b52936ce9d
- Dockerfile: multi-stage (golang:1.23-alpine3.21 → distroless/static:nonroot), CGO off, trimpath, stripped, UID/GID 65532, read-only rootfs friendly. - deploy/signing-service/: ServiceAccount, Deployment (2 replicas, probes, tight SecurityContext), ClusterIP Service on :8081, NetworkPolicy (ingress from agent-trust, DNS egress), example Secret, and README with the full dev + prod secret convention. - .forgejo/workflows/build-images.yml: builds image on push + PR, pushes :<git-sha> + :main to harbor.basicstack.de on main pushes only. Clone pattern matches validate.yml (sha256 repo, manual git clone). - README updates: service README gains Deployment section; repo README layout now mentions services/signing-service, services/transparency-log, deploy/, and the new workflow. Scope matches DEV-605. OpenBao, OPA and Pocket-ID JWKS stay stubs and move in their own follow-up subtasks; the prod secret shape is documented so those subtasks can plug in without reshaping the Deployment. Co-Authored-By: Paperclip <noreply@paperclip.ing>
51 lines
1.6 KiB
YAML
51 lines
1.6 KiB
YAML
# NetworkPolicy for signing-service.
|
|
#
|
|
# Cluster-wide NetworkPolicy enforcement is already active on BasicStack
|
|
# (see cluster memory on NetworkPolicy activation). Any pod in agent-trust
|
|
# without a policy is isolated by default; this file is the explicit
|
|
# allow-list for signing-service.
|
|
#
|
|
# Ingress: anyone in agent-trust (admin-api, attest-reconciler, transparency-log)
|
|
# plus future callers reaching through an in-cluster ingress controller.
|
|
# Egress: DNS (kube-system/coredns), and later the OpenBao Transit namespace
|
|
# and Pocket ID (JWKS) when those backends are wired. For now the
|
|
# service only needs DNS egress — the memory backend and static
|
|
# validator are self-contained.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: signing-service
|
|
namespace: agent-trust
|
|
labels:
|
|
app.kubernetes.io/name: signing-service
|
|
app.kubernetes.io/part-of: proofedmesh
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: signing-service
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
name: agent-trust
|
|
ports:
|
|
- port: 8081
|
|
protocol: TCP
|
|
# Future: add admin-api / app namespaces here once they are deployed and
|
|
# labelled. Keep the list conservative — add on demand, not speculatively.
|
|
egress:
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
podSelector:
|
|
matchLabels:
|
|
k8s-app: kube-dns
|
|
ports:
|
|
- port: 53
|
|
protocol: UDP
|
|
- port: 53
|
|
protocol: TCP
|