Prepare authenticated lifecycle runtime and production release candidate

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f

deploy/lifecycle/policy.candidate.yaml

@@ -0,0 +1,189 @@
+---
+# Source: flex-auth/templates/networkpolicy.yaml
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: flex-auth-informed-decision-lifecycle
+  labels:
+    app.kubernetes.io/name: flex-auth-informed-decision-lifecycle
+    app.kubernetes.io/instance: flex-auth-informed-decision-lifecycle
+    app.kubernetes.io/part-of: flex-auth
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: flex-auth-informed-decision-lifecycle
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - ports:
+        - port: 443
+          protocol: TCP
+        - port: 6443
+          protocol: TCP
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: informed-decision
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: informed-decision
+      ports:
+        - port: 8080
+          protocol: TCP
+---
+# Source: flex-auth/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: flex-auth-informed-decision-lifecycle
+  labels:
+    app.kubernetes.io/name: flex-auth-informed-decision-lifecycle
+    app.kubernetes.io/instance: flex-auth-informed-decision-lifecycle
+    app.kubernetes.io/part-of: flex-auth
+automountServiceAccountToken: false
+---
+# Source: flex-auth/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: flex-auth-informed-decision-lifecycle-tokenreviewer
+  labels:
+    app.kubernetes.io/name: flex-auth-informed-decision-lifecycle
+    app.kubernetes.io/instance: flex-auth-informed-decision-lifecycle
+    app.kubernetes.io/part-of: flex-auth
+rules:
+  - apiGroups:
+      - authentication.k8s.io
+    resources:
+      - tokenreviews
+    verbs:
+      - create
+---
+# Source: flex-auth/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: flex-auth-informed-decision-lifecycle-tokenreviewer
+  labels:
+    app.kubernetes.io/name: flex-auth-informed-decision-lifecycle
+    app.kubernetes.io/instance: flex-auth-informed-decision-lifecycle
+    app.kubernetes.io/part-of: flex-auth
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: flex-auth-informed-decision-lifecycle-tokenreviewer
+subjects:
+  - kind: ServiceAccount
+    name: flex-auth-informed-decision-lifecycle
+    namespace: flex-auth
+---
+# Source: flex-auth/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: flex-auth-informed-decision-lifecycle
+  labels:
+    app.kubernetes.io/name: flex-auth-informed-decision-lifecycle
+    app.kubernetes.io/instance: flex-auth-informed-decision-lifecycle
+    app.kubernetes.io/part-of: flex-auth
+spec:
+  selector:
+    app.kubernetes.io/name: flex-auth-informed-decision-lifecycle
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+---
+# Source: flex-auth/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: flex-auth-informed-decision-lifecycle
+  labels:
+    app.kubernetes.io/name: flex-auth-informed-decision-lifecycle
+    app.kubernetes.io/instance: flex-auth-informed-decision-lifecycle
+    app.kubernetes.io/part-of: flex-auth
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: flex-auth-informed-decision-lifecycle
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: flex-auth-informed-decision-lifecycle
+        app.kubernetes.io/instance: flex-auth-informed-decision-lifecycle
+        app.kubernetes.io/part-of: flex-auth
+    spec:
+      automountServiceAccountToken: false
+      serviceAccountName: flex-auth-informed-decision-lifecycle
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: flex-auth
+          image: forgejo.coulomb.social/coulomb/flex-auth@sha256:f6ed8af69af766d7e9498465a23c292d91185b79352065736a2132216aac1d37
+          imagePullPolicy: IfNotPresent
+          args:
+            - serve
+            - --addr
+            - 0.0.0.0:8080
+            - --registry
+            - /opt/flex-auth/examples/informed-decision-lifecycle/registry.json
+            - --policy
+            - /opt/flex-auth/examples/informed-decision-lifecycle/policy.md
+            - --caller-auth-mode
+            - "enforce"
+            - --caller-kubernetes-url
+            - "https://10.43.0.1"
+            - --caller-binding
+            - "informed-decision=system:serviceaccount:informed-decision:review"
+          ports:
+            - name: http
+              containerPort: 8080
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            periodSeconds: 20
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            periodSeconds: 5
+          resources:
+            limits:
+              cpu: 300m
+              memory: 192Mi
+            requests:
+              cpu: 5m
+              memory: 32Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - mountPath: /var/run/secrets/flex-auth-reviewer
+              name: flex-auth-reviewer
+              readOnly: true
+      volumes:
+        - name: flex-auth-reviewer
+          projected:
+            defaultMode: 0440
+            sources:
+              - serviceAccountToken:
+                  expirationSeconds: 3600
+                  path: token
+              - configMap:
+                  name: kube-root-ca.crt
+                  items:
+                    - key: ca.crt
+                      path: ca.crt