30dd2f8b65
Wires the signing-service's production path for ProofedMesh Phase 1: the service now performs a double identity check (Pocket-ID OIDC JWT + K8s ServiceAccount TokenReview), reconciles both against the trust-api `agents` registry, and asks an OPA/Rego policy whether the caller may sign with the requested key_ref. Code - internal/token/pocket_id.go: OIDC-Discovery-backed JWKS validator with automatic kid rotation (coreos/go-oidc). - internal/token/k8s_tokenreview.go: hand-rolled TokenReview client; reads X-Workload-Token, posts to authentication.k8s.io/v1 via the pod's in-cluster SA token + CA. - internal/registry: Postgres resolver for the agents table + in-memory Static resolver for tests. - internal/policy/opa.go: OPA/rego StructuredDecider; input carries both lookups so the policy can enforce identity consistency AND the key_ref ↔ role mapping. - internal/httpapi/sign.go: new structured flow when Validator+TokenReviewer+Registry+StructuredPolicy are all wired; dev path (static bearers + AllowAll) remains intact. - cmd/signing-service/main.go: -pocket-id-issuer, -pocket-id-audience, -k8s-tokenreview, -registry-dsn, -policy-bundle flags. Policy - policies/sinks/signing_service.rego: identities_agree + key_ref_matches_role rules; agent → key_ref prefix map covers approval-service, testagent-transform, dummy-sink. Deploy - deploy/signing-service/01-rbac.yaml: ClusterRole with tokenreviews.create + binding to the signing-service SA. - deploy/signing-service/20-deployment.yaml: adds POCKET_ID_ISSUER, POCKET_ID_AUDIENCE, TRUST_PG_DSN env, projected SA token volume, OPA policy ConfigMap mount, structured flags. - deploy/signing-service/00-serviceaccount.yaml: disables default auto-mount; a projected volume is used. - deploy/signing-service/README.md: documents prod flags + ConfigMap generation. Tests - httptest-mock Pocket-ID (OIDC discovery + JWKS, kid rotation), StaticTokenReviewer fake, Static registry, real Rego policy. - Happy paths: Approval-Service → trust-api/approval-signer-2026-q4; testagent-transform → trust-api/agent-testagent-transform-2026-q4. - Denies: registry mismatch, wrong key_ref for role, missing / bad workload token, bad Pocket-ID token, kid rotation. Co-Authored-By: Paperclip <noreply@paperclip.ing>
45 lines
1.6 KiB
Docker
45 lines
1.6 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
|
|
# ---------- build ----------
|
|
FROM golang:1.23-alpine3.21 AS build
|
|
|
|
ENV CGO_ENABLED=0 \
|
|
GOOS=linux \
|
|
GOFLAGS="-trimpath"
|
|
|
|
WORKDIR /src
|
|
|
|
# The image reproduces the repo layout under /src so Go module paths and
|
|
# the OPA policy's relative location (`../../../../policies/sinks/...`
|
|
# in tests) line up both in CI and inside the image.
|
|
COPY services/signing-service/go.mod services/signing-service/go.sum ./services/signing-service/
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
cd services/signing-service && go mod download
|
|
|
|
COPY services/signing-service/ ./services/signing-service/
|
|
# The OPA Rego policy ships with the image for dev / smoke runs. GitOps
|
|
# mounts it from a ConfigMap at /etc/signing-service/policies at runtime
|
|
# and wins over the baked-in copy.
|
|
COPY policies/sinks/signing_service.rego ./policies/sinks/signing_service.rego
|
|
|
|
WORKDIR /src/services/signing-service
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
go vet ./... && \
|
|
go test ./... && \
|
|
go build -ldflags="-s -w" -o /out/signing-service ./cmd/signing-service
|
|
|
|
# ---------- runtime ----------
|
|
# Distroless static+nonroot: no shell, no package manager, UID/GID 65532.
|
|
# gcr.io/distroless/static-debian12:nonroot pins to the latest nonroot
|
|
# variant; CI tags images by git sha so this is reproducible at the point
|
|
# of build.
|
|
FROM gcr.io/distroless/static-debian12:nonroot
|
|
|
|
COPY --from=build /out/signing-service /signing-service
|
|
|
|
USER 65532:65532
|
|
EXPOSE 8081
|
|
ENTRYPOINT ["/signing-service"]
|
|
CMD ["-listen=:8081", "-backend=memory"]
|