b52936ce9d
- Dockerfile: multi-stage (golang:1.23-alpine3.21 → distroless/static:nonroot), CGO off, trimpath, stripped, UID/GID 65532, read-only rootfs friendly. - deploy/signing-service/: ServiceAccount, Deployment (2 replicas, probes, tight SecurityContext), ClusterIP Service on :8081, NetworkPolicy (ingress from agent-trust, DNS egress), example Secret, and README with the full dev + prod secret convention. - .forgejo/workflows/build-images.yml: builds image on push + PR, pushes :<git-sha> + :main to harbor.basicstack.de on main pushes only. Clone pattern matches validate.yml (sha256 repo, manual git clone). - README updates: service README gains Deployment section; repo README layout now mentions services/signing-service, services/transparency-log, deploy/, and the new workflow. Scope matches DEV-605. OpenBao, OPA and Pocket-ID JWKS stay stubs and move in their own follow-up subtasks; the prod secret shape is documented so those subtasks can plug in without reshaping the Deployment. Co-Authored-By: Paperclip <noreply@paperclip.ing>
97 lines
2.9 KiB
YAML
97 lines
2.9 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: signing-service
|
|
namespace: agent-trust
|
|
labels:
|
|
app.kubernetes.io/name: signing-service
|
|
app.kubernetes.io/part-of: proofedmesh
|
|
app.kubernetes.io/component: trust-core
|
|
spec:
|
|
replicas: 2
|
|
revisionHistoryLimit: 5
|
|
strategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxSurge: 1
|
|
maxUnavailable: 0
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: signing-service
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: signing-service
|
|
app.kubernetes.io/part-of: proofedmesh
|
|
app.kubernetes.io/component: trust-core
|
|
spec:
|
|
serviceAccountName: signing-service
|
|
automountServiceAccountToken: true
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 65532
|
|
runAsGroup: 65532
|
|
fsGroup: 65532
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: signing-service
|
|
image: harbor.basicstack.de/basicstack/signing-service:dev
|
|
imagePullPolicy: IfNotPresent
|
|
args:
|
|
- "-listen=:8081"
|
|
- "-backend=memory"
|
|
- "-keys=trust-api/rate-change-signer-2026-q4"
|
|
- "-keys-from-env"
|
|
- "-bearers=$(SIGNING_BEARERS)"
|
|
env:
|
|
# Pulled from the dev Secret below; see deploy/signing-service/README.md
|
|
# for the full secret shape and the SealedSecret recipe.
|
|
- name: SIGNING_BEARERS
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: signing-service-dev
|
|
key: SIGNING_BEARERS
|
|
- name: KEY_TRUST_API_RATE_CHANGE_SIGNER_2026_Q4
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: signing-service-dev
|
|
key: KEY_TRUST_API_RATE_CHANGE_SIGNER_2026_Q4
|
|
ports:
|
|
- name: http
|
|
containerPort: 8081
|
|
protocol: TCP
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: http
|
|
initialDelaySeconds: 2
|
|
periodSeconds: 10
|
|
failureThreshold: 3
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: http
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 20
|
|
failureThreshold: 3
|
|
resources:
|
|
requests:
|
|
cpu: "50m"
|
|
memory: "64Mi"
|
|
limits:
|
|
cpu: "500m"
|
|
memory: "256Mi"
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
topologySpreadConstraints:
|
|
- maxSkew: 1
|
|
topologyKey: kubernetes.io/hostname
|
|
whenUnsatisfiable: ScheduleAnyway
|
|
labelSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: signing-service
|