{ "apiVersion": "v1", "kind": "List", "items": [ { "apiVersion": "v1", "kind": "ServiceAccount", "metadata": { "name": "review", "namespace": "informed-decision", "annotations": { "informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08" } }, "automountServiceAccountToken": false }, { "apiVersion": "v1", "kind": "PersistentVolumeClaim", "metadata": { "name": "informed-decision-data", "namespace": "informed-decision", "annotations": { "informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08" } }, "spec": { "accessModes": [ "ReadWriteOnce" ], "storageClassName": "local-path", "resources": { "requests": { "storage": "1Gi" } } } }, { "apiVersion": "v1", "kind": "ConfigMap", "metadata": { "name": "informed-decision-runtime-6c221878d051", "namespace": "informed-decision", "annotations": { "informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08" } }, "immutable": true, "data": { "runtime.json": "{\"approval_origin\":\"http://approval-engine.approval-engine.svc.cluster.local:8080\",\"audit\":{\"origin\":\"http://audit-core.audit-core.svc.cluster.local:8080\",\"sender_token_file\":\"/var/run/secrets/informed-decision/audit/token\"},\"evidence_db\":\"/data/private/review.sqlite\",\"intake_attributes\":true,\"intake_delivery\":{\"hub_origin\":\"http://state-hub.state-hub.svc.cluster.local:8000\"},\"lifecycle_delivery\":true,\"lifecycle_policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-lifecycle.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.lifecycle\",\"package_digest\":\"sha256:da01e045fc108adec6b489e5d51f7e57366793016c5a64776963780a6aae457c\",\"version\":\"v2\"},\"ordinary_approval_ids\":[\"2ce76d7f-01c3-4b63-8476-8d1230679769\",\"c2af4bcf-15b4-4305-aac1-acc7e4dcb099\",\"dc22666a-d5d7-46bc-9490-ebe9fe09dc38\"],\"policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.compact-sitting\",\"package_digest\":\"sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873\",\"version\":\"v13\"},\"schema\":\"informed-decision.review-runtime.v1\",\"workload_api\":{\"intake\":{\"groups_file\":\"/workload-registry/review-groups.json\",\"secret_file\":\"/var/run/secrets/informed-decision/requester/client-secret\",\"submitters_file\":\"/workload-registry/intake-submitters.json\"},\"lifecycle_callers_file\":\"/workload-registry/lifecycle-callers.json\",\"token_review\":{\"ca_file\":\"/var/run/secrets/informed-decision/kubernetes/ca.crt\",\"origin\":\"https://kubernetes.default.svc:443\",\"token_file\":\"/var/run/secrets/informed-decision/kubernetes/token\"}}}" } }, { "apiVersion": "apps/v1", "kind": "Deployment", "metadata": { "name": "informed-decision", "namespace": "informed-decision", "annotations": { "informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08" } }, "spec": { "replicas": 1, "strategy": { "type": "Recreate" }, "progressDeadlineSeconds": 600, "selector": { "matchLabels": { "app.kubernetes.io/name": "informed-decision" } }, "template": { "metadata": { "labels": { "app.kubernetes.io/name": "informed-decision", "app.kubernetes.io/component": "review" } }, "spec": { "automountServiceAccountToken": false, "serviceAccountName": "review", "terminationGracePeriodSeconds": 45, "securityContext": { "runAsNonRoot": true, "runAsUser": 10001, "runAsGroup": 10001, "fsGroup": 10001, "fsGroupChangePolicy": "OnRootMismatch", "seccompProfile": { "type": "RuntimeDefault" } }, "containers": [ { "name": "informed-decision", "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173", "securityContext": { "allowPrivilegeEscalation": false, "readOnlyRootFilesystem": true, "capabilities": { "drop": [ "ALL" ] } }, "env": [ { "name": "INFD_KEYCAPE_ISSUER", "value": "https://kc.coulomb.social" }, { "name": "INFD_CONTAINER_CONFIG", "value": "/configuration/runtime.json" } ], "ports": [ { "name": "http", "containerPort": 8080 }, { "name": "workload", "containerPort": 8081 } ], "startupProbe": { "httpGet": { "path": "/healthz", "port": "http" }, "periodSeconds": 10, "timeoutSeconds": 2, "failureThreshold": 12 }, "readinessProbe": { "httpGet": { "path": "/healthz", "port": "http" }, "periodSeconds": 10, "timeoutSeconds": 2 }, "livenessProbe": { "httpGet": { "path": "/healthz", "port": "http" }, "periodSeconds": 10, "timeoutSeconds": 2 }, "resources": { "requests": { "cpu": "5m", "memory": "64Mi" }, "limits": { "cpu": "500m", "memory": "256Mi" } }, "volumeMounts": [ { "name": "data", "mountPath": "/data" }, { "name": "runtime", "mountPath": "/run/informed-decision" }, { "name": "tmp", "mountPath": "/tmp" }, { "name": "configuration", "mountPath": "/configuration", "readOnly": true }, { "name": "caller", "mountPath": "/var/run/secrets/informed-decision/policy", "readOnly": true }, { "name": "audit", "mountPath": "/var/run/secrets/informed-decision/audit", "readOnly": true }, { "name": "kubernetes-api", "mountPath": "/var/run/secrets/informed-decision/kubernetes", "readOnly": true }, { "name": "workload-registry", "mountPath": "/workload-registry", "readOnly": true }, { "name": "sitting-requester", "mountPath": "/var/run/secrets/informed-decision/requester", "readOnly": true } ] } ], "volumes": [ { "name": "data", "persistentVolumeClaim": { "claimName": "informed-decision-data" } }, { "name": "runtime", "emptyDir": { "medium": "Memory", "sizeLimit": "16Mi" } }, { "name": "tmp", "emptyDir": { "medium": "Memory", "sizeLimit": "16Mi" } }, { "name": "configuration", "configMap": { "name": "informed-decision-runtime-6c221878d051", "defaultMode": 292 } }, { "name": "caller", "projected": { "defaultMode": 288, "sources": [ { "serviceAccountToken": { "path": "token", "audience": "flex-auth", "expirationSeconds": 3600 } } ] } }, { "name": "audit", "secret": { "secretName": "informed-decision-audit", "defaultMode": 288, "items": [ { "key": "token", "path": "token" } ] } }, { "name": "kubernetes-api", "projected": { "defaultMode": 288, "sources": [ { "serviceAccountToken": { "path": "token", "expirationSeconds": 600 } }, { "configMap": { "name": "kube-root-ca.crt", "items": [ { "key": "ca.crt", "path": "ca.crt" } ] } } ] } }, { "name": "workload-registry", "configMap": { "name": "informed-decision-workload-registry", "defaultMode": 292 } }, { "name": "sitting-requester", "secret": { "secretName": "informed-decision-sitting-requester", "defaultMode": 288, "optional": false, "items": [ { "key": "client-secret", "path": "client-secret" } ] } } ] } } } }, { "apiVersion": "v1", "kind": "Service", "metadata": { "name": "informed-decision", "namespace": "informed-decision", "annotations": { "informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08" } }, "spec": { "type": "ClusterIP", "selector": { "app.kubernetes.io/name": "informed-decision", "app.kubernetes.io/component": "review" }, "ports": [ { "name": "http", "port": 80, "targetPort": "http", "protocol": "TCP" } ] } }, { "apiVersion": "networking.k8s.io/v1", "kind": "NetworkPolicy", "metadata": { "name": "informed-decision-review", "namespace": "informed-decision", "annotations": { "informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08" } }, "spec": { "podSelector": { "matchLabels": { "app.kubernetes.io/name": "informed-decision", "app.kubernetes.io/component": "review" } }, "policyTypes": [ "Ingress", "Egress" ], "ingress": [ { "from": [ { "namespaceSelector": { "matchLabels": { "kubernetes.io/metadata.name": "kube-system" } }, "podSelector": { "matchLabels": { "app.kubernetes.io/name": "traefik" } } } ], "ports": [ { "protocol": "TCP", "port": 8080 } ] }, { "from": [ { "namespaceSelector": { "matchLabels": { "kubernetes.io/metadata.name": "state-hub" } }, "podSelector": { "matchLabels": { "app.kubernetes.io/name": "state-hub" } } } ], "ports": [ { "protocol": "TCP", "port": 8081 } ] } ], "egress": [ { "to": [ { "namespaceSelector": { "matchLabels": { "kubernetes.io/metadata.name": "kube-system" } }, "podSelector": { "matchLabels": { "k8s-app": "kube-dns" } } } ], "ports": [ { "protocol": "UDP", "port": 53 }, { "protocol": "TCP", "port": 53 } ] }, { "to": [ { "namespaceSelector": { "matchLabels": { "kubernetes.io/metadata.name": "approval-engine" } }, "podSelector": { "matchLabels": { "app.kubernetes.io/name": "approval-engine" } } }, { "namespaceSelector": { "matchLabels": { "kubernetes.io/metadata.name": "audit-core" } }, "podSelector": { "matchLabels": { "app.kubernetes.io/name": "audit-core" } } }, { "namespaceSelector": { "matchLabels": { "kubernetes.io/metadata.name": "flex-auth" } }, "podSelector": { "matchLabels": { "app.kubernetes.io/name": "flex-auth-informed-decision-sitting" } } }, { "namespaceSelector": { "matchLabels": { "kubernetes.io/metadata.name": "flex-auth" } }, "podSelector": { "matchLabels": { "app.kubernetes.io/name": "flex-auth-informed-decision-lifecycle" } } } ], "ports": [ { "protocol": "TCP", "port": 8080 } ] }, { "to": [ { "namespaceSelector": { "matchLabels": { "kubernetes.io/metadata.name": "kube-system" } }, "podSelector": { "matchLabels": { "app.kubernetes.io/name": "traefik" } } } ], "ports": [ { "protocol": "TCP", "port": 8443 } ] }, { "to": [ { "ipBlock": { "cidr": "92.205.62.239/32" } } ], "ports": [ { "protocol": "TCP", "port": 443 } ] }, { "to": [ { "namespaceSelector": { "matchLabels": { "kubernetes.io/metadata.name": "state-hub" } }, "podSelector": { "matchLabels": { "app.kubernetes.io/name": "state-hub" } } } ], "ports": [ { "protocol": "TCP", "port": 8000 } ] }, { "to": [ { "ipBlock": { "cidr": "10.43.0.1/32" } } ], "ports": [ { "protocol": "TCP", "port": 443 } ] }, { "to": [ { "ipBlock": { "cidr": "92.205.62.239/32" } } ], "ports": [ { "protocol": "TCP", "port": 6443 } ] } ] } }, { "apiVersion": "v1", "kind": "Service", "metadata": { "name": "informed-decision-workload", "namespace": "informed-decision", "annotations": { "informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08" } }, "spec": { "type": "ClusterIP", "selector": { "app.kubernetes.io/name": "informed-decision", "app.kubernetes.io/component": "review" }, "ports": [ { "name": "workload", "port": 8081, "targetPort": "workload", "protocol": "TCP" } ] } }, { "apiVersion": "rbac.authorization.k8s.io/v1", "kind": "ClusterRole", "metadata": { "name": "informed-decision-tokenreview", "annotations": { "informed-decision.coulomb.social/admission": "proposal; INFD-WP-0007/INFD-WP-0005 owner review required" } }, "rules": [ { "apiGroups": [ "authentication.k8s.io" ], "resources": [ "tokenreviews" ], "verbs": [ "create" ] } ] }, { "apiVersion": "rbac.authorization.k8s.io/v1", "kind": "ClusterRoleBinding", "metadata": { "name": "informed-decision-tokenreview", "annotations": { "informed-decision.coulomb.social/admission": "proposal; INFD-WP-0007/INFD-WP-0005 owner review required" } }, "roleRef": { "apiGroup": "rbac.authorization.k8s.io", "kind": "ClusterRole", "name": "informed-decision-tokenreview" }, "subjects": [ { "kind": "ServiceAccount", "name": "review", "namespace": "informed-decision" } ] }, { "apiVersion": "networking.k8s.io/v1", "kind": "NetworkPolicy", "metadata": { "name": "informed-decision-review-ingress", "namespace": "approval-engine", "annotations": { "informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08", "informed-decision.coulomb.social/owner-review": "APPROVAL-WP-0002-T01" } }, "spec": { "podSelector": { "matchLabels": { "app.kubernetes.io/name": "approval-engine" } }, "policyTypes": [ "Ingress" ], "ingress": [ { "from": [ { "namespaceSelector": { "matchLabels": { "kubernetes.io/metadata.name": "informed-decision" } }, "podSelector": { "matchLabels": { "app.kubernetes.io/name": "informed-decision", "app.kubernetes.io/component": "review" } } } ], "ports": [ { "protocol": "TCP", "port": 8080 } ] } ] } }, { "apiVersion": "networking.k8s.io/v1", "kind": "NetworkPolicy", "metadata": { "name": "informed-decision-review-ingress", "namespace": "flex-auth", "annotations": { "informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08", "informed-decision.coulomb.social/owner-review": "INFD-WP-0001-T08 policy-owner return" } }, "spec": { "podSelector": { "matchLabels": { "app.kubernetes.io/name": "flex-auth-informed-decision-sitting" } }, "policyTypes": [ "Ingress" ], "ingress": [ { "from": [ { "namespaceSelector": { "matchLabels": { "kubernetes.io/metadata.name": "informed-decision" } }, "podSelector": { "matchLabels": { "app.kubernetes.io/name": "informed-decision", "app.kubernetes.io/component": "review" } } } ], "ports": [ { "protocol": "TCP", "port": 8080 } ] } ] } }, { "apiVersion": "networking.k8s.io/v1", "kind": "NetworkPolicy", "metadata": { "name": "informed-decision-lifecycle-ingress", "namespace": "flex-auth", "annotations": { "informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08", "informed-decision.coulomb.social/owner-review": "INFD-WP-0007 lifecycle policy-owner return" } }, "spec": { "podSelector": { "matchLabels": { "app.kubernetes.io/name": "flex-auth-informed-decision-lifecycle" } }, "policyTypes": [ "Ingress" ], "ingress": [ { "from": [ { "namespaceSelector": { "matchLabels": { "kubernetes.io/metadata.name": "informed-decision" } }, "podSelector": { "matchLabels": { "app.kubernetes.io/name": "informed-decision", "app.kubernetes.io/component": "review" } } } ], "ports": [ { "protocol": "TCP", "port": 8080 } ] } ] } } ] }