5d2bf73d84
Some checks failed
build-images / signing-service image (push) Successful in 23s
build-images / verification-service image (push) Successful in 48s
build-images / dummy-sink image (push) Successful in 49s
validate / JSON Schema (ajv) (push) Successful in 23s
validate / Rego (opa fmt + opa test) (push) Successful in 15s
phase1-smoke / Phase 1 end-to-end smoke (push) Successful in 1m0s
validate / DB (migrate up/down dry-run) (push) Successful in 24s
validate / Go (vet + test) (push) Has been cancelled
ServiceAccount, Deployment, Service, and NetworkPolicy per sub-directory, matching the signing-service template (non-root, read-only rootfs, distroless, agent-trust namespace). verification-service — NetworkPolicy allows ingress only from approval-service, testagent-transform, and dummy-sink, and egress only to transparency-log, trust-pg, Pocket-ID JWKS (HTTPS/443), and kube-dns. dummy-sink — adds a 1Gi longhorn PVC `dummy-sink-data` mounted at /data/dummy-sink, projected trust-api SA token at /var/run/secrets/tokens/trust-api, Pocket-ID client creds from a dev Secret, strategy Recreate (RWO PVC). NetworkPolicy allows ingress from testagent-transform and egress to verification-service, signing-service, transparency-log, HTTPS/443 (Pocket-ID OIDC), and kube-dns. build-images workflow — adds verification-service and dummy-sink jobs mirroring signing-service's BuildKit + Harbor pipeline. Co-Authored-By: Paperclip <noreply@paperclip.ing>
28 lines
1.1 KiB
YAML
28 lines
1.1 KiB
YAML
# verification-service dev secret — EXAMPLE ONLY.
|
|
#
|
|
# This file is a template. The real cluster Secret MUST be created either
|
|
# as a SealedSecret (preferred, see deploy/verification-service/README.md)
|
|
# or applied imperatively with values that never land in the git repo.
|
|
#
|
|
# Secret shape (Phase 1):
|
|
# VERIFICATION_SIGNER_KEYS — comma- / newline-separated keyid=<enc>:<data>
|
|
# loaded into the in-memory keyring.
|
|
# Encodings: pem | hex | b64 | b64u.
|
|
#
|
|
# The verifier itself does not reach OpenBao Transit in Phase 1; it only
|
|
# needs the public halves of the approval and transform signers to
|
|
# validate DSSE envelopes it pulls from the transparency-log.
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: verification-service-dev
|
|
namespace: agent-trust
|
|
labels:
|
|
app.kubernetes.io/name: verification-service
|
|
app.kubernetes.io/part-of: proofedmesh
|
|
proofedmesh.basicstack.de/mode: dev
|
|
type: Opaque
|
|
stringData:
|
|
VERIFICATION_SIGNER_KEYS: |
|
|
trust-api/approval-signer-2026-q4=pem:REPLACE_WITH_PEM_PUBLIC_KEY
|
|
trust-api/agent-testagent-transform-2026-q4=hex:REPLACE_WITH_64_HEX_PUBLIC_KEY
|