coulomb/informed-decision
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare authenticated lifecycle runtime and production release candidate

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
tegwick 2026-10-04 21:40:19 +02:00
parent f3b71b1521
commit 4f546ae3b1
41 changed files with 2598 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

4
deploy/README.md
View file

@ -20,8 +20,8 @@ Engine, installs the hashed `requirements.lock`, then installs the built wheel
without dependency resolution. The image contains no pip or build installer.
Its user/group is 10001; runtime deployments must use a read-only root filesystem
and drop capabilities. Rebuild the wheel before building the image. Refresh
dependency pins deliberately with `uv pip compile pyproject.toml --python-version
3.12 --generate-hashes --output-file requirements.lock`, then repeat checks and
dependency pins deliberately with `uv lock` followed by `uv export --no-dev --no-emit-project --format
requirements-txt --output-file requirements.lock`, then repeat checks and
the image scan. A successful local build is not a published registry digest.
The dated evidence pins the exact wheel/image/runtime-file hashes and scanner.

96
deploy/lifecycle/README.md Normal file
View file

@ -0,0 +1,96 @@
# INFD-WP-0007 production candidate
Prepared 2026-10-04 for the founder-selected initial audience: net-kingdom-admins
humans and system:serviceaccount:state-hub:state-hub. **Not deployed.**
| Artifact | Immutable reference |
| --- | --- |
| Service | forgejo.coulomb.social/coulomb/informed-decision@sha256:2768bd1da3e651cc0be2d0f1ae6eea1af4eb057b31ef63ebb03b004c2ed76c3d |
| Access Engine | forgejo.coulomb.social/coulomb/flex-auth@sha256:f6ed8af69af766d7e9498465a23c292d91185b79352065736a2132216aac1d37 |
| Lifecycle package | informed-decision.lifecycle v1, sha256:cee6a79f74e81d0d389a2c2e2451a92be3434ea9dfcee4986e8c7e6cfdbb1827 |
| Human review package | informed-decision.compact-sitting v12, sha256:c5387f7d198dc39ab5967e0c218ce05cc779693565c8875e3035e45ec002a2db |
`admission.candidate.json` renders `service.candidate.json` using
`tools/render_deployment.py`. `registries.candidate.json` projects the three
sibling JSON registries. The policy YAML is Helm-rendered from Access Engine's
FLEX-WP-0033 candidate values; it is a review artifact, not a second deployment
owner. Existing Helm releases must be updated through their owning workflow.
All 25 proposed objects passed Kubernetes server dry-run against railiance01.
No Secret is included. Dry-run does not test reachability, credential delivery,
policy caller identity, backup restoration or a human disposition.
## Proposed live changes
- Replace the service's image and immutable runtime ConfigMap, retaining its
public Service/Ingress, single writer, Recreate strategy and existing PVC.
- Enable `/decisions` and lifecycle audit delivery; keep private API on 8081.
- Add the exact State Hub peer, API-server egress, CA/token projection and only
create-tokenreviews RBAC for informed-decision/review.
- Mount the proposed reloadable registries and Platform's exact read-only
requester Secret projection, without subPath.
- Add a separate lifecycle PDP and change the sitting PDP to the v12 package.
Review retains all v11 exact mandates and 15-minute KeyCape MFA; lifecycle
authoring uses a 12-hour MFA window. Agents cannot accept.
- Initial intake permits decision-record / net-kingdom-admins, 50 new attempts
per UTC day, with the existing platform-root recipient. Other admins may
collaborate; this does not silently make them the bound recipient.
The policy chart retains the owner's existing port-only API-server egress
(443/6443). The consumer's new API-server egress is address-specific. CARING is
advisory and consumer fact attribution is unsigned, as in the existing reviewed
contract; neither is presented as a newly enforced control.
## Pre-cutover gates
1. RPF-WP-0051 / CCR-2026-0032: complete the already prepared requester delivery
under its separate live go, with exact identity/path negative proofs and
mounted-file refresh/rotation evidence. Only the audit ExternalSecret was
present in the live namespace at inspection.
2. INFD-WP-0005-T08: State Hub owner supplies production forwarding and separate
lifecycle/intake audience token projections. Its current dev fixture is not
an activated forwarder. Confirm notification receiver reachability; keep
resolution write-back disabled until its owner admission.
3. Refresh live image/config pins and unresolved-entry counts; complete the
backup/restore steps below; obtain explicit approval of this concrete rollout.
INFD-WP-0007-T07 and CCR-2026-0032 require this distinct go.
## Cutover and recovery procedure
Before migrating, close new review traffic through the owning ingress workflow,
let active requests finish, and inspect the current schema-2 writer read-only.
The observed baseline was 24 confirmed submissions, 158 delivered outbox rows,
zero unresolved entries; these counts are not a future maintenance-window gate.
Retain the exact current Deployment, Service, runtime ConfigMap, Helm values and
all related policy pins. Do not include credentials in the evidence packet.
Use the existing running image's installed `informed-decision-admin backup` to
create a unique SQLite consistent snapshot in a private directory. Copy the
backup to independently protected custody, record its digest, and verify a
restore on a separate private volume before cutover. Close the old writer before
starting the schema-5 image. Local synthetic restore proof is retained in the
evidence directory; it does not replace this production data restoration check.
Deploy admitted owner policy/custody prerequisites, then the service candidate.
Verify `/healthz`, `/readyz`, pending/blocked counts, actual audience isolation,
wrong-caller refusals and public/private route separation. Exercise two new
records and a revision without changing image/config/package pins. Only a human
may finish review. Correlate the native Approval Engine entry and independent
Audit Core receipts; restart and retrieve the same immutable evidence.
If validation fails, stop the candidate and retain its database plus all new
receipts. **Never start the old schema-2 image on the schema-5 database.** Rollback
requires the verified pre-cutover copy on a separate volume and reconciliation
of every post-cutover external effect before resuming writes. An uncertain
submission stays unresolved; do not retry or discard it to enable rollback.
The prior image is in ../sitting-admission.json and remains a reference, not an
instruction to downgrade the live database.
## Validation evidence
`docs/evidence/2026-10-04-lifecycle-release/` retains container checks, bounded
scan summaries and policy validation. Service: 662 passed, 1 skipped with owner
components; 13 container checks passed, including restart and backup/restore.
Both artifact scans contain zero HIGH/CRITICAL findings. Actual evaluator tests
cover first-audience collaboration across revisions and verify unchanged package
pins; authentication custody in those tests is synthetic. Native activation and
broader browser packet/binding profiles remain explicit workplan tasks.

52
deploy/lifecycle/admission.candidate.json Normal file
View file

@ -0,0 +1,52 @@
{
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:2768bd1da3e651cc0be2d0f1ae6eea1af4eb057b31ef63ebb03b004c2ed76c3d",
"policy": {
"origin": "http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080",
"package": "informed-decision.compact-sitting",
"version": "v12",
"package_digest": "sha256:c5387f7d198dc39ab5967e0c218ce05cc779693565c8875e3035e45ec002a2db",
"pod_name": "flex-auth-informed-decision-sitting"
},
"keycape_egress_ips": [
"92.205.62.239"
],
"storage_class": "local-path",
"ordinary_approval_ids": [
"2ce76d7f-01c3-4b63-8476-8d1230679769",
"c2af4bcf-15b4-4305-aac1-acc7e4dcb099",
"dc22666a-d5d7-46bc-9490-ebe9fe09dc38"
],
"lifecycle_policy": {
"package": "informed-decision.lifecycle",
"version": "v1",
"package_digest": "sha256:cee6a79f74e81d0d389a2c2e2451a92be3434ea9dfcee4986e8c7e6cfdbb1827",
"origin": "http://flex-auth-informed-decision-lifecycle.flex-auth.svc.cluster.local:8080",
"pod_name": "flex-auth-informed-decision-lifecycle"
},
"lifecycle_delivery": true,
"intake_attributes": true,
"intake_delivery": {
"hub_origin": "http://state-hub.state-hub.svc.cluster.local:8000"
},
"workload_api": {
"registries_configmap": "informed-decision-workload-registry",
"peers": [
{
"namespace": "state-hub",
"app": "state-hub"
}
],
"api_egress": [
{
"ip": "10.43.0.1",
"port": 443
},
{
"ip": "92.205.62.239",
"port": 6443
}
],
"intake": true,
"lifecycle": true
}
}

12
deploy/lifecycle/intake-submitters.json Normal file
View file

@ -0,0 +1,12 @@
{
"system:serviceaccount:state-hub:state-hub": {
"submitter_id": "state-hub",
"memo_classes": [
"decision-record"
],
"review_groups": [
"net-kingdom-admins"
],
"daily_limit": 50
}
}

5
deploy/lifecycle/lifecycle-callers.json Normal file
View file

@ -0,0 +1,5 @@
{
"system:serviceaccount:state-hub:state-hub": {
"tenant": "tenant:platform"
}
}

189
deploy/lifecycle/policy.candidate.yaml Normal file
View file

@ -0,0 +1,189 @@
---
# Source: flex-auth/templates/networkpolicy.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: flex-auth-informed-decision-lifecycle
labels:
app.kubernetes.io/name: flex-auth-informed-decision-lifecycle
app.kubernetes.io/instance: flex-auth-informed-decision-lifecycle
app.kubernetes.io/part-of: flex-auth
spec:
podSelector:
matchLabels:
app.kubernetes.io/name: flex-auth-informed-decision-lifecycle
policyTypes:
- Ingress
- Egress
egress:
- ports:
- port: 443
protocol: TCP
- port: 6443
protocol: TCP
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: informed-decision
podSelector:
matchLabels:
app.kubernetes.io/name: informed-decision
ports:
- port: 8080
protocol: TCP
---
# Source: flex-auth/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: flex-auth-informed-decision-lifecycle
labels:
app.kubernetes.io/name: flex-auth-informed-decision-lifecycle
app.kubernetes.io/instance: flex-auth-informed-decision-lifecycle
app.kubernetes.io/part-of: flex-auth
automountServiceAccountToken: false
---
# Source: flex-auth/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: flex-auth-informed-decision-lifecycle-tokenreviewer
labels:
app.kubernetes.io/name: flex-auth-informed-decision-lifecycle
app.kubernetes.io/instance: flex-auth-informed-decision-lifecycle
app.kubernetes.io/part-of: flex-auth
rules:
- apiGroups:
- authentication.k8s.io
resources:
- tokenreviews
verbs:
- create
---
# Source: flex-auth/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: flex-auth-informed-decision-lifecycle-tokenreviewer
labels:
app.kubernetes.io/name: flex-auth-informed-decision-lifecycle
app.kubernetes.io/instance: flex-auth-informed-decision-lifecycle
app.kubernetes.io/part-of: flex-auth
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: flex-auth-informed-decision-lifecycle-tokenreviewer
subjects:
- kind: ServiceAccount
name: flex-auth-informed-decision-lifecycle
namespace: flex-auth
---
# Source: flex-auth/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
name: flex-auth-informed-decision-lifecycle
labels:
app.kubernetes.io/name: flex-auth-informed-decision-lifecycle
app.kubernetes.io/instance: flex-auth-informed-decision-lifecycle
app.kubernetes.io/part-of: flex-auth
spec:
selector:
app.kubernetes.io/name: flex-auth-informed-decision-lifecycle
ports:
- name: http
port: 8080
targetPort: http
---
# Source: flex-auth/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: flex-auth-informed-decision-lifecycle
labels:
app.kubernetes.io/name: flex-auth-informed-decision-lifecycle
app.kubernetes.io/instance: flex-auth-informed-decision-lifecycle
app.kubernetes.io/part-of: flex-auth
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/name: flex-auth-informed-decision-lifecycle
template:
metadata:
labels:
app.kubernetes.io/name: flex-auth-informed-decision-lifecycle
app.kubernetes.io/instance: flex-auth-informed-decision-lifecycle
app.kubernetes.io/part-of: flex-auth
spec:
automountServiceAccountToken: false
serviceAccountName: flex-auth-informed-decision-lifecycle
securityContext:
runAsNonRoot: true
runAsUser: 65532
runAsGroup: 65532
fsGroup: 65532
seccompProfile:
type: RuntimeDefault
containers:
- name: flex-auth
image: forgejo.coulomb.social/coulomb/flex-auth@sha256:f6ed8af69af766d7e9498465a23c292d91185b79352065736a2132216aac1d37
imagePullPolicy: IfNotPresent
args:
- serve
- --addr
- 0.0.0.0:8080
- --registry
- /opt/flex-auth/examples/informed-decision-lifecycle/registry.json
- --policy
- /opt/flex-auth/examples/informed-decision-lifecycle/policy.md
- --caller-auth-mode
- "enforce"
- --caller-kubernetes-url
- "https://10.43.0.1"
- --caller-binding
- "informed-decision=system:serviceaccount:informed-decision:review"
ports:
- name: http
containerPort: 8080
livenessProbe:
httpGet:
path: /healthz
port: http
periodSeconds: 20
readinessProbe:
httpGet:
path: /healthz
port: http
periodSeconds: 5
resources:
limits:
cpu: 300m
memory: 192Mi
requests:
cpu: 5m
memory: 32Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
volumeMounts:
- mountPath: /var/run/secrets/flex-auth-reviewer
name: flex-auth-reviewer
readOnly: true
volumes:
- name: flex-auth-reviewer
projected:
defaultMode: 0440
sources:
- serviceAccountToken:
expirationSeconds: 3600
path: token
- configMap:
name: kube-root-ca.crt
items:
- key: ca.crt
path: ca.crt

16
deploy/lifecycle/registries.candidate.json Normal file
View file

@ -0,0 +1,16 @@
{
"apiVersion": "v1",
"kind": "ConfigMap",
"metadata": {
"name": "informed-decision-workload-registry",
"namespace": "informed-decision",
"annotations": {
"informed-decision.coulomb.social/admission": "proposal; INFD-WP-0007 concrete rollout approval required"
}
},
"data": {
"lifecycle-callers.json": "{\n \"system:serviceaccount:state-hub:state-hub\": {\n \"tenant\": \"tenant:platform\"\n }\n}\n",
"intake-submitters.json": "{\n \"system:serviceaccount:state-hub:state-hub\": {\n \"submitter_id\": \"state-hub\",\n \"memo_classes\": [\n \"decision-record\"\n ],\n \"review_groups\": [\n \"net-kingdom-admins\"\n ],\n \"daily_limit\": 50\n }\n}\n",
"review-groups.json": "{\n \"net-kingdom-admins\": {\n \"subject\": \"uid=platform-root,ou=people,dc=netkingdom,dc=local\",\n \"display_name\": \"Platform reviewer\"\n }\n}\n"
}
}

6
deploy/lifecycle/review-groups.json Normal file
View file

@ -0,0 +1,6 @@
{
"net-kingdom-admins": {
"subject": "uid=platform-root,ou=people,dc=netkingdom,dc=local",
"display_name": "Platform reviewer"
}
}

189
deploy/lifecycle/review-policy.candidate.yaml Normal file
View file

@ -0,0 +1,189 @@
---
# Source: flex-auth/templates/networkpolicy.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: flex-auth-informed-decision-sitting
labels:
app.kubernetes.io/name: flex-auth-informed-decision-sitting
app.kubernetes.io/instance: flex-auth-informed-decision-sitting
app.kubernetes.io/part-of: flex-auth
spec:
podSelector:
matchLabels:
app.kubernetes.io/name: flex-auth-informed-decision-sitting
policyTypes:
- Ingress
- Egress
egress:
- ports:
- port: 443
protocol: TCP
- port: 6443
protocol: TCP
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: informed-decision
podSelector:
matchLabels:
app.kubernetes.io/name: informed-decision
ports:
- port: 8080
protocol: TCP
---
# Source: flex-auth/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: flex-auth-informed-decision-sitting
labels:
app.kubernetes.io/name: flex-auth-informed-decision-sitting
app.kubernetes.io/instance: flex-auth-informed-decision-sitting
app.kubernetes.io/part-of: flex-auth
automountServiceAccountToken: false
---
# Source: flex-auth/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: flex-auth-informed-decision-sitting-tokenreviewer
labels:
app.kubernetes.io/name: flex-auth-informed-decision-sitting
app.kubernetes.io/instance: flex-auth-informed-decision-sitting
app.kubernetes.io/part-of: flex-auth
rules:
- apiGroups:
- authentication.k8s.io
resources:
- tokenreviews
verbs:
- create
---
# Source: flex-auth/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: flex-auth-informed-decision-sitting-tokenreviewer
labels:
app.kubernetes.io/name: flex-auth-informed-decision-sitting
app.kubernetes.io/instance: flex-auth-informed-decision-sitting
app.kubernetes.io/part-of: flex-auth
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: flex-auth-informed-decision-sitting-tokenreviewer
subjects:
- kind: ServiceAccount
name: flex-auth-informed-decision-sitting
namespace: flex-auth
---
# Source: flex-auth/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
name: flex-auth-informed-decision-sitting
labels:
app.kubernetes.io/name: flex-auth-informed-decision-sitting
app.kubernetes.io/instance: flex-auth-informed-decision-sitting
app.kubernetes.io/part-of: flex-auth
spec:
selector:
app.kubernetes.io/name: flex-auth-informed-decision-sitting
ports:
- name: http
port: 8080
targetPort: http
---
# Source: flex-auth/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: flex-auth-informed-decision-sitting
labels:
app.kubernetes.io/name: flex-auth-informed-decision-sitting
app.kubernetes.io/instance: flex-auth-informed-decision-sitting
app.kubernetes.io/part-of: flex-auth
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/name: flex-auth-informed-decision-sitting
template:
metadata:
labels:
app.kubernetes.io/name: flex-auth-informed-decision-sitting
app.kubernetes.io/instance: flex-auth-informed-decision-sitting
app.kubernetes.io/part-of: flex-auth
spec:
automountServiceAccountToken: false
serviceAccountName: flex-auth-informed-decision-sitting
securityContext:
runAsNonRoot: true
runAsUser: 65532
runAsGroup: 65532
fsGroup: 65532
seccompProfile:
type: RuntimeDefault
containers:
- name: flex-auth
image: forgejo.coulomb.social/coulomb/flex-auth@sha256:f6ed8af69af766d7e9498465a23c292d91185b79352065736a2132216aac1d37
imagePullPolicy: IfNotPresent
args:
- serve
- --addr
- 0.0.0.0:8080
- --registry
- /opt/flex-auth/examples/informed-decision-lifecycle-review/registry.json
- --policy
- /opt/flex-auth/examples/informed-decision-lifecycle-review/policy.md
- --caller-auth-mode
- "enforce"
- --caller-kubernetes-url
- "https://10.43.0.1"
- --caller-binding
- "informed-decision=system:serviceaccount:informed-decision:review"
ports:
- name: http
containerPort: 8080
livenessProbe:
httpGet:
path: /healthz
port: http
periodSeconds: 20
readinessProbe:
httpGet:
path: /healthz
port: http
periodSeconds: 5
resources:
limits:
cpu: 300m
memory: 192Mi
requests:
cpu: 5m
memory: 32Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
volumeMounts:
- mountPath: /var/run/secrets/flex-auth-reviewer
name: flex-auth-reviewer
readOnly: true
volumes:
- name: flex-auth-reviewer
projected:
defaultMode: 0440
sources:
- serviceAccountToken:
expirationSeconds: 3600
path: token
- configMap:
name: kube-root-ca.crt
items:
- key: ca.crt
path: ca.crt

800
deploy/lifecycle/service.candidate.json Normal file
View file

@ -0,0 +1,800 @@
{
"apiVersion": "v1",
"kind": "List",
"items": [
{
"apiVersion": "v1",
"kind": "ServiceAccount",
"metadata": {
"name": "review",
"namespace": "informed-decision",
"annotations": {
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
}
},
"automountServiceAccountToken": false
},
{
"apiVersion": "v1",
"kind": "PersistentVolumeClaim",
"metadata": {
"name": "informed-decision-data",
"namespace": "informed-decision",
"annotations": {
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
}
},
"spec": {
"accessModes": [
"ReadWriteOnce"
],
"storageClassName": "local-path",
"resources": {
"requests": {
"storage": "1Gi"
}
}
}
},
{
"apiVersion": "v1",
"kind": "ConfigMap",
"metadata": {
"name": "informed-decision-runtime-92d01402eb05",
"namespace": "informed-decision",
"annotations": {
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
}
},
"immutable": true,
"data": {
"runtime.json": "{\"approval_origin\":\"http://approval-engine.approval-engine.svc.cluster.local:8080\",\"audit\":{\"origin\":\"http://audit-core.audit-core.svc.cluster.local:8080\",\"sender_token_file\":\"/var/run/secrets/informed-decision/audit/token\"},\"evidence_db\":\"/data/private/review.sqlite\",\"intake_attributes\":true,\"intake_delivery\":{\"hub_origin\":\"http://state-hub.state-hub.svc.cluster.local:8000\"},\"lifecycle_delivery\":true,\"lifecycle_policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-lifecycle.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.lifecycle\",\"package_digest\":\"sha256:cee6a79f74e81d0d389a2c2e2451a92be3434ea9dfcee4986e8c7e6cfdbb1827\",\"version\":\"v1\"},\"ordinary_approval_ids\":[\"2ce76d7f-01c3-4b63-8476-8d1230679769\",\"c2af4bcf-15b4-4305-aac1-acc7e4dcb099\",\"dc22666a-d5d7-46bc-9490-ebe9fe09dc38\"],\"policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.compact-sitting\",\"package_digest\":\"sha256:c5387f7d198dc39ab5967e0c218ce05cc779693565c8875e3035e45ec002a2db\",\"version\":\"v12\"},\"schema\":\"informed-decision.review-runtime.v1\",\"workload_api\":{\"intake\":{\"groups_file\":\"/workload-registry/review-groups.json\",\"secret_file\":\"/var/run/secrets/informed-decision/requester/client-secret\",\"submitters_file\":\"/workload-registry/intake-submitters.json\"},\"lifecycle_callers_file\":\"/workload-registry/lifecycle-callers.json\",\"token_review\":{\"ca_file\":\"/var/run/secrets/informed-decision/kubernetes/ca.crt\",\"origin\":\"https://kubernetes.default.svc:443\",\"token_file\":\"/var/run/secrets/informed-decision/kubernetes/token\"}}}"
}
},
{
"apiVersion": "apps/v1",
"kind": "Deployment",
"metadata": {
"name": "informed-decision",
"namespace": "informed-decision",
"annotations": {
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
}
},
"spec": {
"replicas": 1,
"strategy": {
"type": "Recreate"
},
"progressDeadlineSeconds": 600,
"selector": {
"matchLabels": {
"app.kubernetes.io/name": "informed-decision"
}
},
"template": {
"metadata": {
"labels": {
"app.kubernetes.io/name": "informed-decision",
"app.kubernetes.io/component": "review"
}
},
"spec": {
"automountServiceAccountToken": false,
"serviceAccountName": "review",
"terminationGracePeriodSeconds": 45,
"securityContext": {
"runAsNonRoot": true,
"runAsUser": 10001,
"runAsGroup": 10001,
"fsGroup": 10001,
"fsGroupChangePolicy": "OnRootMismatch",
"seccompProfile": {
"type": "RuntimeDefault"
}
},
"containers": [
{
"name": "informed-decision",
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:2768bd1da3e651cc0be2d0f1ae6eea1af4eb057b31ef63ebb03b004c2ed76c3d",
"securityContext": {
"allowPrivilegeEscalation": false,
"readOnlyRootFilesystem": true,
"capabilities": {
"drop": [
"ALL"
]
}
},
"env": [
{
"name": "INFD_KEYCAPE_ISSUER",
"value": "https://kc.coulomb.social"
},
{
"name": "INFD_CONTAINER_CONFIG",
"value": "/configuration/runtime.json"
}
],
"ports": [
{
"name": "http",
"containerPort": 8080
},
{
"name": "workload",
"containerPort": 8081
}
],
"startupProbe": {
"httpGet": {
"path": "/healthz",
"port": "http"
},
"periodSeconds": 10,
"timeoutSeconds": 2,
"failureThreshold": 12
},
"readinessProbe": {
"httpGet": {
"path": "/healthz",
"port": "http"
},
"periodSeconds": 10,
"timeoutSeconds": 2
},
"livenessProbe": {
"httpGet": {
"path": "/healthz",
"port": "http"
},
"periodSeconds": 10,
"timeoutSeconds": 2
},
"resources": {
"requests": {
"cpu": "5m",
"memory": "64Mi"
},
"limits": {
"cpu": "500m",
"memory": "256Mi"
}
},
"volumeMounts": [
{
"name": "data",
"mountPath": "/data"
},
{
"name": "runtime",
"mountPath": "/run/informed-decision"
},
{
"name": "tmp",
"mountPath": "/tmp"
},
{
"name": "configuration",
"mountPath": "/configuration",
"readOnly": true
},
{
"name": "caller",
"mountPath": "/var/run/secrets/informed-decision/policy",
"readOnly": true
},
{
"name": "audit",
"mountPath": "/var/run/secrets/informed-decision/audit",
"readOnly": true
},
{
"name": "kubernetes-api",
"mountPath": "/var/run/secrets/informed-decision/kubernetes",
"readOnly": true
},
{
"name": "workload-registry",
"mountPath": "/workload-registry",
"readOnly": true
},
{
"name": "sitting-requester",
"mountPath": "/var/run/secrets/informed-decision/requester",
"readOnly": true
}
]
}
],
"volumes": [
{
"name": "data",
"persistentVolumeClaim": {
"claimName": "informed-decision-data"
}
},
{
"name": "runtime",
"emptyDir": {
"medium": "Memory",
"sizeLimit": "16Mi"
}
},
{
"name": "tmp",
"emptyDir": {
"medium": "Memory",
"sizeLimit": "16Mi"
}
},
{
"name": "configuration",
"configMap": {
"name": "informed-decision-runtime-92d01402eb05",
"defaultMode": 292
}
},
{
"name": "caller",
"projected": {
"defaultMode": 288,
"sources": [
{
"serviceAccountToken": {
"path": "token",
"audience": "flex-auth",
"expirationSeconds": 3600
}
}
]
}
},
{
"name": "audit",
"secret": {
"secretName": "informed-decision-audit",
"defaultMode": 288,
"items": [
{
"key": "token",
"path": "token"
}
]
}
},
{
"name": "kubernetes-api",
"projected": {
"defaultMode": 288,
"sources": [
{
"serviceAccountToken": {
"path": "token",
"expirationSeconds": 600
}
},
{
"configMap": {
"name": "kube-root-ca.crt",
"items": [
{
"key": "ca.crt",
"path": "ca.crt"
}
]
}
}
]
}
},
{
"name": "workload-registry",
"configMap": {
"name": "informed-decision-workload-registry",
"defaultMode": 292
}
},
{
"name": "sitting-requester",
"secret": {
"secretName": "informed-decision-sitting-requester",
"defaultMode": 288,
"optional": false,
"items": [
{
"key": "client-secret",
"path": "client-secret"
}
]
}
}
]
}
}
}
},
{
"apiVersion": "v1",
"kind": "Service",
"metadata": {
"name": "informed-decision",
"namespace": "informed-decision",
"annotations": {
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
}
},
"spec": {
"type": "ClusterIP",
"selector": {
"app.kubernetes.io/name": "informed-decision",
"app.kubernetes.io/component": "review"
},
"ports": [
{
"name": "http",
"port": 80,
"targetPort": "http",
"protocol": "TCP"
}
]
}
},
{
"apiVersion": "networking.k8s.io/v1",
"kind": "NetworkPolicy",
"metadata": {
"name": "informed-decision-review",
"namespace": "informed-decision",
"annotations": {
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
}
},
"spec": {
"podSelector": {
"matchLabels": {
"app.kubernetes.io/name": "informed-decision",
"app.kubernetes.io/component": "review"
}
},
"policyTypes": [
"Ingress",
"Egress"
],
"ingress": [
{
"from": [
{
"namespaceSelector": {
"matchLabels": {
"kubernetes.io/metadata.name": "kube-system"
}
},
"podSelector": {
"matchLabels": {
"app.kubernetes.io/name": "traefik"
}
}
}
],
"ports": [
{
"protocol": "TCP",
"port": 8080
}
]
},
{
"from": [
{
"namespaceSelector": {
"matchLabels": {
"kubernetes.io/metadata.name": "state-hub"
}
},
"podSelector": {
"matchLabels": {
"app.kubernetes.io/name": "state-hub"
}
}
}
],
"ports": [
{
"protocol": "TCP",
"port": 8081
}
]
}
],
"egress": [
{
"to": [
{
"namespaceSelector": {
"matchLabels": {
"kubernetes.io/metadata.name": "kube-system"
}
},
"podSelector": {
"matchLabels": {
"k8s-app": "kube-dns"
}
}
}
],
"ports": [
{
"protocol": "UDP",
"port": 53
},
{
"protocol": "TCP",
"port": 53
}
]
},
{
"to": [
{
"namespaceSelector": {
"matchLabels": {
"kubernetes.io/metadata.name": "approval-engine"
}
},
"podSelector": {
"matchLabels": {
"app.kubernetes.io/name": "approval-engine"
}
}
},
{
"namespaceSelector": {
"matchLabels": {
"kubernetes.io/metadata.name": "audit-core"
}
},
"podSelector": {
"matchLabels": {
"app.kubernetes.io/name": "audit-core"
}
}
},
{
"namespaceSelector": {
"matchLabels": {
"kubernetes.io/metadata.name": "flex-auth"
}
},
"podSelector": {
"matchLabels": {
"app.kubernetes.io/name": "flex-auth-informed-decision-sitting"
}
}
},
{
"namespaceSelector": {
"matchLabels": {
"kubernetes.io/metadata.name": "flex-auth"
}
},
"podSelector": {
"matchLabels": {
"app.kubernetes.io/name": "flex-auth-informed-decision-lifecycle"
}
}
}
],
"ports": [
{
"protocol": "TCP",
"port": 8080
}
]
},
{
"to": [
{
"namespaceSelector": {
"matchLabels": {
"kubernetes.io/metadata.name": "kube-system"
}
},
"podSelector": {
"matchLabels": {
"app.kubernetes.io/name": "traefik"
}
}
}
],
"ports": [
{
"protocol": "TCP",
"port": 8443
}
]
},
{
"to": [
{
"ipBlock": {
"cidr": "92.205.62.239/32"
}
}
],
"ports": [
{
"protocol": "TCP",
"port": 443
}
]
},
{
"to": [
{
"namespaceSelector": {
"matchLabels": {
"kubernetes.io/metadata.name": "state-hub"
}
},
"podSelector": {
"matchLabels": {
"app.kubernetes.io/name": "state-hub"
}
}
}
],
"ports": [
{
"protocol": "TCP",
"port": 8000
}
]
},
{
"to": [
{
"ipBlock": {
"cidr": "10.43.0.1/32"
}
}
],
"ports": [
{
"protocol": "TCP",
"port": 443
}
]
},
{
"to": [
{
"ipBlock": {
"cidr": "92.205.62.239/32"
}
}
],
"ports": [
{
"protocol": "TCP",
"port": 6443
}
]
}
]
}
},
{
"apiVersion": "v1",
"kind": "Service",
"metadata": {
"name": "informed-decision-workload",
"namespace": "informed-decision",
"annotations": {
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
}
},
"spec": {
"type": "ClusterIP",
"selector": {
"app.kubernetes.io/name": "informed-decision",
"app.kubernetes.io/component": "review"
},
"ports": [
{
"name": "workload",
"port": 8081,
"targetPort": "workload",
"protocol": "TCP"
}
]
}
},
{
"apiVersion": "rbac.authorization.k8s.io/v1",
"kind": "ClusterRole",
"metadata": {
"name": "informed-decision-tokenreview",
"annotations": {
"informed-decision.coulomb.social/admission": "proposal; INFD-WP-0007/INFD-WP-0005 owner review required"
}
},
"rules": [
{
"apiGroups": [
"authentication.k8s.io"
],
"resources": [
"tokenreviews"
],
"verbs": [
"create"
]
}
]
},
{
"apiVersion": "rbac.authorization.k8s.io/v1",
"kind": "ClusterRoleBinding",
"metadata": {
"name": "informed-decision-tokenreview",
"annotations": {
"informed-decision.coulomb.social/admission": "proposal; INFD-WP-0007/INFD-WP-0005 owner review required"
}
},
"roleRef": {
"apiGroup": "rbac.authorization.k8s.io",
"kind": "ClusterRole",
"name": "informed-decision-tokenreview"
},
"subjects": [
{
"kind": "ServiceAccount",
"name": "review",
"namespace": "informed-decision"
}
]
},
{
"apiVersion": "networking.k8s.io/v1",
"kind": "NetworkPolicy",
"metadata": {
"name": "informed-decision-review-ingress",
"namespace": "approval-engine",
"annotations": {
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08",
"informed-decision.coulomb.social/owner-review": "APPROVAL-WP-0002-T01"
}
},
"spec": {
"podSelector": {
"matchLabels": {
"app.kubernetes.io/name": "approval-engine"
}
},
"policyTypes": [
"Ingress"
],
"ingress": [
{
"from": [
{
"namespaceSelector": {
"matchLabels": {
"kubernetes.io/metadata.name": "informed-decision"
}
},
"podSelector": {
"matchLabels": {
"app.kubernetes.io/name": "informed-decision",
"app.kubernetes.io/component": "review"
}
}
}
],
"ports": [
{
"protocol": "TCP",
"port": 8080
}
]
}
]
}
},
{
"apiVersion": "networking.k8s.io/v1",
"kind": "NetworkPolicy",
"metadata": {
"name": "informed-decision-review-ingress",
"namespace": "flex-auth",
"annotations": {
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08",
"informed-decision.coulomb.social/owner-review": "INFD-WP-0001-T08 policy-owner return"
}
},
"spec": {
"podSelector": {
"matchLabels": {
"app.kubernetes.io/name": "flex-auth-informed-decision-sitting"
}
},
"policyTypes": [
"Ingress"
],
"ingress": [
{
"from": [
{
"namespaceSelector": {
"matchLabels": {
"kubernetes.io/metadata.name": "informed-decision"
}
},
"podSelector": {
"matchLabels": {
"app.kubernetes.io/name": "informed-decision",
"app.kubernetes.io/component": "review"
}
}
}
],
"ports": [
{
"protocol": "TCP",
"port": 8080
}
]
}
]
}
},
{
"apiVersion": "networking.k8s.io/v1",
"kind": "NetworkPolicy",
"metadata": {
"name": "informed-decision-lifecycle-ingress",
"namespace": "flex-auth",
"annotations": {
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08",
"informed-decision.coulomb.social/owner-review": "INFD-WP-0007 lifecycle policy-owner return"
}
},
"spec": {
"podSelector": {
"matchLabels": {
"app.kubernetes.io/name": "flex-auth-informed-decision-lifecycle"
}
},
"policyTypes": [
"Ingress"
],
"ingress": [
{
"from": [
{
"namespaceSelector": {
"matchLabels": {
"kubernetes.io/metadata.name": "informed-decision"
}
},
"podSelector": {
"matchLabels": {
"app.kubernetes.io/name": "informed-decision",
"app.kubernetes.io/component": "review"
}
}
}
],
"ports": [
{
"protocol": "TCP",
"port": 8080
}
]
}
]
}
}
]
}