2026-10-04 21:40:19 +02:00
|
|
|
{
|
|
|
|
|
"apiVersion": "v1",
|
|
|
|
|
"kind": "List",
|
|
|
|
|
"items": [
|
|
|
|
|
{
|
|
|
|
|
"apiVersion": "v1",
|
|
|
|
|
"kind": "ServiceAccount",
|
|
|
|
|
"metadata": {
|
|
|
|
|
"name": "review",
|
|
|
|
|
"namespace": "informed-decision",
|
|
|
|
|
"annotations": {
|
|
|
|
|
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"automountServiceAccountToken": false
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"apiVersion": "v1",
|
|
|
|
|
"kind": "PersistentVolumeClaim",
|
|
|
|
|
"metadata": {
|
|
|
|
|
"name": "informed-decision-data",
|
|
|
|
|
"namespace": "informed-decision",
|
|
|
|
|
"annotations": {
|
|
|
|
|
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"spec": {
|
|
|
|
|
"accessModes": [
|
|
|
|
|
"ReadWriteOnce"
|
|
|
|
|
],
|
|
|
|
|
"storageClassName": "local-path",
|
|
|
|
|
"resources": {
|
|
|
|
|
"requests": {
|
|
|
|
|
"storage": "1Gi"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"apiVersion": "v1",
|
|
|
|
|
"kind": "ConfigMap",
|
|
|
|
|
"metadata": {
|
2026-10-11 01:12:23 +02:00
|
|
|
"name": "informed-decision-runtime-6c221878d051",
|
2026-10-04 21:40:19 +02:00
|
|
|
"namespace": "informed-decision",
|
|
|
|
|
"annotations": {
|
|
|
|
|
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"immutable": true,
|
|
|
|
|
"data": {
|
2026-10-11 01:12:23 +02:00
|
|
|
"runtime.json": "{\"approval_origin\":\"http://approval-engine.approval-engine.svc.cluster.local:8080\",\"audit\":{\"origin\":\"http://audit-core.audit-core.svc.cluster.local:8080\",\"sender_token_file\":\"/var/run/secrets/informed-decision/audit/token\"},\"evidence_db\":\"/data/private/review.sqlite\",\"intake_attributes\":true,\"intake_delivery\":{\"hub_origin\":\"http://state-hub.state-hub.svc.cluster.local:8000\"},\"lifecycle_delivery\":true,\"lifecycle_policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-lifecycle.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.lifecycle\",\"package_digest\":\"sha256:da01e045fc108adec6b489e5d51f7e57366793016c5a64776963780a6aae457c\",\"version\":\"v2\"},\"ordinary_approval_ids\":[\"2ce76d7f-01c3-4b63-8476-8d1230679769\",\"c2af4bcf-15b4-4305-aac1-acc7e4dcb099\",\"dc22666a-d5d7-46bc-9490-ebe9fe09dc38\"],\"policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.compact-sitting\",\"package_digest\":\"sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873\",\"version\":\"v13\"},\"schema\":\"informed-decision.review-runtime.v1\",\"workload_api\":{\"intake\":{\"groups_file\":\"/workload-registry/review-groups.json\",\"secret_file\":\"/var/run/secrets/informed-decision/requester/client-secret\",\"submitters_file\":\"/workload-registry/intake-submitters.json\"},\"lifecycle_callers_file\":\"/workload-registry/lifecycle-callers.json\",\"token_review\":{\"ca_file\":\"/var/run/secrets/informed-decision/kubernetes/ca.crt\",\"origin\":\"https://kubernetes.default.svc:443\",\"token_file\":\"/var/run/secrets/informed-decision/kubernetes/token\"}}}"
|
2026-10-04 21:40:19 +02:00
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"apiVersion": "apps/v1",
|
|
|
|
|
"kind": "Deployment",
|
|
|
|
|
"metadata": {
|
|
|
|
|
"name": "informed-decision",
|
|
|
|
|
"namespace": "informed-decision",
|
|
|
|
|
"annotations": {
|
|
|
|
|
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"spec": {
|
|
|
|
|
"replicas": 1,
|
|
|
|
|
"strategy": {
|
|
|
|
|
"type": "Recreate"
|
|
|
|
|
},
|
|
|
|
|
"progressDeadlineSeconds": 600,
|
|
|
|
|
"selector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"app.kubernetes.io/name": "informed-decision"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"template": {
|
|
|
|
|
"metadata": {
|
|
|
|
|
"labels": {
|
|
|
|
|
"app.kubernetes.io/name": "informed-decision",
|
|
|
|
|
"app.kubernetes.io/component": "review"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"spec": {
|
|
|
|
|
"automountServiceAccountToken": false,
|
|
|
|
|
"serviceAccountName": "review",
|
|
|
|
|
"terminationGracePeriodSeconds": 45,
|
|
|
|
|
"securityContext": {
|
|
|
|
|
"runAsNonRoot": true,
|
|
|
|
|
"runAsUser": 10001,
|
|
|
|
|
"runAsGroup": 10001,
|
|
|
|
|
"fsGroup": 10001,
|
|
|
|
|
"fsGroupChangePolicy": "OnRootMismatch",
|
|
|
|
|
"seccompProfile": {
|
|
|
|
|
"type": "RuntimeDefault"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"containers": [
|
|
|
|
|
{
|
|
|
|
|
"name": "informed-decision",
|
2026-10-11 12:37:05 +02:00
|
|
|
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
2026-10-04 21:40:19 +02:00
|
|
|
"securityContext": {
|
|
|
|
|
"allowPrivilegeEscalation": false,
|
|
|
|
|
"readOnlyRootFilesystem": true,
|
|
|
|
|
"capabilities": {
|
|
|
|
|
"drop": [
|
|
|
|
|
"ALL"
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"env": [
|
|
|
|
|
{
|
|
|
|
|
"name": "INFD_KEYCAPE_ISSUER",
|
|
|
|
|
"value": "https://kc.coulomb.social"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "INFD_CONTAINER_CONFIG",
|
|
|
|
|
"value": "/configuration/runtime.json"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"ports": [
|
|
|
|
|
{
|
|
|
|
|
"name": "http",
|
|
|
|
|
"containerPort": 8080
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "workload",
|
|
|
|
|
"containerPort": 8081
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"startupProbe": {
|
|
|
|
|
"httpGet": {
|
|
|
|
|
"path": "/healthz",
|
|
|
|
|
"port": "http"
|
|
|
|
|
},
|
|
|
|
|
"periodSeconds": 10,
|
|
|
|
|
"timeoutSeconds": 2,
|
|
|
|
|
"failureThreshold": 12
|
|
|
|
|
},
|
|
|
|
|
"readinessProbe": {
|
|
|
|
|
"httpGet": {
|
|
|
|
|
"path": "/healthz",
|
|
|
|
|
"port": "http"
|
|
|
|
|
},
|
|
|
|
|
"periodSeconds": 10,
|
|
|
|
|
"timeoutSeconds": 2
|
|
|
|
|
},
|
|
|
|
|
"livenessProbe": {
|
|
|
|
|
"httpGet": {
|
|
|
|
|
"path": "/healthz",
|
|
|
|
|
"port": "http"
|
|
|
|
|
},
|
|
|
|
|
"periodSeconds": 10,
|
|
|
|
|
"timeoutSeconds": 2
|
|
|
|
|
},
|
|
|
|
|
"resources": {
|
|
|
|
|
"requests": {
|
|
|
|
|
"cpu": "5m",
|
|
|
|
|
"memory": "64Mi"
|
|
|
|
|
},
|
|
|
|
|
"limits": {
|
|
|
|
|
"cpu": "500m",
|
|
|
|
|
"memory": "256Mi"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"volumeMounts": [
|
|
|
|
|
{
|
|
|
|
|
"name": "data",
|
|
|
|
|
"mountPath": "/data"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "runtime",
|
|
|
|
|
"mountPath": "/run/informed-decision"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "tmp",
|
|
|
|
|
"mountPath": "/tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "configuration",
|
|
|
|
|
"mountPath": "/configuration",
|
|
|
|
|
"readOnly": true
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "caller",
|
|
|
|
|
"mountPath": "/var/run/secrets/informed-decision/policy",
|
|
|
|
|
"readOnly": true
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "audit",
|
|
|
|
|
"mountPath": "/var/run/secrets/informed-decision/audit",
|
|
|
|
|
"readOnly": true
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "kubernetes-api",
|
|
|
|
|
"mountPath": "/var/run/secrets/informed-decision/kubernetes",
|
|
|
|
|
"readOnly": true
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "workload-registry",
|
|
|
|
|
"mountPath": "/workload-registry",
|
|
|
|
|
"readOnly": true
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "sitting-requester",
|
|
|
|
|
"mountPath": "/var/run/secrets/informed-decision/requester",
|
|
|
|
|
"readOnly": true
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"volumes": [
|
|
|
|
|
{
|
|
|
|
|
"name": "data",
|
|
|
|
|
"persistentVolumeClaim": {
|
|
|
|
|
"claimName": "informed-decision-data"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "runtime",
|
|
|
|
|
"emptyDir": {
|
|
|
|
|
"medium": "Memory",
|
|
|
|
|
"sizeLimit": "16Mi"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "tmp",
|
|
|
|
|
"emptyDir": {
|
|
|
|
|
"medium": "Memory",
|
|
|
|
|
"sizeLimit": "16Mi"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "configuration",
|
|
|
|
|
"configMap": {
|
2026-10-11 01:12:23 +02:00
|
|
|
"name": "informed-decision-runtime-6c221878d051",
|
2026-10-04 21:40:19 +02:00
|
|
|
"defaultMode": 292
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "caller",
|
|
|
|
|
"projected": {
|
|
|
|
|
"defaultMode": 288,
|
|
|
|
|
"sources": [
|
|
|
|
|
{
|
|
|
|
|
"serviceAccountToken": {
|
|
|
|
|
"path": "token",
|
|
|
|
|
"audience": "flex-auth",
|
|
|
|
|
"expirationSeconds": 3600
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "audit",
|
|
|
|
|
"secret": {
|
|
|
|
|
"secretName": "informed-decision-audit",
|
|
|
|
|
"defaultMode": 288,
|
|
|
|
|
"items": [
|
|
|
|
|
{
|
|
|
|
|
"key": "token",
|
|
|
|
|
"path": "token"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "kubernetes-api",
|
|
|
|
|
"projected": {
|
|
|
|
|
"defaultMode": 288,
|
|
|
|
|
"sources": [
|
|
|
|
|
{
|
|
|
|
|
"serviceAccountToken": {
|
|
|
|
|
"path": "token",
|
|
|
|
|
"expirationSeconds": 600
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"configMap": {
|
|
|
|
|
"name": "kube-root-ca.crt",
|
|
|
|
|
"items": [
|
|
|
|
|
{
|
|
|
|
|
"key": "ca.crt",
|
|
|
|
|
"path": "ca.crt"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "workload-registry",
|
|
|
|
|
"configMap": {
|
|
|
|
|
"name": "informed-decision-workload-registry",
|
|
|
|
|
"defaultMode": 292
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "sitting-requester",
|
|
|
|
|
"secret": {
|
|
|
|
|
"secretName": "informed-decision-sitting-requester",
|
|
|
|
|
"defaultMode": 288,
|
|
|
|
|
"optional": false,
|
|
|
|
|
"items": [
|
|
|
|
|
{
|
|
|
|
|
"key": "client-secret",
|
|
|
|
|
"path": "client-secret"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"apiVersion": "v1",
|
|
|
|
|
"kind": "Service",
|
|
|
|
|
"metadata": {
|
|
|
|
|
"name": "informed-decision",
|
|
|
|
|
"namespace": "informed-decision",
|
|
|
|
|
"annotations": {
|
|
|
|
|
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"spec": {
|
|
|
|
|
"type": "ClusterIP",
|
|
|
|
|
"selector": {
|
|
|
|
|
"app.kubernetes.io/name": "informed-decision",
|
|
|
|
|
"app.kubernetes.io/component": "review"
|
|
|
|
|
},
|
|
|
|
|
"ports": [
|
|
|
|
|
{
|
|
|
|
|
"name": "http",
|
|
|
|
|
"port": 80,
|
|
|
|
|
"targetPort": "http",
|
|
|
|
|
"protocol": "TCP"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"apiVersion": "networking.k8s.io/v1",
|
|
|
|
|
"kind": "NetworkPolicy",
|
|
|
|
|
"metadata": {
|
|
|
|
|
"name": "informed-decision-review",
|
|
|
|
|
"namespace": "informed-decision",
|
|
|
|
|
"annotations": {
|
|
|
|
|
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"spec": {
|
|
|
|
|
"podSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"app.kubernetes.io/name": "informed-decision",
|
|
|
|
|
"app.kubernetes.io/component": "review"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"policyTypes": [
|
|
|
|
|
"Ingress",
|
|
|
|
|
"Egress"
|
|
|
|
|
],
|
|
|
|
|
"ingress": [
|
|
|
|
|
{
|
|
|
|
|
"from": [
|
|
|
|
|
{
|
|
|
|
|
"namespaceSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"kubernetes.io/metadata.name": "kube-system"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"podSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"app.kubernetes.io/name": "traefik"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"ports": [
|
|
|
|
|
{
|
|
|
|
|
"protocol": "TCP",
|
|
|
|
|
"port": 8080
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"from": [
|
|
|
|
|
{
|
|
|
|
|
"namespaceSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"kubernetes.io/metadata.name": "state-hub"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"podSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"app.kubernetes.io/name": "state-hub"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"ports": [
|
|
|
|
|
{
|
|
|
|
|
"protocol": "TCP",
|
|
|
|
|
"port": 8081
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"egress": [
|
|
|
|
|
{
|
|
|
|
|
"to": [
|
|
|
|
|
{
|
|
|
|
|
"namespaceSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"kubernetes.io/metadata.name": "kube-system"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"podSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"k8s-app": "kube-dns"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"ports": [
|
|
|
|
|
{
|
|
|
|
|
"protocol": "UDP",
|
|
|
|
|
"port": 53
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"protocol": "TCP",
|
|
|
|
|
"port": 53
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"to": [
|
|
|
|
|
{
|
|
|
|
|
"namespaceSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"kubernetes.io/metadata.name": "approval-engine"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"podSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"app.kubernetes.io/name": "approval-engine"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"namespaceSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"kubernetes.io/metadata.name": "audit-core"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"podSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"app.kubernetes.io/name": "audit-core"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"namespaceSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"kubernetes.io/metadata.name": "flex-auth"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"podSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"app.kubernetes.io/name": "flex-auth-informed-decision-sitting"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"namespaceSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"kubernetes.io/metadata.name": "flex-auth"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"podSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"app.kubernetes.io/name": "flex-auth-informed-decision-lifecycle"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"ports": [
|
|
|
|
|
{
|
|
|
|
|
"protocol": "TCP",
|
|
|
|
|
"port": 8080
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"to": [
|
|
|
|
|
{
|
|
|
|
|
"namespaceSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"kubernetes.io/metadata.name": "kube-system"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"podSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"app.kubernetes.io/name": "traefik"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"ports": [
|
|
|
|
|
{
|
|
|
|
|
"protocol": "TCP",
|
|
|
|
|
"port": 8443
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"to": [
|
|
|
|
|
{
|
|
|
|
|
"ipBlock": {
|
|
|
|
|
"cidr": "92.205.62.239/32"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"ports": [
|
|
|
|
|
{
|
|
|
|
|
"protocol": "TCP",
|
|
|
|
|
"port": 443
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"to": [
|
|
|
|
|
{
|
|
|
|
|
"namespaceSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"kubernetes.io/metadata.name": "state-hub"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"podSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"app.kubernetes.io/name": "state-hub"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"ports": [
|
|
|
|
|
{
|
|
|
|
|
"protocol": "TCP",
|
|
|
|
|
"port": 8000
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"to": [
|
|
|
|
|
{
|
|
|
|
|
"ipBlock": {
|
|
|
|
|
"cidr": "10.43.0.1/32"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"ports": [
|
|
|
|
|
{
|
|
|
|
|
"protocol": "TCP",
|
|
|
|
|
"port": 443
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"to": [
|
|
|
|
|
{
|
|
|
|
|
"ipBlock": {
|
|
|
|
|
"cidr": "92.205.62.239/32"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"ports": [
|
|
|
|
|
{
|
|
|
|
|
"protocol": "TCP",
|
|
|
|
|
"port": 6443
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"apiVersion": "v1",
|
|
|
|
|
"kind": "Service",
|
|
|
|
|
"metadata": {
|
|
|
|
|
"name": "informed-decision-workload",
|
|
|
|
|
"namespace": "informed-decision",
|
|
|
|
|
"annotations": {
|
|
|
|
|
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"spec": {
|
|
|
|
|
"type": "ClusterIP",
|
|
|
|
|
"selector": {
|
|
|
|
|
"app.kubernetes.io/name": "informed-decision",
|
|
|
|
|
"app.kubernetes.io/component": "review"
|
|
|
|
|
},
|
|
|
|
|
"ports": [
|
|
|
|
|
{
|
|
|
|
|
"name": "workload",
|
|
|
|
|
"port": 8081,
|
|
|
|
|
"targetPort": "workload",
|
|
|
|
|
"protocol": "TCP"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"apiVersion": "rbac.authorization.k8s.io/v1",
|
|
|
|
|
"kind": "ClusterRole",
|
|
|
|
|
"metadata": {
|
|
|
|
|
"name": "informed-decision-tokenreview",
|
|
|
|
|
"annotations": {
|
|
|
|
|
"informed-decision.coulomb.social/admission": "proposal; INFD-WP-0007/INFD-WP-0005 owner review required"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"rules": [
|
|
|
|
|
{
|
|
|
|
|
"apiGroups": [
|
|
|
|
|
"authentication.k8s.io"
|
|
|
|
|
],
|
|
|
|
|
"resources": [
|
|
|
|
|
"tokenreviews"
|
|
|
|
|
],
|
|
|
|
|
"verbs": [
|
|
|
|
|
"create"
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"apiVersion": "rbac.authorization.k8s.io/v1",
|
|
|
|
|
"kind": "ClusterRoleBinding",
|
|
|
|
|
"metadata": {
|
|
|
|
|
"name": "informed-decision-tokenreview",
|
|
|
|
|
"annotations": {
|
|
|
|
|
"informed-decision.coulomb.social/admission": "proposal; INFD-WP-0007/INFD-WP-0005 owner review required"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"roleRef": {
|
|
|
|
|
"apiGroup": "rbac.authorization.k8s.io",
|
|
|
|
|
"kind": "ClusterRole",
|
|
|
|
|
"name": "informed-decision-tokenreview"
|
|
|
|
|
},
|
|
|
|
|
"subjects": [
|
|
|
|
|
{
|
|
|
|
|
"kind": "ServiceAccount",
|
|
|
|
|
"name": "review",
|
|
|
|
|
"namespace": "informed-decision"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"apiVersion": "networking.k8s.io/v1",
|
|
|
|
|
"kind": "NetworkPolicy",
|
|
|
|
|
"metadata": {
|
|
|
|
|
"name": "informed-decision-review-ingress",
|
|
|
|
|
"namespace": "approval-engine",
|
|
|
|
|
"annotations": {
|
|
|
|
|
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08",
|
|
|
|
|
"informed-decision.coulomb.social/owner-review": "APPROVAL-WP-0002-T01"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"spec": {
|
|
|
|
|
"podSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"app.kubernetes.io/name": "approval-engine"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"policyTypes": [
|
|
|
|
|
"Ingress"
|
|
|
|
|
],
|
|
|
|
|
"ingress": [
|
|
|
|
|
{
|
|
|
|
|
"from": [
|
|
|
|
|
{
|
|
|
|
|
"namespaceSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"kubernetes.io/metadata.name": "informed-decision"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"podSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"app.kubernetes.io/name": "informed-decision",
|
|
|
|
|
"app.kubernetes.io/component": "review"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"ports": [
|
|
|
|
|
{
|
|
|
|
|
"protocol": "TCP",
|
|
|
|
|
"port": 8080
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"apiVersion": "networking.k8s.io/v1",
|
|
|
|
|
"kind": "NetworkPolicy",
|
|
|
|
|
"metadata": {
|
|
|
|
|
"name": "informed-decision-review-ingress",
|
|
|
|
|
"namespace": "flex-auth",
|
|
|
|
|
"annotations": {
|
|
|
|
|
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08",
|
|
|
|
|
"informed-decision.coulomb.social/owner-review": "INFD-WP-0001-T08 policy-owner return"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"spec": {
|
|
|
|
|
"podSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"app.kubernetes.io/name": "flex-auth-informed-decision-sitting"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"policyTypes": [
|
|
|
|
|
"Ingress"
|
|
|
|
|
],
|
|
|
|
|
"ingress": [
|
|
|
|
|
{
|
|
|
|
|
"from": [
|
|
|
|
|
{
|
|
|
|
|
"namespaceSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"kubernetes.io/metadata.name": "informed-decision"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"podSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"app.kubernetes.io/name": "informed-decision",
|
|
|
|
|
"app.kubernetes.io/component": "review"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"ports": [
|
|
|
|
|
{
|
|
|
|
|
"protocol": "TCP",
|
|
|
|
|
"port": 8080
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"apiVersion": "networking.k8s.io/v1",
|
|
|
|
|
"kind": "NetworkPolicy",
|
|
|
|
|
"metadata": {
|
|
|
|
|
"name": "informed-decision-lifecycle-ingress",
|
|
|
|
|
"namespace": "flex-auth",
|
|
|
|
|
"annotations": {
|
|
|
|
|
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08",
|
|
|
|
|
"informed-decision.coulomb.social/owner-review": "INFD-WP-0007 lifecycle policy-owner return"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"spec": {
|
|
|
|
|
"podSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"app.kubernetes.io/name": "flex-auth-informed-decision-lifecycle"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"policyTypes": [
|
|
|
|
|
"Ingress"
|
|
|
|
|
],
|
|
|
|
|
"ingress": [
|
|
|
|
|
{
|
|
|
|
|
"from": [
|
|
|
|
|
{
|
|
|
|
|
"namespaceSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"kubernetes.io/metadata.name": "informed-decision"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"podSelector": {
|
|
|
|
|
"matchLabels": {
|
|
|
|
|
"app.kubernetes.io/name": "informed-decision",
|
|
|
|
|
"app.kubernetes.io/component": "review"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"ports": [
|
|
|
|
|
{
|
|
|
|
|
"protocol": "TCP",
|
|
|
|
|
"port": 8080
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
