint, DNS to `kube-dns`.
|
|
|
|
## Image
|
|
|
|
Images are built by `.forgejo/workflows/build-images.yml` on every push
|
|
to `main` and pushed to:
|
|
|
|
```
|
|
harbor.basicstack.de/basicstack/dummy-sink:<git-sha>
|
|
harbor.basicstack.de/basicstack/dummy-sink:main (floating)
|
|
```
|
|
|
|
The Deployment currently references `:dev`; a GitOps apply will pin it
|
|
to a `:<git-sha>` once the image build pipeline has produced one.
|