465 lines
13 KiB
JSON
465 lines
13 KiB
JSON
{
|
|
"source_pins": {
|
|
"chart_revision": "dc042022f7c30671cf0a7605cf43ef6d96d04242",
|
|
"image_revision": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0",
|
|
"platform_revision": "84c529f239c81e6d3ca337015700b03e3a862f53",
|
|
"stopped_render_sha256": "03b631f0fe17c63494c14619199f69f2a2a9ab245d00f1ec441248868b24c071"
|
|
},
|
|
"resources": [
|
|
{
|
|
"apiVersion": "networking.k8s.io/v1",
|
|
"kind": "NetworkPolicy",
|
|
"metadata": {
|
|
"name": "flex-auth-secrets-engine",
|
|
"labels": {
|
|
"app.kubernetes.io/name": "flex-auth-secrets-engine",
|
|
"app.kubernetes.io/instance": "flex-auth-secrets-engine",
|
|
"app.kubernetes.io/part-of": "flex-auth"
|
|
}
|
|
},
|
|
"spec": {
|
|
"podSelector": {
|
|
"matchLabels": {
|
|
"app.kubernetes.io/name": "flex-auth-secrets-engine"
|
|
}
|
|
},
|
|
"policyTypes": [
|
|
"Ingress",
|
|
"Egress"
|
|
],
|
|
"egress": [
|
|
{
|
|
"ports": [
|
|
{
|
|
"port": 443,
|
|
"protocol": "TCP"
|
|
},
|
|
{
|
|
"port": 6443,
|
|
"protocol": "TCP"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"ingress": [
|
|
{
|
|
"from": [
|
|
{
|
|
"namespaceSelector": {
|
|
"matchLabels": {
|
|
"kubernetes.io/metadata.name": "secrets-engine"
|
|
}
|
|
},
|
|
"podSelector": {
|
|
"matchLabels": {
|
|
"app.kubernetes.io/name": "secrets-engine"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"ports": [
|
|
{
|
|
"port": 8080,
|
|
"protocol": "TCP"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"apiVersion": "v1",
|
|
"kind": "ServiceAccount",
|
|
"metadata": {
|
|
"name": "flex-auth-secrets-engine",
|
|
"labels": {
|
|
"app.kubernetes.io/name": "flex-auth-secrets-engine",
|
|
"app.kubernetes.io/instance": "flex-auth-secrets-engine",
|
|
"app.kubernetes.io/part-of": "flex-auth"
|
|
}
|
|
},
|
|
"automountServiceAccountToken": false
|
|
},
|
|
{
|
|
"apiVersion": "v1",
|
|
"kind": "PersistentVolumeClaim",
|
|
"metadata": {
|
|
"name": "flex-auth-secrets-engine-outbox",
|
|
"annotations": {
|
|
"helm.sh/resource-policy": "keep"
|
|
},
|
|
"labels": {
|
|
"app.kubernetes.io/name": "flex-auth-secrets-engine",
|
|
"app.kubernetes.io/instance": "flex-auth-secrets-engine",
|
|
"app.kubernetes.io/part-of": "flex-auth"
|
|
}
|
|
},
|
|
"spec": {
|
|
"accessModes": [
|
|
"ReadWriteOnce"
|
|
],
|
|
"storageClassName": "local-path",
|
|
"resources": {
|
|
"requests": {
|
|
"storage": "1Gi"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"apiVersion": "rbac.authorization.k8s.io/v1",
|
|
"kind": "ClusterRole",
|
|
"metadata": {
|
|
"name": "flex-auth-secrets-engine-tokenreviewer",
|
|
"labels": {
|
|
"app.kubernetes.io/name": "flex-auth-secrets-engine",
|
|
"app.kubernetes.io/instance": "flex-auth-secrets-engine",
|
|
"app.kubernetes.io/part-of": "flex-auth"
|
|
}
|
|
},
|
|
"rules": [
|
|
{
|
|
"apiGroups": [
|
|
"authentication.k8s.io"
|
|
],
|
|
"resources": [
|
|
"tokenreviews"
|
|
],
|
|
"verbs": [
|
|
"create"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"apiVersion": "rbac.authorization.k8s.io/v1",
|
|
"kind": "ClusterRoleBinding",
|
|
"metadata": {
|
|
"name": "flex-auth-secrets-engine-tokenreviewer",
|
|
"labels": {
|
|
"app.kubernetes.io/name": "flex-auth-secrets-engine",
|
|
"app.kubernetes.io/instance": "flex-auth-secrets-engine",
|
|
"app.kubernetes.io/part-of": "flex-auth"
|
|
}
|
|
},
|
|
"roleRef": {
|
|
"apiGroup": "rbac.authorization.k8s.io",
|
|
"kind": "ClusterRole",
|
|
"name": "flex-auth-secrets-engine-tokenreviewer"
|
|
},
|
|
"subjects": [
|
|
{
|
|
"kind": "ServiceAccount",
|
|
"name": "flex-auth-secrets-engine",
|
|
"namespace": "flex-auth"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"apiVersion": "v1",
|
|
"kind": "Service",
|
|
"metadata": {
|
|
"name": "flex-auth-secrets-engine",
|
|
"labels": {
|
|
"app.kubernetes.io/name": "flex-auth-secrets-engine",
|
|
"app.kubernetes.io/instance": "flex-auth-secrets-engine",
|
|
"app.kubernetes.io/part-of": "flex-auth"
|
|
}
|
|
},
|
|
"spec": {
|
|
"selector": {
|
|
"app.kubernetes.io/name": "flex-auth-secrets-engine"
|
|
},
|
|
"ports": [
|
|
{
|
|
"name": "http",
|
|
"port": 8080,
|
|
"targetPort": "http"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"apiVersion": "apps/v1",
|
|
"kind": "Deployment",
|
|
"metadata": {
|
|
"name": "flex-auth-secrets-engine",
|
|
"labels": {
|
|
"app.kubernetes.io/name": "flex-auth-secrets-engine",
|
|
"app.kubernetes.io/instance": "flex-auth-secrets-engine",
|
|
"app.kubernetes.io/part-of": "flex-auth"
|
|
}
|
|
},
|
|
"spec": {
|
|
"strategy": {
|
|
"type": "Recreate"
|
|
},
|
|
"replicas": 0,
|
|
"selector": {
|
|
"matchLabels": {
|
|
"app.kubernetes.io/name": "flex-auth-secrets-engine"
|
|
}
|
|
},
|
|
"template": {
|
|
"metadata": {
|
|
"labels": {
|
|
"app.kubernetes.io/name": "flex-auth-secrets-engine",
|
|
"app.kubernetes.io/instance": "flex-auth-secrets-engine",
|
|
"app.kubernetes.io/part-of": "flex-auth"
|
|
}
|
|
},
|
|
"spec": {
|
|
"automountServiceAccountToken": false,
|
|
"serviceAccountName": "flex-auth-secrets-engine",
|
|
"securityContext": {
|
|
"runAsNonRoot": true,
|
|
"runAsUser": 65532,
|
|
"runAsGroup": 65532,
|
|
"fsGroup": 65532,
|
|
"seccompProfile": {
|
|
"type": "RuntimeDefault"
|
|
}
|
|
},
|
|
"containers": [
|
|
{
|
|
"name": "flex-auth",
|
|
"image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f",
|
|
"imagePullPolicy": "IfNotPresent",
|
|
"args": [
|
|
"serve",
|
|
"--addr",
|
|
"0.0.0.0:8080",
|
|
"--registry",
|
|
"/opt/flex-auth/examples/secrets-engine/registry_snapshot.json",
|
|
"--policy",
|
|
"/opt/flex-auth/examples/secrets-engine/policy_package.md",
|
|
"--envelope-signing-key-file",
|
|
"/var/run/secrets/decision-envelope-signing/seed",
|
|
"--envelope-signing-kid",
|
|
"flex-auth-lifecycle-20261016-r1",
|
|
"--outbox-max-bytes",
|
|
"67108864",
|
|
"--outbox-dir",
|
|
"/var/lib/flex-auth/outbox",
|
|
"--emission-source",
|
|
"flex-auth.secrets-engine",
|
|
"--caller-audience",
|
|
"flex-auth",
|
|
"--caller-auth-mode",
|
|
"enforce",
|
|
"--caller-kubernetes-url",
|
|
"https://10.43.0.1",
|
|
"--caller-binding",
|
|
"secrets-engine=system:serviceaccount:secrets-engine:secrets-engine"
|
|
],
|
|
"ports": [
|
|
{
|
|
"name": "http",
|
|
"containerPort": 8080
|
|
}
|
|
],
|
|
"livenessProbe": {
|
|
"httpGet": {
|
|
"path": "/healthz",
|
|
"port": "http"
|
|
},
|
|
"periodSeconds": 20
|
|
},
|
|
"readinessProbe": {
|
|
"httpGet": {
|
|
"path": "/healthz",
|
|
"port": "http"
|
|
},
|
|
"periodSeconds": 5
|
|
},
|
|
"resources": {
|
|
"limits": {
|
|
"cpu": "300m",
|
|
"memory": "192Mi"
|
|
},
|
|
"requests": {
|
|
"cpu": "25m",
|
|
"memory": "32Mi"
|
|
}
|
|
},
|
|
"securityContext": {
|
|
"allowPrivilegeEscalation": false,
|
|
"capabilities": {
|
|
"drop": [
|
|
"ALL"
|
|
]
|
|
},
|
|
"readOnlyRootFilesystem": true
|
|
},
|
|
"volumeMounts": [
|
|
{
|
|
"mountPath": "/var/run/secrets/decision-envelope-signing",
|
|
"name": "flex-auth-envelope-signing",
|
|
"readOnly": true
|
|
},
|
|
{
|
|
"mountPath": "/var/lib/flex-auth/outbox",
|
|
"name": "flex-auth-outbox"
|
|
},
|
|
{
|
|
"mountPath": "/var/run/secrets/flex-auth-reviewer",
|
|
"name": "flex-auth-reviewer",
|
|
"readOnly": true
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"volumes": [
|
|
{
|
|
"name": "flex-auth-envelope-signing",
|
|
"secret": {
|
|
"secretName": "flex-auth-secrets-engine-envelope-signing",
|
|
"defaultMode": 288,
|
|
"items": [
|
|
{
|
|
"key": "seed",
|
|
"path": "seed"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"name": "flex-auth-outbox",
|
|
"persistentVolumeClaim": {
|
|
"claimName": "flex-auth-secrets-engine-outbox"
|
|
}
|
|
},
|
|
{
|
|
"name": "flex-auth-reviewer",
|
|
"projected": {
|
|
"defaultMode": 288,
|
|
"sources": [
|
|
{
|
|
"serviceAccountToken": {
|
|
"expirationSeconds": 3600,
|
|
"path": "token"
|
|
}
|
|
},
|
|
{
|
|
"configMap": {
|
|
"name": "kube-root-ca.crt",
|
|
"items": [
|
|
{
|
|
"key": "ca.crt",
|
|
"path": "ca.crt"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"expected_projection": {
|
|
"service_account": "flex-auth-secrets-engine",
|
|
"image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f",
|
|
"args": [
|
|
"serve",
|
|
"--addr",
|
|
"0.0.0.0:8080",
|
|
"--registry",
|
|
"/opt/flex-auth/examples/secrets-engine/registry_snapshot.json",
|
|
"--policy",
|
|
"/opt/flex-auth/examples/secrets-engine/policy_package.md",
|
|
"--envelope-signing-key-file",
|
|
"/var/run/secrets/decision-envelope-signing/seed",
|
|
"--envelope-signing-kid",
|
|
"flex-auth-lifecycle-20261016-r1",
|
|
"--outbox-max-bytes",
|
|
"67108864",
|
|
"--outbox-dir",
|
|
"/var/lib/flex-auth/outbox",
|
|
"--emission-source",
|
|
"flex-auth.secrets-engine",
|
|
"--caller-audience",
|
|
"flex-auth",
|
|
"--caller-auth-mode",
|
|
"enforce",
|
|
"--caller-kubernetes-url",
|
|
"https://10.43.0.1",
|
|
"--caller-binding",
|
|
"secrets-engine=system:serviceaccount:secrets-engine:secrets-engine"
|
|
],
|
|
"volume_mounts": [
|
|
{
|
|
"mountPath": "/var/run/secrets/decision-envelope-signing",
|
|
"name": "flex-auth-envelope-signing",
|
|
"readOnly": true
|
|
},
|
|
{
|
|
"mountPath": "/var/lib/flex-auth/outbox",
|
|
"name": "flex-auth-outbox"
|
|
},
|
|
{
|
|
"mountPath": "/var/run/secrets/flex-auth-reviewer",
|
|
"name": "flex-auth-reviewer",
|
|
"readOnly": true
|
|
}
|
|
],
|
|
"volumes": [
|
|
{
|
|
"name": "flex-auth-envelope-signing",
|
|
"secret": {
|
|
"secretName": "flex-auth-secrets-engine-envelope-signing",
|
|
"defaultMode": 288,
|
|
"items": [
|
|
{
|
|
"key": "seed",
|
|
"path": "seed"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"name": "flex-auth-outbox",
|
|
"persistentVolumeClaim": {
|
|
"claimName": "flex-auth-secrets-engine-outbox"
|
|
}
|
|
},
|
|
{
|
|
"name": "flex-auth-reviewer",
|
|
"projected": {
|
|
"defaultMode": 288,
|
|
"sources": [
|
|
{
|
|
"serviceAccountToken": {
|
|
"expirationSeconds": 3600,
|
|
"path": "token"
|
|
}
|
|
},
|
|
{
|
|
"configMap": {
|
|
"name": "kube-root-ca.crt",
|
|
"items": [
|
|
{
|
|
"key": "ca.crt",
|
|
"path": "ca.crt"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
],
|
|
"security_context": {
|
|
"runAsNonRoot": true,
|
|
"runAsUser": 65532,
|
|
"runAsGroup": 65532,
|
|
"fsGroup": 65532,
|
|
"seccompProfile": {
|
|
"type": "RuntimeDefault"
|
|
}
|
|
}
|
|
}
|
|
}
|