mirror of
https://github.com/kerberos-io/helm-charts.git
synced 2026-11-12 21:30:24 +00:00
Compare commits
33
Commits
@@ -16,7 +16,7 @@ type: application
|
||||
# This is the chart version. This version number should be incremented each time you make changes
|
||||
# to the chart and its templates, including the app version.
|
||||
# Versions are expected to follow Semantic Versioning (https://semver.org/)
|
||||
version: 0.178.0
|
||||
version: 0.186.0
|
||||
|
||||
# This is the version number of the application being deployed. This version number should be
|
||||
# incremented each time you make changes to the application. Versions are not expected to
|
||||
|
||||
+226
-90
@@ -58,7 +58,7 @@ legacy opt-out, TLS/configuration mounts and deployment modes.
|
||||
### Hardened frontend images
|
||||
|
||||
Starting with chart **`0.170.0`**, both frontends default to shell-free
|
||||
`ghcr.io/uug-ai/hub-frontend:v1.19.28`, running as `65532:65532` on port `8080`
|
||||
`ghcr.io/uug-ai/hub-frontend:v1.19.35`, running as `65532:65532` on port `8080`
|
||||
with a read-only root filesystem and writable `/tmp`. The Service and ingress
|
||||
remain on port `80`. Admin retains its legacy image and port `80`; its hardened
|
||||
runtime remains opt-in.
|
||||
@@ -122,61 +122,35 @@ instructions below if the existing Deployment cannot be patched to `8080`.
|
||||
Run `bash scripts/check-frontend-runtime.sh` for default, demo, legacy override,
|
||||
and deployment-values regression coverage.
|
||||
|
||||
### Hardened Admin image (opt-in, chart 0.167.3)
|
||||
### Hardened Admin image (default since chart 0.184.0)
|
||||
|
||||
`charts/hub` deploys Admin in `all` and `ui` modes. Shell-free Admin `v1.4.3`
|
||||
runs as `65532:65532` and listens on `8080`, unlike the legacy image on `80`.
|
||||
Set these values together; the chart does not upgrade the image automatically:
|
||||
`charts/hub` deploys Admin in `all` and `ui` modes. Since chart **`0.184.0`** the
|
||||
default is the signed, shell-free `ghcr.io/uug-ai/admin` (`v1.4.6` since 0.185.0): it runs as
|
||||
`65532:65532` on `8080` with a read-only root filesystem, a memory-backed `/tmp`
|
||||
(`admin-tmp`, the only writable path) and `/healthz` probes. These settings are
|
||||
the defaults in `values.yaml`; keep them together with the image. Append extra
|
||||
volumes and mounts to the `admin.volumes` / `admin.volumeMounts` lists (Helm
|
||||
replaces lists in overrides). Memory-backed scratch counts against the pod memory
|
||||
limit. The `admin-svc` Service and Admin ingress use port `80`; the Service
|
||||
targets the named `http` container port. OAuth2-proxy is unchanged.
|
||||
|
||||
Only `ghcr.io/uug-ai` images are trusted (see *Image signature verification*).
|
||||
To run a legacy image on port `80` instead, restore all of these together:
|
||||
|
||||
```yaml
|
||||
admin:
|
||||
repository: ghcr.io/uug-ai/admin
|
||||
tag: v1.4.3
|
||||
containerPort: 8080
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
readOnlyRootFilesystem: true
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumes:
|
||||
- name: admin-tmp
|
||||
emptyDir:
|
||||
medium: Memory
|
||||
sizeLimit: 16Mi # Example; size for your runtime configuration.
|
||||
volumeMounts:
|
||||
- name: admin-tmp
|
||||
mountPath: /tmp
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
periodSeconds: 10
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
repository: uugai/admin
|
||||
tag: v1.3.0
|
||||
containerPort: 80
|
||||
securityContext: null
|
||||
readinessProbe: null
|
||||
livenessProbe: null
|
||||
volumes: null
|
||||
volumeMounts: null
|
||||
```
|
||||
|
||||
Merge the scratch volume with any existing mounts. Only `/tmp` is writable;
|
||||
application files remain read-only. Memory-backed scratch counts against the
|
||||
pod memory limit. The `admin-svc` Service and Admin ingress still use port `80`;
|
||||
the Service targets the named `http` container port. OAuth2-proxy is unchanged.
|
||||
Defaults remain port `80` with no security context, added volumes, or probes. Coordinate
|
||||
the image, values and a chart revision containing these settings: published
|
||||
`0.167.2` does not contain Admin runtime support.
|
||||
|
||||
Rollbacks to legacy images must restore port `80`, remove the hardened
|
||||
security context, and disable `/healthz` probes together. Run
|
||||
`bash scripts/check-admin-runtime.sh` from the repository root to verify
|
||||
legacy defaults, hardened runtime/probes, and unchanged OAuth2 routing.
|
||||
|
||||
Run `bash scripts/check-admin-runtime.sh` from the repository root to verify the
|
||||
hardened defaults, the legacy opt-out and unchanged OAuth2 routing.
|
||||
### Recovering a duplicate HTTP port during upgrades
|
||||
|
||||
Chart `0.169.1` publishes this recovery guidance. The helper is available in the
|
||||
@@ -327,13 +301,184 @@ Optional dataset mode also requires its own writable `ANPR_DATASET_DIR` mount.
|
||||
Models and application directories stay read-only.
|
||||
|
||||
This repository has **no Vault server or design-system chart**. The files named
|
||||
`vault-proxy` and `vault-forwarder` deploy different legacy applications; their
|
||||
ports are not the Vault server's port. Do not change them for `uug-ai/vault#119`.
|
||||
That proposed Vault image requires port `8080` (legacy `80`), UID/GID `65532`,
|
||||
read-only `/home/vault`, workload-sized writable `/run/vault`, and compatible
|
||||
ownership on existing optional `LOCAL_CACHE_DIRECTORY` mounts. Its liveness
|
||||
endpoint is `GET /api/health`. Wire those settings in the actual Vault deployment
|
||||
only when a compatible image release is selected; no migration is required.
|
||||
### Image signature verification (Kyverno)
|
||||
|
||||
Starting with chart **`0.179.0`**, the chart can verify that UUG.AI images are
|
||||
signed by UUG.AI. It is **opt-in** from chart **`0.179.1`** (in `0.179.0` it was
|
||||
on by default):
|
||||
|
||||
```yaml
|
||||
imageVerification:
|
||||
enabled: true
|
||||
```
|
||||
|
||||
When enabled and [Kyverno](https://kyverno.io) is installed in the cluster, it
|
||||
creates Kyverno policies in the release namespace. Without Kyverno (no
|
||||
`kyverno.io/v1` API), nothing is created even when enabled.
|
||||
|
||||
Signature policies use the Kyverno category **`Image signing`** and hardening
|
||||
policies **`Image hardening`** (chart `0.182.1`), so Policy Reporter and its
|
||||
dashboards can filter on each check separately.
|
||||
|
||||
Each policy is a plain, namespaced Kyverno `Policy` in its own file in
|
||||
`templates/kyverno/`, so it applies only to the release namespace. There is one
|
||||
per `ghcr.io/uug-ai` image the chart can deploy; each requires the image to be
|
||||
signed for its own `uug-ai/<image>` repository. "Mode" is the
|
||||
`validationFailureAction` the policy uses:
|
||||
|
||||
| Template | Image | Releases signed | Mode |
|
||||
|---|---|---|---|
|
||||
| `hub-api-signed-images.yaml` | `ghcr.io/uug-ai/hub-api` | ✅ signed | value |
|
||||
| `hub-cleanup-signed-images.yaml` | `ghcr.io/uug-ai/hub-cleanup` | ✅ signed | value |
|
||||
| `hub-frontend-signed-images.yaml` | `ghcr.io/uug-ai/hub-frontend` | ✅ signed | value |
|
||||
| `hub-loitering-signed-images.yaml` | `ghcr.io/uug-ai/hub-loitering` | ✅ signed | value |
|
||||
| `hub-monitor-device-signed-images.yaml` | `ghcr.io/uug-ai/hub-monitor-device` | ✅ signed | value |
|
||||
| `hub-workflows-signed-images.yaml` | `ghcr.io/uug-ai/hub-workflows` | ✅ signed | value |
|
||||
| `hub-pipeline-analysis-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-analysis` | ✅ signed | value |
|
||||
| `hub-pipeline-counting-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-counting` | ✅ signed | value |
|
||||
| `hub-pipeline-monitor-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-monitor` | ✅ signed | value |
|
||||
| `hub-pipeline-sequence-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-sequence` | ✅ signed | value |
|
||||
| `hub-pipeline-throttler-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-throttler` | ✅ signed | value |
|
||||
| `hub-audit-signed-images.yaml` | `ghcr.io/uug-ai/hub-audit` | ✅ signed (from v1.0.11) | value |
|
||||
| `hub-objecttracking-signed-images.yaml` | `ghcr.io/uug-ai/hub-objecttracking` | ✅ signed (from v1.0.10); `-gpu` image not yet | always `Audit` |
|
||||
| `hub-vlm-signed-images.yaml` | `ghcr.io/uug-ai/hub-vlm` | ✅ signed (from v1.0.8) | value |
|
||||
| `hub-pipeline-dominantcolors-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-dominantcolors` | ✅ signed (from v2.0.10) | value |
|
||||
| `hub-pipeline-event-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-event` | ✅ signed (from v1.3.10) | value |
|
||||
| `hub-pipeline-export-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-export` | ✅ signed (from v1.2.22) | value |
|
||||
| `hub-pipeline-notification-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-notification` | ✅ signed (from v1.3.48) | value |
|
||||
| `hub-pipeline-notification-test-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-notification-test` | ✅ signed (from v1.2.7) | value |
|
||||
| `hub-pipeline-sprite-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-sprite` | ✅ signed (from v1.1.28) | value |
|
||||
| `hub-pipeline-thumbnail-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-thumbnail` | ✅ signed (from v1.3.24) | value |
|
||||
| `admin-signed-images.yaml` | `ghcr.io/uug-ai/admin` | ✅ signed (from v1.4.5) | value |
|
||||
| `hub-reactivatesubscriptions-signed-images.yaml` | `ghcr.io/uug-ai/hub-reactivatesubscriptions` | ✅ signed (from v1.0.3, the first GHCR release) | value |
|
||||
|
||||
Since chart **`0.182.0`** every `ghcr.io/uug-ai` image's releases are signed, so
|
||||
every policy follows `imageVerification.validationFailureAction`, except
|
||||
`hub-objecttracking`: its GPU image (`<tag>-gpu`) is not signed yet, so that
|
||||
policy stays in `Audit` and enabling `Enforce` never blocks it. Images are signed
|
||||
from the release noted in the table; **older tags are unsigned and are rejected
|
||||
in `Enforce`**, so check the tags you run before enforcing. Since chart
|
||||
**`0.183.0`** the default image tags are signed releases, and since **`0.183.1`** hardened
|
||||
releases (with the attestation) for every image that has a hardening policy.
|
||||
|
||||
Since chart **`0.184.0`** only `ghcr.io/uug-ai` images are trusted:
|
||||
|
||||
- every UUG.AI image has a signature and a hardening policy, matching its
|
||||
`ghcr.io/uug-ai/<image>` repository only. Images that are not signed or
|
||||
hardened yet stay in `Audit` (the tables mark them), so they show up as
|
||||
failures in Policy Reporter without ever being blocked;
|
||||
- `trusted-registry.yaml` (category **`Image registry`**, `Audit`) reports a
|
||||
UUG.AI image (`uugai/...`, or a `uugai/` or `uug-ai/` organisation on any
|
||||
registry) that is not pulled from `ghcr.io/uug-ai`. Since **`0.185.1`** it
|
||||
ignores every other image in the namespace: workloads the chart doesn't
|
||||
deploy (agents, cert-manager solvers, other tools) and the third-party
|
||||
`quay.io/oauth2-proxy/oauth2-proxy` (pin that one to a version or digest
|
||||
rather than `:latest`).
|
||||
|
||||
Since chart **`0.185.0`** every UUG.AI image defaults to a signed, hardened
|
||||
release with the attestation (Admin `v1.4.6`, hub-reactivatesubscriptions
|
||||
`v1.0.3` on `ghcr.io/uug-ai`), and every policy follows its
|
||||
`validationFailureAction` value except `hub-objecttracking`'s, whose `-gpu`
|
||||
image is not signed or hardened yet.
|
||||
|
||||
To change a policy, edit its file. To add an image, copy a policy file and
|
||||
change the image and repository.
|
||||
|
||||
Every image is released with a keyless [cosign](https://docs.sigstore.dev)
|
||||
signature recorded in the public Rekor transparency log. A policy accepts an
|
||||
image only when its signature was:
|
||||
|
||||
- issued by GitHub Actions (`https://token.actions.githubusercontent.com`),
|
||||
- made by the UUG.AI release workflow
|
||||
(`uug-ai/workflows/.github/workflows/release-create.yml`), and
|
||||
- made **for the image's own repository** (for `hub-api`: `uug-ai/hub-api`).
|
||||
The release workflow is shared by all UUG.AI repositories, so this repository
|
||||
claim is what stops an image of one repository passing as another.
|
||||
|
||||
Signed means the image's releases are signed now; older tags of the same image
|
||||
can still be unsigned (for example `hub-api` `v1.11.38`) and are rejected in
|
||||
`Enforce`. Check the tags you run before enforcing.
|
||||
|
||||
By default the policies run in **`Audit`** mode: unsigned images are reported in
|
||||
Kyverno PolicyReports (for example in Policy Reporter) but still run. Once the
|
||||
reports are clean, block them:
|
||||
|
||||
```yaml
|
||||
imageVerification:
|
||||
enabled: true
|
||||
validationFailureAction: Enforce # Audit (default) or Enforce
|
||||
```
|
||||
|
||||
In both modes `failurePolicy: Ignore` keeps pods starting if Kyverno itself is
|
||||
unavailable, and `mutateDigest`/`verifyDigest: false` leave pod images as they
|
||||
are; those are set in the policy files.
|
||||
|
||||
The policies verify the images at `ghcr.io/uug-ai`. If you mirror the images to
|
||||
another registry, disable the chart's policies and apply your own copy with
|
||||
your registry in `imageReferences` (the mirror must also copy the cosign `.sig`
|
||||
artifacts). To check an image yourself:
|
||||
|
||||
```bash
|
||||
cosign verify ghcr.io/uug-ai/hub-api:v1.11.40 \
|
||||
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
|
||||
--certificate-identity-regexp '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@' \
|
||||
--certificate-github-workflow-repository uug-ai/hub-api
|
||||
```
|
||||
|
||||
### Image hardening verification (Kyverno)
|
||||
|
||||
Starting with chart **`0.181.0`**, the chart can also require images to come
|
||||
from a **hardened** UUG.AI release. A hardened release runs extra gates (tests,
|
||||
non-root runtime contract, read-only smoke test, vulnerability and secret scans,
|
||||
SBOM checks) and, only when all pass, adds a signed in-toto attestation of type
|
||||
`https://github.com/uug-ai/workflows/attestations/image-hardening/v1` with
|
||||
`result: passed` and the image's repository. This is separate from (and
|
||||
stricter than) the signature check above, and opt-in on its own:
|
||||
|
||||
```yaml
|
||||
imageHardening:
|
||||
enabled: true
|
||||
validationFailureAction: Audit # Audit (default) or Enforce
|
||||
```
|
||||
|
||||
When enabled and Kyverno is installed, it creates one namespaced `Policy` per
|
||||
image whose repository makes hardened releases, in `templates/kyverno/`:
|
||||
|
||||
| Template | Image |
|
||||
|---|---|
|
||||
| `hub-api-hardened-images.yaml` | `ghcr.io/uug-ai/hub-api` |
|
||||
| `hub-cleanup-hardened-images.yaml` | `ghcr.io/uug-ai/hub-cleanup` |
|
||||
| `hub-frontend-hardened-images.yaml` | `ghcr.io/uug-ai/hub-frontend` |
|
||||
| `hub-loitering-hardened-images.yaml` | `ghcr.io/uug-ai/hub-loitering` |
|
||||
| `hub-monitor-device-hardened-images.yaml` | `ghcr.io/uug-ai/hub-monitor-device` |
|
||||
| `hub-workflows-hardened-images.yaml` | `ghcr.io/uug-ai/hub-workflows` |
|
||||
| `hub-pipeline-analysis-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-analysis` |
|
||||
| `hub-pipeline-counting-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-counting` |
|
||||
| `hub-pipeline-monitor-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-monitor` |
|
||||
| `hub-pipeline-sequence-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-sequence` |
|
||||
| `hub-pipeline-throttler-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-throttler` |
|
||||
| `hub-audit-hardened-images.yaml` | `ghcr.io/uug-ai/hub-audit` (hardened from v1.0.12) |
|
||||
| `hub-objecttracking-hardened-images.yaml` | `ghcr.io/uug-ai/hub-objecttracking` (hardened from v1.0.11; `-gpu` image not yet; always `Audit`) |
|
||||
| `hub-vlm-hardened-images.yaml` | `ghcr.io/uug-ai/hub-vlm` (hardened from v1.0.9) |
|
||||
| `hub-pipeline-dominantcolors-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-dominantcolors` (hardened from v2.0.11) |
|
||||
| `hub-pipeline-event-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-event` (hardened from v1.3.11) |
|
||||
| `hub-pipeline-export-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-export` (hardened from v1.2.23) |
|
||||
| `hub-pipeline-notification-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-notification` (hardened from v1.3.49) |
|
||||
| `hub-pipeline-notification-test-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-notification-test` (hardened from v1.2.8) |
|
||||
| `hub-pipeline-sprite-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-sprite` (hardened from v1.1.29) |
|
||||
| `hub-pipeline-thumbnail-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-thumbnail` (hardened from v1.3.25) |
|
||||
| `admin-hardened-images.yaml` | `ghcr.io/uug-ai/admin` (hardened from v1.4.6) |
|
||||
| `hub-reactivatesubscriptions-hardened-images.yaml` | `ghcr.io/uug-ai/hub-reactivatesubscriptions` (hardened from v1.0.3) |
|
||||
|
||||
Each requires the attestation to be signed by the UUG.AI release workflow for
|
||||
the image's own repository, and its `result` and `repository` to be `passed`
|
||||
and `uug-ai/<image>`. Images whose repositories do not make hardened releases
|
||||
have no hardening policy.
|
||||
|
||||
Only releases made with hardening enabled after the attestation was introduced
|
||||
(November 2026) carry it, so most currently running versions fail this policy
|
||||
until their next hardened release. Keep it in `Audit` until the reports are
|
||||
clean.
|
||||
|
||||
### MCP
|
||||
|
||||
@@ -695,9 +840,9 @@ kerberospipeline:
|
||||
| `kerberosvault.sprite.provider` | Configuration value for `kerberosvault.sprite.provider`. | `"a-sprite-provider"` |
|
||||
| `kerberosvault.sprite.accessKey` | Access key for `kerberosvault.sprite`. | `"xxx"` |
|
||||
| `kerberosvault.sprite.secretKey` | Secret key for `kerberosvault.sprite`. | `"xxx"` |
|
||||
| `admin.repository` | Container image repository for `admin`. | `"uugai/admin"` |
|
||||
| `admin.repository` | Container image repository for `admin`. | `"ghcr.io/uug-ai/admin"` |
|
||||
| `admin.pullPolicy` | Image pull policy for `admin`. | `"IfNotPresent"` |
|
||||
| `admin.tag` | Container image tag/version for `admin`. | `"v1.3.0"` |
|
||||
| `admin.tag` | Container image tag/version for `admin`. | `"v1.4.6"` |
|
||||
| `admin.replicas` | Number of replicas for `admin`. | `2` |
|
||||
| `admin.logLevel` | Log verbosity level for `admin`. | `"info"` |
|
||||
| `admin.resources.requests.memory` | Memory request for `admin`. | `"100Mi"` |
|
||||
@@ -717,11 +862,14 @@ kerberospipeline:
|
||||
| `kerberoshub.serviceAccount.labels` | Labels applied to `kerberoshub.serviceAccount` resources. | `""` |
|
||||
| `kerberoshub.api.repository` | The Docker registry where the Kerberos Hub API container is hosted. | `"ghcr.io/uug-ai/hub-api"` |
|
||||
| `kerberoshub.api.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
|
||||
| `kerberoshub.api.tag` | The Docker image tag/version. | `"v1.9.8"` |
|
||||
| `kerberoshub.api.tag` | The Docker image tag/version. | `"v1.11.42"` |
|
||||
| `kerberoshub.api.replicas` | The number of pods/replicas running for the Kerberos Hub API deployment. | `2` |
|
||||
| `kerberoshub.api.audit.enabled` | Enable audit publishing from Hub API when global auditing is enabled. | `true` |
|
||||
| `kerberoshub.api.logLevel` | Log verbosity level for `kerberoshub.api`. | `"info"` |
|
||||
| `kerberoshub.api.jwtSecret` | A secret that is for generating JWT tokens. | `"this-is-a-secret-please-change-to-random-string"` |
|
||||
| `kerberoshub.api.session.accessTokenTimeout` | Lifetime of one access token (Go duration). The frontend renews it silently while the session is valid. | `"15m"` |
|
||||
| `kerberoshub.api.session.idleTimeout` | A session that is not used for this long ends (lifetime of the refresh token). | `"12h"` |
|
||||
| `kerberoshub.api.session.maxLifetime` | Hard session limit counted from login; refreshing never extends a session past it. | `"24h"` |
|
||||
| `kerberoshub.api.schema` | The protocol to serve the Kerberos Hub API, `'http'` or `'https'`. | `"https"` |
|
||||
| `kerberoshub.api.url` | The Kerberos Hub API ingress to access the API. | `"api.yourdomain.com"` |
|
||||
| `kerberoshub.api.corsAllowedOrigins` | Additional complete HTTP(S) origins allowed to call the Hub API. Configured frontend origins remain allowed automatically. | `[]` |
|
||||
@@ -775,7 +923,7 @@ kerberospipeline:
|
||||
| `kerberoshub.api.sso.extraHeaders.value` | Header value for each configured SSO extra header entry. | `""` |
|
||||
| `kerberoshub.frontend.repository` | The Docker registry where the Kerberos Hub frontend is hosted. | `"ghcr.io/uug-ai/hub-frontend"` |
|
||||
| `kerberoshub.frontend.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
|
||||
| `kerberoshub.frontend.tag` | The Docker image tag/version. | `"v1.9.11"` |
|
||||
| `kerberoshub.frontend.tag` | The Docker image tag/version. | `"v1.19.35"` |
|
||||
| `kerberoshub.frontend.replicas` | The number of pods/replicas running for the Kerberos Hub frontend deployment. | `2` |
|
||||
| `kerberoshub.frontend.logLevel` | Log verbosity level for `kerberoshub.frontend`. | `"info"` |
|
||||
| `kerberoshub.frontend.schema` | The protocol to serve the Kerberos Hub frontend, `'http'` or `'https'`. | `"https"` |
|
||||
@@ -899,7 +1047,7 @@ kerberospipeline:
|
||||
| `kerberoshub.oauth2Proxy.github.team` | Team value used by `kerberoshub.oauth2Proxy.github`. | `"github-team"` |
|
||||
| `kerberoshub.cleanup.repository` | The Docker container that is responsible for cleaning up the Kerberos Hub API content and related MongoDB collections. | `"ghcr.io/uug-ai/hub-cleanup"` |
|
||||
| `kerberoshub.cleanup.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
|
||||
| `kerberoshub.cleanup.tag` | The Docker image tag/version. | `"v1.4.13"` |
|
||||
| `kerberoshub.cleanup.tag` | The Docker image tag/version. | `"v1.4.27"` |
|
||||
| `kerberoshub.cleanup.replicas` | Number of replicas for `kerberoshub.cleanup`. | `1` |
|
||||
| `kerberoshub.cleanup.mode` | Cleanup service mode: `serve`, `dry-run`, or `version`. | `"serve"` |
|
||||
| `kerberoshub.cleanup.logLevel` | Log verbosity level for `kerberoshub.cleanup`. | `"info"` |
|
||||
@@ -927,7 +1075,7 @@ kerberospipeline:
|
||||
| `kerberoshub.cleanup.resources.requests.cpu` | CPU request for `kerberoshub.cleanup`. | `"10m"` |
|
||||
| `kerberoshub.audit.repository` | Hub audit service container image repository. | `"ghcr.io/uug-ai/hub-audit"` |
|
||||
| `kerberoshub.audit.pullPolicy` | Hub audit service image pull policy. | `"IfNotPresent"` |
|
||||
| `kerberoshub.audit.tag` | Hub audit service image tag. S3 destinations need v1.0.9 or later, and `s3.allowUnlockedBucket` needs v1.0.10. | `"v1.0.10"` |
|
||||
| `kerberoshub.audit.tag` | Hub audit service image tag. S3 destinations need v1.0.9 or later, and `s3.allowUnlockedBucket` needs v1.0.10. | `"v1.0.12"` |
|
||||
| `kerberoshub.audit.replicas` | Number of audit service replicas. Per-destination MongoDB leases prevent concurrent delivery. | `1` |
|
||||
| `kerberoshub.audit.dispatchInterval` | How often the mounted destination configuration is reloaded and eligible destinations are polled. | `"5s"` |
|
||||
| `kerberoshub.audit.leaseDuration` | Per-destination lease duration. It must exceed every destination timeout by at least 30 seconds. | `"2m"` |
|
||||
@@ -965,58 +1113,49 @@ kerberospipeline:
|
||||
| `kerberoshub.audit.topologySpreadConstraints` | Topology spread constraints for audit service pods. | `[]` |
|
||||
| `kerberoshub.monitordevice.repository` | The monitoring microservice, following up the status of your cameras and Kerberos Agents. | `"ghcr.io/uug-ai/hub-monitor-device"` |
|
||||
| `kerberoshub.monitordevice.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
|
||||
| `kerberoshub.monitordevice.tag` | The Docker image tag/version. | `"v1.4.0"` |
|
||||
| `kerberoshub.monitordevice.tag` | The Docker image tag/version. | `"v1.4.15"` |
|
||||
| `kerberoshub.monitordevice.replicas` | Number of replicas for `kerberoshub.monitordevice`. | `1` |
|
||||
| `kerberoshub.monitordevice.logLevel` | Log verbosity level for `kerberoshub.monitordevice`. | `"info"` |
|
||||
| `kerberoshub.monitordevice.scanIntervalSeconds` | Seconds between device status scans. Sets how quickly a camera going offline or online is detected. For accounts with "Group notifications" on, `hub-monitor-device` v1.4.10 and later then hold a change 20 seconds (`DEVICE_GROUPING_HOLD_SECONDS`) to collect other cameras that change status at the same time; older releases hold it one scan. | `60` |
|
||||
| `kerberoshub.monitordevice.resources.requests.memory` | Memory request for `kerberoshub.monitordevice`. | `"10Mi"` |
|
||||
| `kerberoshub.monitordevice.resources.requests.cpu` | CPU request for `kerberoshub.monitordevice`. | `"10m"` |
|
||||
| `kerberoshub.reactivate.repository` | Container image repository for `kerberoshub.reactivate`. | `"uugai/hub-reactivatesubscriptions"` |
|
||||
| `kerberoshub.reactivate.repository` | Container image repository for `kerberoshub.reactivate`. | `"ghcr.io/uug-ai/hub-reactivatesubscriptions"` |
|
||||
| `kerberoshub.reactivate.pullPolicy` | Image pull policy for `kerberoshub.reactivate`. | `"IfNotPresent"` |
|
||||
| `kerberoshub.reactivate.tag` | Container image tag/version for `kerberoshub.reactivate`. | `"v1.0.2"` |
|
||||
| `kerberoshub.reactivate.tag` | Container image tag/version for `kerberoshub.reactivate`. | `"v1.0.3"` |
|
||||
| `kerberoshub.reactivate.replicas` | Number of replicas for `kerberoshub.reactivate`. Set to `0` to disable. | `0` |
|
||||
| `kerberoshub.reactivate.logLevel` | Log verbosity level for `kerberoshub.reactivate`. | `"info"` |
|
||||
| `kerberoshub.reactivate.resources.requests.memory` | Memory request for `kerberoshub.reactivate`. | `"10Mi"` |
|
||||
| `kerberoshub.reactivate.resources.requests.cpu` | CPU request for `kerberoshub.reactivate`. | `"10m"` |
|
||||
| `kerberoshub.forwarder.enabled` | Enable or disable the Hub forwarder component. | `false` |
|
||||
| `kerberoshub.proxy.enabled` | Enable or disable the legacy Hub proxy Deployment and LoadBalancer Service. | `false` |
|
||||
| `kerberoshub.proxy.repository` | Container image repository for `kerberoshub.proxy`. | `"uugai/hub-proxy"` |
|
||||
| `kerberoshub.proxy.pullPolicy` | Image pull policy for `kerberoshub.proxy`. | `"IfNotPresent"` |
|
||||
| `kerberoshub.proxy.tag` | Container image tag/version for `kerberoshub.proxy`. | `"v1.0.0"` |
|
||||
| `kerberoshub.proxy.replicas` | Number of replicas for `kerberoshub.proxy` when enabled. | `0` |
|
||||
| `kerberoshub.proxy.logLevel` | Log verbosity level for `kerberoshub.proxy`. | `"info"` |
|
||||
| `kerberoshub.proxy.resources.requests.memory` | Memory request for `kerberoshub.proxy`. | `"10Mi"` |
|
||||
| `kerberoshub.proxy.resources.requests.cpu` | CPU request for `kerberoshub.proxy`. | `"10m"` |
|
||||
| `kerberospipeline.event.repository` | The [event orchestration](https://doc.kerberos.io/hub/pipeline/#orchestrator) microservice. | `"ghcr.io/uug-ai/hub-pipeline-event"` |
|
||||
| `kerberospipeline.event.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
|
||||
| `kerberospipeline.event.tag` | The Docker image tag/version. | `"v1.3.0"` |
|
||||
| `kerberospipeline.event.tag` | The Docker image tag/version. | `"v1.3.11"` |
|
||||
| `kerberospipeline.event.replicas` | Number of replicas for `kerberospipeline.event`. | `1` |
|
||||
| `kerberospipeline.event.logLevel` | Log verbosity level for `kerberospipeline.event`. | `"info"` |
|
||||
| `kerberospipeline.event.resources.requests.memory` | Memory request for `kerberospipeline.event`. | `"10Mi"` |
|
||||
| `kerberospipeline.event.resources.requests.cpu` | CPU request for `kerberospipeline.event`. | `"10m"` |
|
||||
| `kerberospipeline.monitor.repository` | The [monitoring microservice](https://doc.kerberos.io/hub/pipeline/#monitoring), calculating metrics of incoming messages. | `"ghcr.io/uug-ai/hub-pipeline-monitor"` |
|
||||
| `kerberospipeline.monitor.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
|
||||
| `kerberospipeline.monitor.tag` | The Docker image tag/version. | `"v1.3.9"` |
|
||||
| `kerberospipeline.monitor.tag` | The Docker image tag/version. | `"v1.3.30"` |
|
||||
| `kerberospipeline.monitor.replicas` | Number of replicas for `kerberospipeline.monitor`. | `1` |
|
||||
| `kerberospipeline.monitor.logLevel` | Monitor log level. Set to `debug` for per-event processing checkpoints. | `"info"` |
|
||||
| `kerberospipeline.monitor.resources.requests.memory` | Memory request for `kerberospipeline.monitor`. | `"10Mi"` |
|
||||
| `kerberospipeline.monitor.resources.requests.cpu` | CPU request for `kerberospipeline.monitor`. | `"10m"` |
|
||||
| `kerberospipeline.sequence.repository` | The [sequencer microservice](https://doc.kerberos.io/hub/pipeline/#sequencer), grouping recordings in chunks/groups. | `"ghcr.io/uug-ai/hub-pipeline-sequence"` |
|
||||
| `kerberospipeline.sequence.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
|
||||
| `kerberospipeline.sequence.tag` | The Docker image tag/version. | `"v1.6.18"` |
|
||||
| `kerberospipeline.sequence.tag` | The Docker image tag/version. | `"v1.7.15"` |
|
||||
| `kerberospipeline.sequence.replicas` | Number of replicas for `kerberospipeline.sequence`. | `1` |
|
||||
| `kerberospipeline.sequence.resources.requests.memory` | Memory request for `kerberospipeline.sequence`. | `"10Mi"` |
|
||||
| `kerberospipeline.sequence.resources.requests.cpu` | CPU request for `kerberospipeline.sequence`. | `"10m"` |
|
||||
| `kerberospipeline.throttler.repository` | The [throttler microservice](https://doc.kerberos.io/hub/pipeline/#throttler), throttling events. | `"uugai/hub-pipeline-throttler"` |
|
||||
| `kerberospipeline.throttler.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
|
||||
| `kerberospipeline.throttler.tag` | The Docker image tag/version. | `"v1.2.0"` |
|
||||
| `kerberospipeline.throttler.tag` | The Docker image tag/version. | `"v1.2.11"` |
|
||||
| `kerberospipeline.throttler.replicas` | Number of replicas for `kerberospipeline.throttler`. | `1` |
|
||||
| `kerberospipeline.throttler.logLevel` | Log verbosity level for `kerberospipeline.throttler`. | `"info"` |
|
||||
| `kerberospipeline.throttler.resources.requests.memory` | Memory request for `kerberospipeline.throttler`. | `"10Mi"` |
|
||||
| `kerberospipeline.throttler.resources.requests.cpu` | CPU request for `kerberospipeline.throttler`. | `"10m"` |
|
||||
| `kerberospipeline.notify.repository` | The [notification microservice](https://doc.kerberos.io/hub/pipeline/#notification), sending notifications on events. | `"ghcr.io/uug-ai/hub-pipeline-notification"` |
|
||||
| `kerberospipeline.notify.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
|
||||
| `kerberospipeline.notify.tag` | The Docker image tag/version. | `"v1.3.9"` |
|
||||
| `kerberospipeline.notify.tag` | The Docker image tag/version. | `"v1.3.49"` |
|
||||
| `kerberospipeline.notify.replicas` | Number of replicas for `kerberospipeline.notify`. | `1` |
|
||||
| `kerberospipeline.notify.audit.enabled` | Enable audit publishing from the notification worker when global auditing is enabled. | `true` |
|
||||
| `kerberospipeline.notify.logLevel` | Log verbosity level for `kerberospipeline.notify`. | `"info"` |
|
||||
@@ -1025,13 +1164,13 @@ kerberospipeline:
|
||||
| `kerberospipeline.notify.resources.requests.cpu` | CPU request for `kerberospipeline.notify`. | `"10m"` |
|
||||
| `kerberospipeline.notifyTest.repository` | The notification service for testing, the different channels. | `"uugai/hub-pipeline-notification-test"` |
|
||||
| `kerberospipeline.notifyTest.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
|
||||
| `kerberospipeline.notifyTest.tag` | The Docker image tag/version. | `"v1.2.1"` |
|
||||
| `kerberospipeline.notifyTest.tag` | The Docker image tag/version. | `"v1.2.8"` |
|
||||
| `kerberospipeline.notifyTest.replicas` | Number of replicas for `kerberospipeline.notifyTest`. | `1` |
|
||||
| `kerberospipeline.notifyTest.resources.requests.memory` | Memory request for `kerberospipeline.notifyTest`. | `"10Mi"` |
|
||||
| `kerberospipeline.notifyTest.resources.requests.cpu` | CPU request for `kerberospipeline.notifyTest`. | `"10m"` |
|
||||
| `kerberospipeline.analysis.repository` | The [analysis microservices](https://doc.kerberos.io/hub/pipeline/#analyser) which executed specific analysis in parallel. | `"ghcr.io/uug-ai/hub-pipeline-analysis"` |
|
||||
| `kerberospipeline.analysis.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
|
||||
| `kerberospipeline.analysis.tag` | The Docker image tag/version. | `"v1.7.8"` |
|
||||
| `kerberospipeline.analysis.tag` | The Docker image tag/version. | `"v1.8.31"` |
|
||||
| `kerberospipeline.analysis.replicas` | Number of replicas for `kerberospipeline.analysis`. | `1` |
|
||||
| `kerberospipeline.analysis.logLevel` | Log verbosity level for `kerberospipeline.analysis`. | `"info"` |
|
||||
| `kerberospipeline.analysis.thumbnailRegeneration.enabled` | Regenerate thumbnails from the first frame of a classified moving object (`THUMBNAIL_REGENERATION_ENABLED`). Adds up to one thumbnail job per classified recording. Requires an analysis image that reads the flag. | `false` |
|
||||
@@ -1043,7 +1182,7 @@ kerberospipeline:
|
||||
| `kerberospipeline.dominantColor.enabled` | Deploy `pipe-dominantcolor` and let the analysis stage schedule it (`DOMINANTCOLOR_ENABLED`). Requires an analysis image that reads the flag. | `false` |
|
||||
| `kerberospipeline.dominantColor.repository` | The dominant color microservices is computing a top 3 color histogram. | `"ghcr.io/uug-ai/hub-pipeline-dominantcolors"` |
|
||||
| `kerberospipeline.dominantColor.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
|
||||
| `kerberospipeline.dominantColor.tag` | The Docker image tag/version. | `"v2.0.2"` |
|
||||
| `kerberospipeline.dominantColor.tag` | The Docker image tag/version. | `"v2.0.11"` |
|
||||
| `kerberospipeline.dominantColor.replicas` | Number of replicas for `kerberospipeline.dominantColor`. | `3` |
|
||||
| `kerberospipeline.dominantColor.logLevel` | Log verbosity level for `kerberospipeline.dominantColor`. | `"info"` |
|
||||
| `kerberospipeline.dominantColor.resources.requests.memory` | Memory request for `kerberospipeline.dominantColor`. | `"512Mi"` |
|
||||
@@ -1052,7 +1191,7 @@ kerberospipeline:
|
||||
| `kerberospipeline.dominantColor.resources.limits.cpu` | CPU limit for `kerberospipeline.dominantColor`. | `"1000m"` |
|
||||
| `kerberospipeline.thumbnail.repository` | The thumbnail microservices generated a thumbnail for a recordings. | `"ghcr.io/uug-ai/hub-pipeline-thumbnail"` |
|
||||
| `kerberospipeline.thumbnail.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
|
||||
| `kerberospipeline.thumbnail.tag` | The Docker image tag/version. | `"v1.3.4"` |
|
||||
| `kerberospipeline.thumbnail.tag` | The Docker image tag/version. | `"v1.3.25"` |
|
||||
| `kerberospipeline.thumbnail.replicas` | Number of replicas for `kerberospipeline.thumbnail`. | `2` |
|
||||
| `kerberospipeline.thumbnail.prefetchCount` | Max unacknowledged RabbitMQ messages per pod (`RABBITMQ_PREFETCH_COUNT`); `0` keeps the service default of 5. Requires hub-pipeline-thumbnail ≥ v1.3.15. | `0` |
|
||||
| `kerberospipeline.sprite.prefetchCount` | Max unacknowledged RabbitMQ messages per pod (`RABBITMQ_PREFETCH_COUNT`); `0` keeps the service default of 5. Requires hub-pipeline-sprite ≥ v1.1.21. | `0` |
|
||||
@@ -1067,7 +1206,7 @@ kerberospipeline:
|
||||
| `kerberospipeline.thumbnail.resources.limits.cpu` | CPU limit for `kerberospipeline.thumbnail`. | `"1000m"` |
|
||||
| `kerberospipeline.counting.repository` | The counting microservices computes objects passing different line segments. | `"uugai/hub-pipeline-counting"` |
|
||||
| `kerberospipeline.counting.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
|
||||
| `kerberospipeline.counting.tag` | The Docker image tag/version. | `"v1.6.3"` |
|
||||
| `kerberospipeline.counting.tag` | The Docker image tag/version. | `"v2.0.7"` |
|
||||
| `kerberospipeline.counting.replicas` | Number of replicas for `kerberospipeline.counting`. | `1` |
|
||||
| `kerberospipeline.counting.logLevel` | Log verbosity level for `kerberospipeline.counting`. | `"info"` |
|
||||
| `kerberospipeline.counting.resources.requests.memory` | Memory request for `kerberospipeline.counting`. | `"10Mi"` |
|
||||
@@ -1075,7 +1214,7 @@ kerberospipeline:
|
||||
| `kerberospipeline.sprite.enabled` | Enable or disable `kerberospipeline.sprite`. | `false` |
|
||||
| `kerberospipeline.sprite.repository` | Container image repository for `kerberospipeline.sprite`. | `"ghcr.io/uug-ai/hub-pipeline-sprite"` |
|
||||
| `kerberospipeline.sprite.pullPolicy` | Image pull policy for `kerberospipeline.sprite`. | `"IfNotPresent"` |
|
||||
| `kerberospipeline.sprite.tag` | Container image tag/version for `kerberospipeline.sprite`. | `"v1.1.12"` |
|
||||
| `kerberospipeline.sprite.tag` | Container image tag/version for `kerberospipeline.sprite`. | `"v1.1.29"` |
|
||||
| `kerberospipeline.sprite.replicas` | Number of replicas for `kerberospipeline.sprite`. | `5` |
|
||||
| `kerberospipeline.sprite.logLevel` | Log verbosity level for `kerberospipeline.sprite`. | `"info"` |
|
||||
| `kerberospipeline.sprite.interval` | Configuration value for `kerberospipeline.sprite.interval`. | `"1"` |
|
||||
@@ -1087,7 +1226,7 @@ kerberospipeline:
|
||||
| `kerberospipeline.sprite.resources.limits.cpu` | CPU limit for `kerberospipeline.sprite`. | `"1000m"` |
|
||||
| `kerberospipeline.export.repository` | Container image repository for `kerberospipeline.export`. | `"ghcr.io/uug-ai/hub-pipeline-export"` |
|
||||
| `kerberospipeline.export.pullPolicy` | Image pull policy for `kerberospipeline.export`. | `"IfNotPresent"` |
|
||||
| `kerberospipeline.export.tag` | Container image tag/version for `kerberospipeline.export`. | `"v1.2.4"` |
|
||||
| `kerberospipeline.export.tag` | Container image tag/version for `kerberospipeline.export`. | `"v1.2.23"` |
|
||||
| `kerberospipeline.export.replicas` | Number of replicas for `kerberospipeline.export`. | `2` |
|
||||
| `kerberospipeline.export.logLevel` | Log verbosity level for `kerberospipeline.export`. | `"info"` |
|
||||
| `kerberospipeline.export.resources.requests.memory` | Memory request for `kerberospipeline.export`. | `"10Mi"` |
|
||||
@@ -1123,9 +1262,6 @@ kerberospipeline:
|
||||
| `email.templates.recordingTitle` | Email subject for recording check alerts. Empty uses "[Device] A camera stopped recording", "[Device] A camera is recording again" and their forms for several cameras. | `""` |
|
||||
| `email.mailgun.apiKey` | The Mailgun API key linked to your Mailgun domain. | `""` |
|
||||
| `imagePullSecrets.name` | Docker registry secret name, which is also granted with the license. This allows you to download the Docker images. | `""` |
|
||||
| `kerberoshub.forwarder.pullPolicy` | The Docker registry pull policy. | `""` |
|
||||
| `kerberoshub.forwarder.repository` | The Docker container which orchestrates forwarding coming from different Kerberos Vaults. | `""` |
|
||||
| `kerberoshub.forwarder.tag` | The Docker image tag/version. | `""` |
|
||||
| `kerberoshub.frontend.ssoDomain` | The domain that's being used to activate SSO from the login page. | `""` |
|
||||
| `kerberoshub.frontend.stripe.apikey` | If using the public version, `stripe` can be used for automated billing and subscriptions. | `""` |
|
||||
|
||||
|
||||
@@ -303,6 +303,12 @@ spec:
|
||||
value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}"
|
||||
- name: PUBLIC_URL
|
||||
value: "{{ .Values.kerberoshub.frontend.schema }}://{{ .Values.kerberoshub.frontend.url }}"
|
||||
- name: ACCESS_TOKEN_TIMEOUT
|
||||
value: {{ .Values.kerberoshub.api.session.accessTokenTimeout | quote }}
|
||||
- name: SESSION_IDLE_TIMEOUT
|
||||
value: {{ .Values.kerberoshub.api.session.idleTimeout | quote }}
|
||||
- name: SESSION_MAX_LIFETIME
|
||||
value: {{ .Values.kerberoshub.api.session.maxLifetime | quote }}
|
||||
- name: REFRESH_COOKIE_SECURE
|
||||
value: {{ eq .Values.kerberoshub.api.schema "https" | quote }}
|
||||
{{- $corsOrigins := list (printf "%s://%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.url) }}
|
||||
|
||||
@@ -1,76 +0,0 @@
|
||||
# If .Values.kerberoshub.forwarder.enabled is set to true
|
||||
{{- if and (eq .Values.mode "all") .Values.kerberoshub.forwarder.enabled }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: vault-forwarder
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: vault-forwarder
|
||||
minReadySeconds: 10
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
maxSurge: 1
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
|
||||
labels:
|
||||
app: vault-forwarder
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberoshub.forwarder.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- with .Values.kerberoshub.forwarder.volumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.forwarder.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: vault-forwarder
|
||||
image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.forwarder.repository }}:{{ .Values.kerberoshub.forwarder.tag }}"
|
||||
imagePullPolicy: {{ .Values.kerberoshub.forwarder.pullPolicy }}
|
||||
resources:
|
||||
requests:
|
||||
memory: 10Mi
|
||||
cpu: 10m
|
||||
{{- if or .Values.kerberoshub.forwarder.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- with .Values.kerberoshub.forwarder.volumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
env:
|
||||
{{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "vault-forwarder") | nindent 10 }}
|
||||
- name: ITERATION_SPEED
|
||||
value: "5"
|
||||
- name: BUFFER_TIME
|
||||
value: "3"
|
||||
- name: MQTT_URI
|
||||
value: "{{ .Values.mqtt.host }}"
|
||||
- name: MQTT_USERNAME
|
||||
value: "{{ .Values.mqtt.username }}"
|
||||
- name: MQTT_PASSWORD
|
||||
value: "{{ .Values.mqtt.password }}"
|
||||
{{- end }}
|
||||
@@ -1,78 +0,0 @@
|
||||
{{- if and (eq .Values.mode "all") .Values.kerberoshub.proxy.enabled -}}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: vault-proxy
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
replicas: {{ .Values.kerberoshub.proxy.replicas }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: vault-proxy
|
||||
minReadySeconds: 10
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
maxSurge: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: vault-proxy
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.proxy.volumes }}
|
||||
volumes:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.proxy.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: vault-proxy
|
||||
image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.proxy.repository }}:{{ .Values.kerberoshub.proxy.tag }}"
|
||||
imagePullPolicy: {{ .Values.kerberoshub.proxy.pullPolicy }}
|
||||
{{- with .Values.kerberoshub.proxy.volumeMounts }}
|
||||
volumeMounts:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
env:
|
||||
- name: LOG_LEVEL
|
||||
value: "{{ .Values.kerberoshub.proxy.logLevel }}"
|
||||
# Kerberos Hub API
|
||||
- name: KERBEROS_API_CHECK_SUBSCRIPTION
|
||||
value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}/user/has-subscription"
|
||||
# Kerberos Vault
|
||||
- name: KSTORAGE_URI
|
||||
value: "{{ .Values.kerberosvault.uri }}/storage"
|
||||
- name: KSTORAGE_ACCESSKEY
|
||||
value: "{{ .Values.kerberosvault.accesskey }}"
|
||||
- name: KSTORAGE_SECRET
|
||||
value: "{{ .Values.kerberosvault.secretkey }}"
|
||||
- name: KSTORAGE_PROVIDER
|
||||
value: "{{ .Values.kerberosvault.provider }}"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: vault-proxy-svc
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app: vault-proxy-svc
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 80
|
||||
targetPort: 8080
|
||||
name: http
|
||||
selector:
|
||||
app: vault-proxy
|
||||
{{- end }}
|
||||
@@ -0,0 +1,65 @@
|
||||
{{- /*
|
||||
admin images must come from a hardened release: they carry the signed
|
||||
image-hardening attestation (result "passed") that the UUG.AI release workflow
|
||||
adds after all hardening gates pass, for uug-ai/admin.
|
||||
The signature itself is checked by admin-signed-images.yaml.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageHardening.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: admin-hardened-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: admin images must come from a hardened UUG.AI release
|
||||
policies.kyverno.io/category: Image hardening
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, attestation required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report images without a hardened release, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop admin pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-admin-hardened
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/admin:*"
|
||||
- "ghcr.io/uug-ai/admin@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestations:
|
||||
- type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
githubWorkflowRepository: uug-ai/admin
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
# Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
|
||||
# syntax, escaped so Helm leaves it alone.
|
||||
conditions:
|
||||
- all:
|
||||
- key: "{{`{{ result }}`}}"
|
||||
operator: Equals
|
||||
value: passed
|
||||
- key: "{{`{{ repository }}`}}"
|
||||
operator: Equals
|
||||
value: uug-ai/admin
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
admin images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/admin.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: admin-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: admin images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Image signing
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop admin pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-admin
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/admin:*"
|
||||
- "ghcr.io/uug-ai/admin@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to admin's own repository.
|
||||
githubWorkflowRepository: uug-ai/admin
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,65 @@
|
||||
{{- /*
|
||||
hub-api images must come from a hardened release: they carry the signed
|
||||
image-hardening attestation (result "passed") that the UUG.AI release workflow
|
||||
adds after all hardening gates pass, for uug-ai/hub-api.
|
||||
The signature itself is checked by hub-api-signed-images.yaml.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageHardening.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-api-hardened-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-api images must come from a hardened UUG.AI release
|
||||
policies.kyverno.io/category: Image hardening
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, attestation required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report images without a hardened release, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-api pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-api-hardened
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-api:*"
|
||||
- "ghcr.io/uug-ai/hub-api@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestations:
|
||||
- type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
githubWorkflowRepository: uug-ai/hub-api
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
# Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
|
||||
# syntax, escaped so Helm leaves it alone.
|
||||
conditions:
|
||||
- all:
|
||||
- key: "{{`{{ result }}`}}"
|
||||
operator: Equals
|
||||
value: passed
|
||||
- key: "{{`{{ repository }}`}}"
|
||||
operator: Equals
|
||||
value: uug-ai/hub-api
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-api images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-api.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-api-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-api images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Image signing
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-api pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-api
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-api:*"
|
||||
- "ghcr.io/uug-ai/hub-api@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-api's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-api
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,65 @@
|
||||
{{- /*
|
||||
hub-audit images must come from a hardened release: they carry the signed
|
||||
image-hardening attestation (result "passed") that the UUG.AI release workflow
|
||||
adds after all hardening gates pass, for uug-ai/hub-audit.
|
||||
The signature itself is checked by hub-audit-signed-images.yaml.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageHardening.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-audit-hardened-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-audit images must come from a hardened UUG.AI release
|
||||
policies.kyverno.io/category: Image hardening
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, attestation required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report images without a hardened release, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-audit pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-audit-hardened
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-audit:*"
|
||||
- "ghcr.io/uug-ai/hub-audit@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestations:
|
||||
- type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
githubWorkflowRepository: uug-ai/hub-audit
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
# Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
|
||||
# syntax, escaped so Helm leaves it alone.
|
||||
conditions:
|
||||
- all:
|
||||
- key: "{{`{{ result }}`}}"
|
||||
operator: Equals
|
||||
value: passed
|
||||
- key: "{{`{{ repository }}`}}"
|
||||
operator: Equals
|
||||
value: uug-ai/hub-audit
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-audit images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-audit.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-audit-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-audit images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Image signing
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-audit pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-audit
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-audit:*"
|
||||
- "ghcr.io/uug-ai/hub-audit@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-audit's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-audit
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,65 @@
|
||||
{{- /*
|
||||
hub-cleanup images must come from a hardened release: they carry the signed
|
||||
image-hardening attestation (result "passed") that the UUG.AI release workflow
|
||||
adds after all hardening gates pass, for uug-ai/hub-cleanup.
|
||||
The signature itself is checked by hub-cleanup-signed-images.yaml.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageHardening.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-cleanup-hardened-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-cleanup images must come from a hardened UUG.AI release
|
||||
policies.kyverno.io/category: Image hardening
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, attestation required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report images without a hardened release, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-cleanup pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-cleanup-hardened
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-cleanup:*"
|
||||
- "ghcr.io/uug-ai/hub-cleanup@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestations:
|
||||
- type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
githubWorkflowRepository: uug-ai/hub-cleanup
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
# Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
|
||||
# syntax, escaped so Helm leaves it alone.
|
||||
conditions:
|
||||
- all:
|
||||
- key: "{{`{{ result }}`}}"
|
||||
operator: Equals
|
||||
value: passed
|
||||
- key: "{{`{{ repository }}`}}"
|
||||
operator: Equals
|
||||
value: uug-ai/hub-cleanup
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-cleanup images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-cleanup.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-cleanup-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-cleanup images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Image signing
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-cleanup pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-cleanup
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-cleanup:*"
|
||||
- "ghcr.io/uug-ai/hub-cleanup@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-cleanup's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-cleanup
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,65 @@
|
||||
{{- /*
|
||||
hub-frontend images must come from a hardened release: they carry the signed
|
||||
image-hardening attestation (result "passed") that the UUG.AI release workflow
|
||||
adds after all hardening gates pass, for uug-ai/hub-frontend.
|
||||
The signature itself is checked by hub-frontend-signed-images.yaml.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageHardening.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-frontend-hardened-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-frontend images must come from a hardened UUG.AI release
|
||||
policies.kyverno.io/category: Image hardening
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, attestation required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report images without a hardened release, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-frontend pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-frontend-hardened
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-frontend:*"
|
||||
- "ghcr.io/uug-ai/hub-frontend@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestations:
|
||||
- type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
githubWorkflowRepository: uug-ai/hub-frontend
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
# Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
|
||||
# syntax, escaped so Helm leaves it alone.
|
||||
conditions:
|
||||
- all:
|
||||
- key: "{{`{{ result }}`}}"
|
||||
operator: Equals
|
||||
value: passed
|
||||
- key: "{{`{{ repository }}`}}"
|
||||
operator: Equals
|
||||
value: uug-ai/hub-frontend
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-frontend images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-frontend.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-frontend-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-frontend images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Image signing
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-frontend pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-frontend
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-frontend:*"
|
||||
- "ghcr.io/uug-ai/hub-frontend@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-frontend's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-frontend
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,65 @@
|
||||
{{- /*
|
||||
hub-loitering images must come from a hardened release: they carry the signed
|
||||
image-hardening attestation (result "passed") that the UUG.AI release workflow
|
||||
adds after all hardening gates pass, for uug-ai/hub-loitering.
|
||||
The signature itself is checked by hub-loitering-signed-images.yaml.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageHardening.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-loitering-hardened-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-loitering images must come from a hardened UUG.AI release
|
||||
policies.kyverno.io/category: Image hardening
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, attestation required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report images without a hardened release, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-loitering pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-loitering-hardened
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-loitering:*"
|
||||
- "ghcr.io/uug-ai/hub-loitering@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestations:
|
||||
- type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
githubWorkflowRepository: uug-ai/hub-loitering
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
# Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
|
||||
# syntax, escaped so Helm leaves it alone.
|
||||
conditions:
|
||||
- all:
|
||||
- key: "{{`{{ result }}`}}"
|
||||
operator: Equals
|
||||
value: passed
|
||||
- key: "{{`{{ repository }}`}}"
|
||||
operator: Equals
|
||||
value: uug-ai/hub-loitering
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-loitering images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-loitering.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-loitering-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-loitering images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Image signing
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-loitering pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-loitering
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-loitering:*"
|
||||
- "ghcr.io/uug-ai/hub-loitering@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-loitering's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-loitering
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,65 @@
|
||||
{{- /*
|
||||
hub-monitor-device images must come from a hardened release: they carry the signed
|
||||
image-hardening attestation (result "passed") that the UUG.AI release workflow
|
||||
adds after all hardening gates pass, for uug-ai/hub-monitor-device.
|
||||
The signature itself is checked by hub-monitor-device-signed-images.yaml.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageHardening.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-monitor-device-hardened-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-monitor-device images must come from a hardened UUG.AI release
|
||||
policies.kyverno.io/category: Image hardening
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, attestation required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report images without a hardened release, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-monitor-device pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-monitor-device-hardened
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-monitor-device:*"
|
||||
- "ghcr.io/uug-ai/hub-monitor-device@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestations:
|
||||
- type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
githubWorkflowRepository: uug-ai/hub-monitor-device
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
# Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
|
||||
# syntax, escaped so Helm leaves it alone.
|
||||
conditions:
|
||||
- all:
|
||||
- key: "{{`{{ result }}`}}"
|
||||
operator: Equals
|
||||
value: passed
|
||||
- key: "{{`{{ repository }}`}}"
|
||||
operator: Equals
|
||||
value: uug-ai/hub-monitor-device
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-monitor-device images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-monitor-device.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-monitor-device-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-monitor-device images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Image signing
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-monitor-device pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-monitor-device
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-monitor-device:*"
|
||||
- "ghcr.io/uug-ai/hub-monitor-device@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-monitor-device's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-monitor-device
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,68 @@
|
||||
{{- /*
|
||||
hub-objecttracking images must come from a hardened release: they carry the signed
|
||||
image-hardening attestation (result "passed") that the UUG.AI release workflow
|
||||
adds after all hardening gates pass, for uug-ai/hub-objecttracking.
|
||||
The signature itself is checked by hub-objecttracking-signed-images.yaml.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageHardening.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-objecttracking-hardened-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-objecttracking images must come from a hardened UUG.AI release
|
||||
policies.kyverno.io/category: Image hardening
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, attestation required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# The standard image is hardened (from v1.0.11), but its `-gpu` image is not:
|
||||
# it is built outside the shared release workflow. This policy stays in Audit,
|
||||
# even when imageHardening.validationFailureAction is Enforce. Once the `-gpu`
|
||||
# image is hardened, use the same line as hub-api-hardened-images.yaml.
|
||||
validationFailureAction: Audit
|
||||
# Kyverno's default (Fail) would stop hub-objecttracking pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-objecttracking-hardened
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-objecttracking:*"
|
||||
- "ghcr.io/uug-ai/hub-objecttracking@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestations:
|
||||
- type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
githubWorkflowRepository: uug-ai/hub-objecttracking
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
# Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
|
||||
# syntax, escaped so Helm leaves it alone.
|
||||
conditions:
|
||||
- all:
|
||||
- key: "{{`{{ result }}`}}"
|
||||
operator: Equals
|
||||
value: passed
|
||||
- key: "{{`{{ repository }}`}}"
|
||||
operator: Equals
|
||||
value: uug-ai/hub-objecttracking
|
||||
{{- end }}
|
||||
@@ -0,0 +1,57 @@
|
||||
{{- /*
|
||||
hub-objecttracking images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-objecttracking.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-objecttracking-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-objecttracking images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Image signing
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# hub-objecttracking releases are signed (from v1.0.10), but the GPU image
|
||||
# (<tag>-gpu, built by the repository's release-gpu-image.yml) is not, and this
|
||||
# policy matches every hub-objecttracking tag. It therefore stays in Audit even
|
||||
# when imageVerification.validationFailureAction is Enforce, until the GPU
|
||||
# image is signed too. Then use the same line as hub-api-signed-images.yaml.
|
||||
validationFailureAction: Audit
|
||||
# Kyverno's default (Fail) would stop hub-objecttracking pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-objecttracking
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-objecttracking:*"
|
||||
- "ghcr.io/uug-ai/hub-objecttracking@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-objecttracking's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-objecttracking
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,65 @@
|
||||
{{- /*
|
||||
hub-pipeline-analysis images must come from a hardened release: they carry the signed
|
||||
image-hardening attestation (result "passed") that the UUG.AI release workflow
|
||||
adds after all hardening gates pass, for uug-ai/hub-pipeline-analysis.
|
||||
The signature itself is checked by hub-pipeline-analysis-signed-images.yaml.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageHardening.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-analysis-hardened-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-analysis images must come from a hardened UUG.AI release
|
||||
policies.kyverno.io/category: Image hardening
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, attestation required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report images without a hardened release, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-analysis pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-analysis-hardened
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-analysis:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-analysis@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestations:
|
||||
- type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-analysis
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
# Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
|
||||
# syntax, escaped so Helm leaves it alone.
|
||||
conditions:
|
||||
- all:
|
||||
- key: "{{`{{ result }}`}}"
|
||||
operator: Equals
|
||||
value: passed
|
||||
- key: "{{`{{ repository }}`}}"
|
||||
operator: Equals
|
||||
value: uug-ai/hub-pipeline-analysis
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-pipeline-analysis images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-analysis.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-analysis-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-analysis images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Image signing
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-analysis pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-analysis
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-analysis:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-analysis@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-pipeline-analysis's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-analysis
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,65 @@
|
||||
{{- /*
|
||||
hub-pipeline-counting images must come from a hardened release: they carry the signed
|
||||
image-hardening attestation (result "passed") that the UUG.AI release workflow
|
||||
adds after all hardening gates pass, for uug-ai/hub-pipeline-counting.
|
||||
The signature itself is checked by hub-pipeline-counting-signed-images.yaml.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageHardening.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-counting-hardened-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-counting images must come from a hardened UUG.AI release
|
||||
policies.kyverno.io/category: Image hardening
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, attestation required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report images without a hardened release, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-counting pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-counting-hardened
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-counting:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-counting@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestations:
|
||||
- type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-counting
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
# Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
|
||||
# syntax, escaped so Helm leaves it alone.
|
||||
conditions:
|
||||
- all:
|
||||
- key: "{{`{{ result }}`}}"
|
||||
operator: Equals
|
||||
value: passed
|
||||
- key: "{{`{{ repository }}`}}"
|
||||
operator: Equals
|
||||
value: uug-ai/hub-pipeline-counting
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-pipeline-counting images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-counting.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-counting-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-counting images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Image signing
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-counting pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-counting
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-counting:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-counting@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-pipeline-counting's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-counting
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,65 @@
|
||||
{{- /*
|
||||
hub-pipeline-dominantcolors images must come from a hardened release: they carry the signed
|
||||
image-hardening attestation (result "passed") that the UUG.AI release workflow
|
||||
adds after all hardening gates pass, for uug-ai/hub-pipeline-dominantcolors.
|
||||
The signature itself is checked by hub-pipeline-dominantcolors-signed-images.yaml.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageHardening.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-dominantcolors-hardened-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-dominantcolors images must come from a hardened UUG.AI release
|
||||
policies.kyverno.io/category: Image hardening
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, attestation required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report images without a hardened release, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-dominantcolors pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-dominantcolors-hardened
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-dominantcolors:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-dominantcolors@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestations:
|
||||
- type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-dominantcolors
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
# Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
|
||||
# syntax, escaped so Helm leaves it alone.
|
||||
conditions:
|
||||
- all:
|
||||
- key: "{{`{{ result }}`}}"
|
||||
operator: Equals
|
||||
value: passed
|
||||
- key: "{{`{{ repository }}`}}"
|
||||
operator: Equals
|
||||
value: uug-ai/hub-pipeline-dominantcolors
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-pipeline-dominantcolors images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-dominantcolors.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-dominantcolors-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-dominantcolors images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Image signing
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-dominantcolors pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-dominantcolors
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-dominantcolors:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-dominantcolors@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-pipeline-dominantcolors's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-dominantcolors
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,65 @@
|
||||
{{- /*
|
||||
hub-pipeline-event images must come from a hardened release: they carry the signed
|
||||
image-hardening attestation (result "passed") that the UUG.AI release workflow
|
||||
adds after all hardening gates pass, for uug-ai/hub-pipeline-event.
|
||||
The signature itself is checked by hub-pipeline-event-signed-images.yaml.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageHardening.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-event-hardened-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-event images must come from a hardened UUG.AI release
|
||||
policies.kyverno.io/category: Image hardening
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, attestation required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report images without a hardened release, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-event pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-event-hardened
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-event:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-event@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestations:
|
||||
- type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-event
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
# Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
|
||||
# syntax, escaped so Helm leaves it alone.
|
||||
conditions:
|
||||
- all:
|
||||
- key: "{{`{{ result }}`}}"
|
||||
operator: Equals
|
||||
value: passed
|
||||
- key: "{{`{{ repository }}`}}"
|
||||
operator: Equals
|
||||
value: uug-ai/hub-pipeline-event
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-pipeline-event images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-event.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-event-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-event images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Image signing
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-event pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-event
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-event:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-event@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-pipeline-event's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-event
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,65 @@
|
||||
{{- /*
|
||||
hub-pipeline-export images must come from a hardened release: they carry the signed
|
||||
image-hardening attestation (result "passed") that the UUG.AI release workflow
|
||||
adds after all hardening gates pass, for uug-ai/hub-pipeline-export.
|
||||
The signature itself is checked by hub-pipeline-export-signed-images.yaml.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageHardening.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-export-hardened-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-export images must come from a hardened UUG.AI release
|
||||
policies.kyverno.io/category: Image hardening
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, attestation required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report images without a hardened release, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-export pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-export-hardened
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-export:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-export@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestations:
|
||||
- type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-export
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
# Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
|
||||
# syntax, escaped so Helm leaves it alone.
|
||||
conditions:
|
||||
- all:
|
||||
- key: "{{`{{ result }}`}}"
|
||||
operator: Equals
|
||||
value: passed
|
||||
- key: "{{`{{ repository }}`}}"
|
||||
operator: Equals
|
||||
value: uug-ai/hub-pipeline-export
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-pipeline-export images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-export.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-export-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-export images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Image signing
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-export pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-export
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-export:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-export@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-pipeline-export's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-export
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,65 @@
|
||||
{{- /*
|
||||
hub-pipeline-monitor images must come from a hardened release: they carry the signed
|
||||
image-hardening attestation (result "passed") that the UUG.AI release workflow
|
||||
adds after all hardening gates pass, for uug-ai/hub-pipeline-monitor.
|
||||
The signature itself is checked by hub-pipeline-monitor-signed-images.yaml.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageHardening.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-monitor-hardened-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-monitor images must come from a hardened UUG.AI release
|
||||
policies.kyverno.io/category: Image hardening
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, attestation required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report images without a hardened release, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-monitor pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-monitor-hardened
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-monitor:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-monitor@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestations:
|
||||
- type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-monitor
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
# Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
|
||||
# syntax, escaped so Helm leaves it alone.
|
||||
conditions:
|
||||
- all:
|
||||
- key: "{{`{{ result }}`}}"
|
||||
operator: Equals
|
||||
value: passed
|
||||
- key: "{{`{{ repository }}`}}"
|
||||
operator: Equals
|
||||
value: uug-ai/hub-pipeline-monitor
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-pipeline-monitor images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-monitor.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-monitor-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-monitor images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Image signing
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-monitor pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-monitor
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-monitor:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-monitor@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-pipeline-monitor's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-monitor
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,65 @@
|
||||
{{- /*
|
||||
hub-pipeline-notification images must come from a hardened release: they carry the signed
|
||||
image-hardening attestation (result "passed") that the UUG.AI release workflow
|
||||
adds after all hardening gates pass, for uug-ai/hub-pipeline-notification.
|
||||
The signature itself is checked by hub-pipeline-notification-signed-images.yaml.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageHardening.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-notification-hardened-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-notification images must come from a hardened UUG.AI release
|
||||
policies.kyverno.io/category: Image hardening
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, attestation required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report images without a hardened release, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-notification pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-notification-hardened
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-notification:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-notification@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestations:
|
||||
- type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-notification
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
# Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
|
||||
# syntax, escaped so Helm leaves it alone.
|
||||
conditions:
|
||||
- all:
|
||||
- key: "{{`{{ result }}`}}"
|
||||
operator: Equals
|
||||
value: passed
|
||||
- key: "{{`{{ repository }}`}}"
|
||||
operator: Equals
|
||||
value: uug-ai/hub-pipeline-notification
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-pipeline-notification images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-notification.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-notification-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-notification images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Image signing
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-notification pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-notification
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-notification:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-notification@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-pipeline-notification's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-notification
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,65 @@
|
||||
{{- /*
|
||||
hub-pipeline-notification-test images must come from a hardened release: they carry the signed
|
||||
image-hardening attestation (result "passed") that the UUG.AI release workflow
|
||||
adds after all hardening gates pass, for uug-ai/hub-pipeline-notification-test.
|
||||
The signature itself is checked by hub-pipeline-notification-test-signed-images.yaml.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageHardening.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-notification-test-hardened-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-notification-test images must come from a hardened UUG.AI release
|
||||
policies.kyverno.io/category: Image hardening
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, attestation required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report images without a hardened release, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-notification-test pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-notification-test-hardened
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-notification-test:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-notification-test@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestations:
|
||||
- type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-notification-test
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
# Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
|
||||
# syntax, escaped so Helm leaves it alone.
|
||||
conditions:
|
||||
- all:
|
||||
- key: "{{`{{ result }}`}}"
|
||||
operator: Equals
|
||||
value: passed
|
||||
- key: "{{`{{ repository }}`}}"
|
||||
operator: Equals
|
||||
value: uug-ai/hub-pipeline-notification-test
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-pipeline-notification-test images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-notification-test.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-notification-test-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-notification-test images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Image signing
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-notification-test pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-notification-test
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-notification-test:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-notification-test@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-pipeline-notification-test's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-notification-test
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,65 @@
|
||||
{{- /*
|
||||
hub-pipeline-sequence images must come from a hardened release: they carry the signed
|
||||
image-hardening attestation (result "passed") that the UUG.AI release workflow
|
||||
adds after all hardening gates pass, for uug-ai/hub-pipeline-sequence.
|
||||
The signature itself is checked by hub-pipeline-sequence-signed-images.yaml.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageHardening.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-sequence-hardened-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-sequence images must come from a hardened UUG.AI release
|
||||
policies.kyverno.io/category: Image hardening
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, attestation required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report images without a hardened release, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-sequence pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-sequence-hardened
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-sequence:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-sequence@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestations:
|
||||
- type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-sequence
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
# Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
|
||||
# syntax, escaped so Helm leaves it alone.
|
||||
conditions:
|
||||
- all:
|
||||
- key: "{{`{{ result }}`}}"
|
||||
operator: Equals
|
||||
value: passed
|
||||
- key: "{{`{{ repository }}`}}"
|
||||
operator: Equals
|
||||
value: uug-ai/hub-pipeline-sequence
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-pipeline-sequence images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-sequence.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-sequence-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-sequence images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Image signing
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-sequence pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-sequence
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-sequence:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-sequence@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-pipeline-sequence's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-sequence
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,65 @@
|
||||
{{- /*
|
||||
hub-pipeline-sprite images must come from a hardened release: they carry the signed
|
||||
image-hardening attestation (result "passed") that the UUG.AI release workflow
|
||||
adds after all hardening gates pass, for uug-ai/hub-pipeline-sprite.
|
||||
The signature itself is checked by hub-pipeline-sprite-signed-images.yaml.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageHardening.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-sprite-hardened-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-sprite images must come from a hardened UUG.AI release
|
||||
policies.kyverno.io/category: Image hardening
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, attestation required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report images without a hardened release, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-sprite pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-sprite-hardened
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-sprite:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-sprite@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestations:
|
||||
- type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-sprite
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
# Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
|
||||
# syntax, escaped so Helm leaves it alone.
|
||||
conditions:
|
||||
- all:
|
||||
- key: "{{`{{ result }}`}}"
|
||||
operator: Equals
|
||||
value: passed
|
||||
- key: "{{`{{ repository }}`}}"
|
||||
operator: Equals
|
||||
value: uug-ai/hub-pipeline-sprite
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-pipeline-sprite images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-sprite.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-sprite-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-sprite images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Image signing
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-sprite pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-sprite
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-sprite:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-sprite@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-pipeline-sprite's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-sprite
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,65 @@
|
||||
{{- /*
|
||||
hub-pipeline-throttler images must come from a hardened release: they carry the signed
|
||||
image-hardening attestation (result "passed") that the UUG.AI release workflow
|
||||
adds after all hardening gates pass, for uug-ai/hub-pipeline-throttler.
|
||||
The signature itself is checked by hub-pipeline-throttler-signed-images.yaml.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageHardening.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-throttler-hardened-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-throttler images must come from a hardened UUG.AI release
|
||||
policies.kyverno.io/category: Image hardening
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, attestation required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report images without a hardened release, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-throttler pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-throttler-hardened
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-throttler:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-throttler@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestations:
|
||||
- type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-throttler
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
# Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
|
||||
# syntax, escaped so Helm leaves it alone.
|
||||
conditions:
|
||||
- all:
|
||||
- key: "{{`{{ result }}`}}"
|
||||
operator: Equals
|
||||
value: passed
|
||||
- key: "{{`{{ repository }}`}}"
|
||||
operator: Equals
|
||||
value: uug-ai/hub-pipeline-throttler
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-pipeline-throttler images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-throttler.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-throttler-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-throttler images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Image signing
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-throttler pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-throttler
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-throttler:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-throttler@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-pipeline-throttler's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-throttler
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,65 @@
|
||||
{{- /*
|
||||
hub-pipeline-thumbnail images must come from a hardened release: they carry the signed
|
||||
image-hardening attestation (result "passed") that the UUG.AI release workflow
|
||||
adds after all hardening gates pass, for uug-ai/hub-pipeline-thumbnail.
|
||||
The signature itself is checked by hub-pipeline-thumbnail-signed-images.yaml.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageHardening.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-thumbnail-hardened-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-thumbnail images must come from a hardened UUG.AI release
|
||||
policies.kyverno.io/category: Image hardening
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, attestation required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report images without a hardened release, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-thumbnail pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-thumbnail-hardened
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-thumbnail:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-thumbnail@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestations:
|
||||
- type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-thumbnail
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
# Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
|
||||
# syntax, escaped so Helm leaves it alone.
|
||||
conditions:
|
||||
- all:
|
||||
- key: "{{`{{ result }}`}}"
|
||||
operator: Equals
|
||||
value: passed
|
||||
- key: "{{`{{ repository }}`}}"
|
||||
operator: Equals
|
||||
value: uug-ai/hub-pipeline-thumbnail
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-pipeline-thumbnail images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-thumbnail.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-thumbnail-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-thumbnail images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Image signing
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-thumbnail pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-thumbnail
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-thumbnail:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-thumbnail@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-pipeline-thumbnail's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-thumbnail
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,65 @@
|
||||
{{- /*
|
||||
hub-reactivatesubscriptions images must come from a hardened release: they carry the signed
|
||||
image-hardening attestation (result "passed") that the UUG.AI release workflow
|
||||
adds after all hardening gates pass, for uug-ai/hub-reactivatesubscriptions.
|
||||
The signature itself is checked by hub-reactivatesubscriptions-signed-images.yaml.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageHardening.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-reactivatesubscriptions-hardened-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-reactivatesubscriptions images must come from a hardened UUG.AI release
|
||||
policies.kyverno.io/category: Image hardening
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, attestation required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report images without a hardened release, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-reactivatesubscriptions pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-reactivatesubscriptions-hardened
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-reactivatesubscriptions:*"
|
||||
- "ghcr.io/uug-ai/hub-reactivatesubscriptions@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestations:
|
||||
- type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
githubWorkflowRepository: uug-ai/hub-reactivatesubscriptions
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
# Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
|
||||
# syntax, escaped so Helm leaves it alone.
|
||||
conditions:
|
||||
- all:
|
||||
- key: "{{`{{ result }}`}}"
|
||||
operator: Equals
|
||||
value: passed
|
||||
- key: "{{`{{ repository }}`}}"
|
||||
operator: Equals
|
||||
value: uug-ai/hub-reactivatesubscriptions
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-reactivatesubscriptions images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-reactivatesubscriptions.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-reactivatesubscriptions-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-reactivatesubscriptions images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Image signing
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-reactivatesubscriptions pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-reactivatesubscriptions
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-reactivatesubscriptions:*"
|
||||
- "ghcr.io/uug-ai/hub-reactivatesubscriptions@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-reactivatesubscriptions's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-reactivatesubscriptions
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,65 @@
|
||||
{{- /*
|
||||
hub-vlm images must come from a hardened release: they carry the signed
|
||||
image-hardening attestation (result "passed") that the UUG.AI release workflow
|
||||
adds after all hardening gates pass, for uug-ai/hub-vlm.
|
||||
The signature itself is checked by hub-vlm-signed-images.yaml.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageHardening.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-vlm-hardened-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-vlm images must come from a hardened UUG.AI release
|
||||
policies.kyverno.io/category: Image hardening
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, attestation required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report images without a hardened release, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-vlm pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-vlm-hardened
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-vlm:*"
|
||||
- "ghcr.io/uug-ai/hub-vlm@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestations:
|
||||
- type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
githubWorkflowRepository: uug-ai/hub-vlm
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
# Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
|
||||
# syntax, escaped so Helm leaves it alone.
|
||||
conditions:
|
||||
- all:
|
||||
- key: "{{`{{ result }}`}}"
|
||||
operator: Equals
|
||||
value: passed
|
||||
- key: "{{`{{ repository }}`}}"
|
||||
operator: Equals
|
||||
value: uug-ai/hub-vlm
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-vlm images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-vlm.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-vlm-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-vlm images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Image signing
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-vlm pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-vlm
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-vlm:*"
|
||||
- "ghcr.io/uug-ai/hub-vlm@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-vlm's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-vlm
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,65 @@
|
||||
{{- /*
|
||||
hub-workflows images must come from a hardened release: they carry the signed
|
||||
image-hardening attestation (result "passed") that the UUG.AI release workflow
|
||||
adds after all hardening gates pass, for uug-ai/hub-workflows.
|
||||
The signature itself is checked by hub-workflows-signed-images.yaml.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageHardening.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-workflows-hardened-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-workflows images must come from a hardened UUG.AI release
|
||||
policies.kyverno.io/category: Image hardening
|
||||
policies.kyverno.io/severity: medium
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, attestation required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report images without a hardened release, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-workflows pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-workflows-hardened
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-workflows:*"
|
||||
- "ghcr.io/uug-ai/hub-workflows@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestations:
|
||||
- type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
githubWorkflowRepository: uug-ai/hub-workflows
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
# Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
|
||||
# syntax, escaped so Helm leaves it alone.
|
||||
conditions:
|
||||
- all:
|
||||
- key: "{{`{{ result }}`}}"
|
||||
operator: Equals
|
||||
value: passed
|
||||
- key: "{{`{{ repository }}`}}"
|
||||
operator: Equals
|
||||
value: uug-ai/hub-workflows
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-workflows images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-workflows.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-workflows-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-workflows images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Image signing
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-workflows pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-workflows
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-workflows:*"
|
||||
- "ghcr.io/uug-ai/hub-workflows@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-workflows's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-workflows
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,54 @@
|
||||
{{- /*
|
||||
UUG.AI images are trusted only from ghcr.io/uug-ai: report a container, init
|
||||
container or ephemeral container image that is a UUG.AI image (uugai/... on
|
||||
Docker Hub, or any registry's uugai/ or uug-ai/ organisation) pulled from
|
||||
anywhere else. Other images in the namespace (agents, cert-manager solvers,
|
||||
third-party tools) are not the chart's to vouch for and are ignored. Signature
|
||||
and hardening are checked per image by the *-signed-images / *-hardened-images
|
||||
policies, which match ghcr.io/uug-ai images only.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: trusted-registry
|
||||
annotations:
|
||||
policies.kyverno.io/title: UUG.AI images must come from ghcr.io/uug-ai
|
||||
policies.kyverno.io/category: Image registry
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
spec:
|
||||
# Reports UUG.AI images from other registries without blocking them, even
|
||||
# when imageVerification.validationFailureAction is Enforce.
|
||||
validationFailureAction: Audit
|
||||
# Kyverno's default (Fail) would stop pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
rules:
|
||||
- name: images-from-ghcr-uug-ai
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
message: "UUG.AI images must come from the trusted registry ghcr.io/uug-ai/."
|
||||
foreach:
|
||||
- list: "request.object.spec.[containers, initContainers, ephemeralContainers][]"
|
||||
deny:
|
||||
conditions:
|
||||
all:
|
||||
# A UUG.AI image: Docker Hub uugai/..., or a uugai/ or uug-ai/
|
||||
# organisation on any registry ...
|
||||
- key: "{{`{{ element.image }}`}}"
|
||||
operator: AnyIn
|
||||
value:
|
||||
- "uugai/*"
|
||||
- "*/uugai/*"
|
||||
- "*/uug-ai/*"
|
||||
# ... that is not pulled from ghcr.io/uug-ai.
|
||||
- key: "{{`{{ element.image }}`}}"
|
||||
operator: NotEquals
|
||||
value: "ghcr.io/uug-ai/*"
|
||||
{{- end }}
|
||||
@@ -22,6 +22,44 @@
|
||||
}
|
||||
}
|
||||
},
|
||||
"imageVerification": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"description": "Kyverno policies (templates/kyverno/) requiring UUG.AI images to be signed by UUG.AI. Created only when the cluster serves kyverno.io/v1.",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"description": "Create the policies when Kyverno is installed."
|
||||
},
|
||||
"validationFailureAction": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"Audit",
|
||||
"Enforce"
|
||||
],
|
||||
"description": "Audit reports unsigned images but lets them run; Enforce rejects them."
|
||||
}
|
||||
}
|
||||
},
|
||||
"imageHardening": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"description": "Kyverno policies (templates/kyverno/*-hardened-images.yaml) requiring images to come from a hardened UUG.AI release (signed image-hardening attestation). Created only when the cluster serves kyverno.io/v1.",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"description": "Create the hardening policies when Kyverno is installed."
|
||||
},
|
||||
"validationFailureAction": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"Audit",
|
||||
"Enforce"
|
||||
],
|
||||
"description": "Audit reports images without a hardened release but lets them run; Enforce rejects them."
|
||||
}
|
||||
}
|
||||
},
|
||||
"deviceTags": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
|
||||
+87
-74
@@ -26,6 +26,28 @@ readOnly: false # Set to 'true' to halt all write operations to the database (e.
|
||||
# - ui: Hub services only
|
||||
mode: "all"
|
||||
###########################################################################
|
||||
# Image signature verification (Kyverno)
|
||||
###########################################################################
|
||||
# Kyverno policies in templates/kyverno/ (one file per ghcr.io/uug-ai image)
|
||||
# requiring UUG.AI images to be signed by UUG.AI. Opt-in: when enabled, they are
|
||||
# created only if Kyverno is installed.
|
||||
imageVerification:
|
||||
enabled: false
|
||||
# Audit: report unsigned images (PolicyReports) but let them run.
|
||||
# Enforce: reject pods whose image is unsigned or signed for another repository.
|
||||
# Images whose releases are not signed yet always stay in Audit (see README).
|
||||
validationFailureAction: Audit
|
||||
# Kyverno policies in templates/kyverno/ (*-hardened-images.yaml, one per image
|
||||
# whose repository makes hardened releases) requiring the image to come from a
|
||||
# hardened UUG.AI release: a signed image-hardening attestation with result
|
||||
# "passed" for the image's own repository. Opt-in and separate from
|
||||
# imageVerification, since only releases made with hardening enabled carry it.
|
||||
imageHardening:
|
||||
enabled: false
|
||||
# Audit: report images without a hardened release but let them run.
|
||||
# Enforce: reject pods whose image is not from a hardened release.
|
||||
validationFailureAction: Audit
|
||||
###########################################################################
|
||||
# Global configuration
|
||||
###########################################################################
|
||||
global:
|
||||
@@ -264,14 +286,34 @@ kerberosvault:
|
||||
# For now it's used to create, edit users for Hub.
|
||||
###########################################################################
|
||||
admin:
|
||||
repository: uugai/admin
|
||||
# Opt in to 8080 and a securityContext only with a compatible hardened image.
|
||||
containerPort: 80
|
||||
securityContext: {}
|
||||
readinessProbe: {}
|
||||
livenessProbe: {}
|
||||
# Signed release from the UUG.AI release workflow (only ghcr.io/uug-ai is trusted).
|
||||
# It runs shell-free as 65532:65532 on 8080 with a read-only root filesystem:
|
||||
# keep the runtime settings below together with the image (see README).
|
||||
repository: ghcr.io/uug-ai/admin
|
||||
containerPort: 8080
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
readOnlyRootFilesystem: true
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
periodSeconds: 10
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.3.0"
|
||||
tag: "v1.4.6"
|
||||
replicas: 2
|
||||
# Optional pod topology spread constraints for this deployment. Empty by
|
||||
# default. Example:
|
||||
@@ -283,13 +325,16 @@ admin:
|
||||
# matchLabels:
|
||||
# app: admin
|
||||
topologySpreadConstraints: []
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
#volumes:
|
||||
# - name: extra
|
||||
# emptyDir: {}
|
||||
#volumeMounts:
|
||||
# - name: extra
|
||||
# mountPath: /data
|
||||
# The only writable path: memory-backed /tmp (counts against the pod memory
|
||||
# limit). Append extra volumes / volumeMounts to these lists.
|
||||
volumes:
|
||||
- name: admin-tmp
|
||||
emptyDir:
|
||||
medium: Memory
|
||||
sizeLimit: 16Mi
|
||||
volumeMounts:
|
||||
- name: admin-tmp
|
||||
mountPath: /tmp
|
||||
logLevel: "info" # possible values: trace, debug, info, warn, error
|
||||
resources:
|
||||
requests:
|
||||
@@ -336,7 +381,7 @@ kerberoshub:
|
||||
api:
|
||||
repository: ghcr.io/uug-ai/hub-api
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.11.31"
|
||||
tag: "v1.11.42"
|
||||
replicas: 2
|
||||
podSecurityContext:
|
||||
fsGroup: 65532
|
||||
@@ -365,6 +410,11 @@ kerberoshub:
|
||||
serviceEnabled: true
|
||||
logLevel: "info" # possible values: trace, debug, info, warn, error
|
||||
jwtSecret: "this-is-a-secret-please-change-to-random-string" # change to a random value, this is for generating JWT tokens.
|
||||
# How long a user stays signed in (Go durations, e.g. "15m", "12h").
|
||||
session:
|
||||
accessTokenTimeout: "15m" # Lifetime of one access token; the frontend renews it silently.
|
||||
idleTimeout: "12h" # A session that is not used for this long ends.
|
||||
maxLifetime: "24h" # Hard limit counted from login; the user must sign in again after it.
|
||||
schema: "https"
|
||||
url: "api.yourdomain.com"
|
||||
# Additional complete HTTP(S) origins allowed to call the Hub API.
|
||||
@@ -505,7 +555,7 @@ kerberoshub:
|
||||
frontend:
|
||||
repository: ghcr.io/uug-ai/hub-frontend
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.19.28"
|
||||
tag: "v1.19.35"
|
||||
replicas: 2
|
||||
containerPort: 8080
|
||||
securityContext:
|
||||
@@ -817,7 +867,7 @@ kerberoshub:
|
||||
podSecurityContext: {}
|
||||
repository: ghcr.io/uug-ai/hub-cleanup
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.4.26"
|
||||
tag: "v1.4.27"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -871,7 +921,7 @@ kerberoshub:
|
||||
audit:
|
||||
repository: ghcr.io/uug-ai/hub-audit
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.0.10"
|
||||
tag: "v1.0.12"
|
||||
replicas: 1
|
||||
resources: {}
|
||||
# resources:
|
||||
@@ -1070,7 +1120,7 @@ kerberoshub:
|
||||
securityContext: {}
|
||||
podSecurityContext: {}
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.0.0"
|
||||
tag: "v1.0.49"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -1100,7 +1150,7 @@ kerberoshub:
|
||||
# enabled: true
|
||||
# repository: ghcr.io/uug-ai/hub-loitering
|
||||
# pullPolicy: IfNotPresent
|
||||
# tag: "v1.0.0"
|
||||
# tag: "v1.0.11"
|
||||
# replicas: 1 # Number of pods for the worker.
|
||||
# topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# #volumes:
|
||||
@@ -1129,7 +1179,7 @@ kerberoshub:
|
||||
# enabled: true
|
||||
# repository: ghcr.io/uug-ai/hub-objecttracking
|
||||
# pullPolicy: IfNotPresent
|
||||
# tag: "v1.0.0"
|
||||
# tag: "v1.0.11"
|
||||
# replicas: 1 # Number of pods for the worker.
|
||||
# topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# logLevel: "info" # possible values: trace, debug, info, warn, error
|
||||
@@ -1154,7 +1204,7 @@ kerberoshub:
|
||||
# enabled: true
|
||||
# repository: ghcr.io/uug-ai/hub-vlm
|
||||
# pullPolicy: IfNotPresent
|
||||
# tag: "v1.0.0"
|
||||
# tag: "v1.0.9"
|
||||
# replicas: 1 # Number of pods for the worker.
|
||||
# topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# logLevel: "info" # possible values: trace, debug, info, warn, error
|
||||
@@ -1181,7 +1231,7 @@ kerberoshub:
|
||||
podSecurityContext: {}
|
||||
repository: ghcr.io/uug-ai/hub-monitor-device
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.4.10"
|
||||
tag: "v1.4.15"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
logLevel: "info" # possible values: trace, debug, info, warn, error
|
||||
@@ -1203,9 +1253,9 @@ kerberoshub:
|
||||
# persistentVolumeClaim:
|
||||
# claimName: custom-layout-claim
|
||||
reactivate:
|
||||
repository: uugai/hub-reactivatesubscriptions
|
||||
repository: ghcr.io/uug-ai/hub-reactivatesubscriptions
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.0.2"
|
||||
tag: "v1.0.3"
|
||||
replicas: 0 # Number of pods for the service. Set to 0 to disable.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -1220,43 +1270,6 @@ kerberoshub:
|
||||
requests:
|
||||
memory: 10Mi
|
||||
cpu: 10m
|
||||
forwarder:
|
||||
enabled: false
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
#volumes:
|
||||
# - name: extra
|
||||
# emptyDir: {}
|
||||
#volumeMounts:
|
||||
# - name: extra
|
||||
# mountPath: /data
|
||||
#repository: kerberos/vault-forwarder
|
||||
#pullPolicy: IfNotPresent
|
||||
#tag: "1.0.2732389692"
|
||||
#resources:
|
||||
# requests:
|
||||
# memory: 10Mi
|
||||
# cpu: 10m
|
||||
# This proxy is legacy for the old agent, will be migrated in the new Hub API.
|
||||
proxy:
|
||||
enabled: false
|
||||
repository: uugai/hub-proxy
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.0.0"
|
||||
replicas: 0 # Number of pods for the service when enabled.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
#volumes:
|
||||
# - name: extra
|
||||
# emptyDir: {}
|
||||
#volumeMounts:
|
||||
# - name: extra
|
||||
# mountPath: /data
|
||||
logLevel: "info" # possible values: trace, debug, info, warn, error
|
||||
resources:
|
||||
requests:
|
||||
memory: 10Mi
|
||||
cpu: 10m
|
||||
# The Kerberos Hub pipeline is a series of microservices that process the recordings.
|
||||
# Each microservice is responsible for a specific task, like counting objects, generating thumbnails, etc.
|
||||
# The pipeline is orchestrated through Kafka topics or RabbitMQ queues.
|
||||
@@ -1269,7 +1282,7 @@ kerberospipeline:
|
||||
# argocd.argoproj.io/sync-wave: "10"
|
||||
repository: ghcr.io/uug-ai/hub-pipeline-event
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.3.9"
|
||||
tag: "v1.3.11"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -1290,7 +1303,7 @@ kerberospipeline:
|
||||
# deploymentAnnotations:
|
||||
# argocd.argoproj.io/sync-wave: "70"
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.3.29"
|
||||
tag: "v1.3.30"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -1311,7 +1324,7 @@ kerberospipeline:
|
||||
# deploymentAnnotations:
|
||||
# argocd.argoproj.io/sync-wave: "60"
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.7.14"
|
||||
tag: "v1.7.15"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -1334,7 +1347,7 @@ kerberospipeline:
|
||||
# deploymentAnnotations:
|
||||
# argocd.argoproj.io/sync-wave: "30"
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.2.10"
|
||||
tag: "v1.2.11"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -1357,7 +1370,7 @@ kerberospipeline:
|
||||
# deploymentAnnotations:
|
||||
# argocd.argoproj.io/sync-wave: "20"
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.3.46"
|
||||
tag: "v1.3.49"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
audit:
|
||||
enabled: true
|
||||
@@ -1379,7 +1392,7 @@ kerberospipeline:
|
||||
notifyTest:
|
||||
repository: ghcr.io/uug-ai/hub-pipeline-notification-test
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.2.6"
|
||||
tag: "v1.2.8"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
resources:
|
||||
@@ -1400,7 +1413,7 @@ kerberospipeline:
|
||||
# deploymentAnnotations:
|
||||
# argocd.argoproj.io/sync-wave: "40"
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.8.29"
|
||||
tag: "v1.8.31"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -1442,7 +1455,7 @@ kerberospipeline:
|
||||
# deploymentAnnotations:
|
||||
# argocd.argoproj.io/sync-wave: "50"
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v2.0.9"
|
||||
tag: "v2.0.11"
|
||||
replicas: 3 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -1468,7 +1481,7 @@ kerberospipeline:
|
||||
# deploymentAnnotations:
|
||||
# argocd.argoproj.io/sync-wave: "50"
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.3.22"
|
||||
tag: "v1.3.25"
|
||||
replicas: 2 # Number of pods for the service.
|
||||
prefetchCount: 0 # Max unacknowledged RabbitMQ messages per pod; 0 = service default (5).
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
@@ -1501,7 +1514,7 @@ kerberospipeline:
|
||||
# deploymentAnnotations:
|
||||
# argocd.argoproj.io/sync-wave: "50"
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v2.0.6"
|
||||
tag: "v2.0.7"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -1523,7 +1536,7 @@ kerberospipeline:
|
||||
# argocd.argoproj.io/sync-wave: "50"
|
||||
repository: ghcr.io/uug-ai/hub-pipeline-sprite
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.1.27"
|
||||
tag: "v1.1.29"
|
||||
replicas: 5 # Number of pods for the service.
|
||||
prefetchCount: 0 # Max unacknowledged RabbitMQ messages per pod; 0 = service default (5).
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
@@ -1550,7 +1563,7 @@ kerberospipeline:
|
||||
export:
|
||||
repository: ghcr.io/uug-ai/hub-pipeline-export
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.2.20"
|
||||
tag: "v1.2.23"
|
||||
replicas: 2 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
logLevel: "info" # possible values: trace, debug, info, warn, error
|
||||
|
||||
@@ -28,28 +28,26 @@ assert_absent() {
|
||||
fi
|
||||
}
|
||||
|
||||
HARDENED_FLAGS=(
|
||||
--set admin.containerPort=8080
|
||||
--set-json 'admin.securityContext={"runAsNonRoot":true,"runAsUser":65532,"runAsGroup":65532,"readOnlyRootFilesystem":true,"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"seccompProfile":{"type":"RuntimeDefault"}}'
|
||||
--set-json 'admin.volumes=[{"name":"admin-tmp","emptyDir":{"medium":"Memory","sizeLimit":"16Mi"}}]'
|
||||
--set-json 'admin.volumeMounts=[{"name":"admin-tmp","mountPath":"/tmp"}]'
|
||||
--set-json 'admin.readinessProbe={"httpGet":{"path":"/healthz","port":"http"},"periodSeconds":10}'
|
||||
--set-json 'admin.livenessProbe={"httpGet":{"path":"/healthz","port":"http"},"initialDelaySeconds":10,"periodSeconds":10}'
|
||||
# Since chart 0.184.0 the hardened ghcr.io/uug-ai/admin runtime is the default;
|
||||
# LEGACY_FLAGS opts back into a legacy image on port 80.
|
||||
LEGACY_FLAGS=(
|
||||
--set admin.repository=uugai/admin
|
||||
--set admin.tag=v1.3.0
|
||||
--set admin.containerPort=80
|
||||
--set admin.securityContext=null
|
||||
--set admin.readinessProbe=null
|
||||
--set admin.livenessProbe=null
|
||||
--set admin.volumes=null
|
||||
--set admin.volumeMounts=null
|
||||
)
|
||||
|
||||
for mode in all ui; do
|
||||
default_render="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set admin.oauth2Proxy.enabled=true)"
|
||||
default_deployment="$(resource deployment <<< "$default_render")"
|
||||
default_service="$(resource service <<< "$default_render")"
|
||||
default_ingress="$(resource ingress <<< "$default_render")"
|
||||
default_oauth="$(resource oauth2-proxy <<< "$default_render")"
|
||||
assert_contains "$default_deployment" 'containerPort: 80$'
|
||||
assert_absent "$default_deployment" 'securityContext:|readinessProbe:|livenessProbe:'
|
||||
assert_contains "$default_service" 'port: 80$'
|
||||
assert_contains "$default_service" 'targetPort: http$'
|
||||
|
||||
hardened_render="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set admin.oauth2Proxy.enabled=true "${HARDENED_FLAGS[@]}")"
|
||||
hardened_render="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set admin.oauth2Proxy.enabled=true)"
|
||||
hardened_deployment="$(resource deployment <<< "$hardened_render")"
|
||||
hardened_service="$(resource service <<< "$hardened_render")"
|
||||
hardened_ingress="$(resource ingress <<< "$hardened_render")"
|
||||
hardened_oauth="$(resource oauth2-proxy <<< "$hardened_render")"
|
||||
assert_contains "$hardened_deployment" 'image: "ghcr.io/uug-ai/admin:'
|
||||
assert_contains "$hardened_deployment" 'containerPort: 8080$'
|
||||
assert_absent "$hardened_deployment" 'containerPort: 80$'
|
||||
for setting in 'runAsNonRoot: true' 'runAsUser: 65532' 'runAsGroup: 65532' \
|
||||
@@ -66,17 +64,24 @@ for mode in all ui; do
|
||||
assert_contains "$probe_render" 'path: /healthz$'
|
||||
assert_contains "$probe_render" 'port: http$'
|
||||
done
|
||||
assert_contains "$hardened_service" 'port: 80$'
|
||||
assert_contains "$hardened_service" 'targetPort: http$'
|
||||
|
||||
[[ "$(resource service <<< "$hardened_render")" == "$default_service" ]]
|
||||
[[ "$(resource ingress <<< "$hardened_render")" == "$default_ingress" ]]
|
||||
[[ "$(resource oauth2-proxy <<< "$hardened_render")" == "$default_oauth" ]]
|
||||
assert_contains "$default_ingress" 'nginx.ingress.kubernetes.io/auth-url:'
|
||||
assert_contains "$default_ingress" 'number: 80$'
|
||||
legacy_render="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set admin.oauth2Proxy.enabled=true "${LEGACY_FLAGS[@]}")"
|
||||
legacy_deployment="$(resource deployment <<< "$legacy_render")"
|
||||
assert_contains "$legacy_deployment" 'containerPort: 80$'
|
||||
assert_absent "$legacy_deployment" 'securityContext:|readinessProbe:|livenessProbe:|admin-tmp'
|
||||
|
||||
echo "OK ($mode): legacy defaults; hardened runtime/probes; stable Service, ingress and OAuth2"
|
||||
[[ "$(resource service <<< "$legacy_render")" == "$hardened_service" ]]
|
||||
[[ "$(resource ingress <<< "$legacy_render")" == "$hardened_ingress" ]]
|
||||
[[ "$(resource oauth2-proxy <<< "$legacy_render")" == "$hardened_oauth" ]]
|
||||
assert_contains "$hardened_ingress" 'nginx.ingress.kubernetes.io/auth-url:'
|
||||
assert_contains "$hardened_ingress" 'number: 80$'
|
||||
|
||||
echo "OK ($mode): hardened ghcr.io defaults; legacy opt-out; stable Service, ingress and OAuth2"
|
||||
done
|
||||
|
||||
pipeline_render="$(helm template hub "$CHART_DIR" --set mode=pipeline "${HARDENED_FLAGS[@]}")"
|
||||
pipeline_render="$(helm template hub "$CHART_DIR" --set mode=pipeline)"
|
||||
assert_absent "$pipeline_render" '^# Source: hub/templates/admin/'
|
||||
|
||||
echo "All Admin runtime checks passed."
|
||||
|
||||
@@ -29,7 +29,7 @@ for mode in all ui; do
|
||||
--set kerberoshub.frontend.demoEnabled=true)"
|
||||
for name in hub-frontend hub-frontend-demo; do
|
||||
deployment="$(resource Deployment "$name" <<< "$rendered")"
|
||||
assert_contains "$deployment" 'image: "ghcr.io/uug-ai/hub-frontend:v1.19.28"$'
|
||||
assert_contains "$deployment" 'image: "ghcr.io/uug-ai/hub-frontend:v1.19.35"$'
|
||||
assert_contains "$deployment" 'containerPort: 8080$'
|
||||
[[ "$(grep -c 'containerPort:' <<< "$deployment")" == 1 ]]
|
||||
for setting in 'name: http' 'runAsNonRoot: true' 'runAsUser: 65532' \
|
||||
@@ -44,7 +44,7 @@ for mode in all ui; do
|
||||
echo "OK ($mode): $name hardened image, security, scratch and named routing"
|
||||
done
|
||||
admin="$(resource Deployment admin <<< "$rendered")"
|
||||
assert_contains "$admin" 'containerPort: 80$'
|
||||
assert_contains "$admin" 'containerPort: 8080$'
|
||||
|
||||
legacy="$(helm template hub "$CHART_DIR" "${values[@]}" --set "mode=$mode" \
|
||||
--set kerberoshub.frontend.demoEnabled=true \
|
||||
|
||||
@@ -60,6 +60,14 @@ assert_line() {
|
||||
fi
|
||||
}
|
||||
|
||||
without_admin() {
|
||||
awk '
|
||||
/^---$/ { skip=0 }
|
||||
/^# Source: hub\/templates\/admin\/deployment\.yaml$/ { skip=1 }
|
||||
!skip { print }
|
||||
'
|
||||
}
|
||||
|
||||
without_frontends() {
|
||||
awk '
|
||||
/^---$/ { skip=0 }
|
||||
@@ -70,7 +78,8 @@ without_frontends() {
|
||||
|
||||
for mode in all pipeline ui; do
|
||||
defaults="$(helm template hub "$CHART_DIR" --set "mode=$mode")"
|
||||
worker_defaults="$(without_frontends <<< "$defaults")"
|
||||
# Frontends, hub-api and Admin (since 0.184.0) are hardened by default.
|
||||
worker_defaults="$(without_frontends <<< "$defaults" | without_admin)"
|
||||
if grep -q 'securityContext:' <<< "$worker_defaults"; then
|
||||
echo "Default $mode mode unexpectedly enables worker security settings" >&2
|
||||
exit 1
|
||||
@@ -120,8 +129,8 @@ for mode in all pipeline ui; do
|
||||
fi
|
||||
done
|
||||
expected="${#names[@]}"
|
||||
[[ "$(without_frontends <<< "$hardened" | grep -c 'runAsUser: 65532')" == "$expected" ]]
|
||||
[[ "$(without_frontends <<< "$hardened" | grep -c 'fsGroup: 65532')" == "$expected" ]]
|
||||
[[ "$(without_frontends <<< "$hardened" | without_admin | grep -c 'runAsUser: 65532')" == "$expected" ]]
|
||||
[[ "$(without_frontends <<< "$hardened" | without_admin | grep -c 'fsGroup: 65532')" == "$expected" ]]
|
||||
|
||||
# Image selection, Services, env and TLS mounts must not change.
|
||||
for pattern in '^[ ]+image:' '^[ ]+(port|targetPort|containerPort):' 'mongodb-tls'; do
|
||||
@@ -137,26 +146,23 @@ isolated="$(helm template hub "$CHART_DIR" --set mode=pipeline \
|
||||
assert_line "$(resource Deployment pipe-counting <<< "$isolated")" '^[ ]+runAsUser: 65532$'
|
||||
echo "All hardened worker checks passed."
|
||||
|
||||
admin_flags=(
|
||||
--set admin.containerPort=8080
|
||||
--set admin.securityContext.runAsNonRoot=true
|
||||
--set admin.securityContext.runAsUser=65532
|
||||
--set admin.securityContext.runAsGroup=65532
|
||||
--set admin.securityContext.readOnlyRootFilesystem=true
|
||||
--set admin.securityContext.allowPrivilegeEscalation=false
|
||||
--set admin.securityContext.capabilities.drop[0]=ALL
|
||||
--set admin.securityContext.seccompProfile.type=RuntimeDefault
|
||||
--set admin.volumes[0].name=admin-tmp
|
||||
--set admin.volumes[0].emptyDir.medium=Memory
|
||||
--set admin.volumes[0].emptyDir.sizeLimit=16Mi
|
||||
--set admin.volumeMounts[0].name=admin-tmp
|
||||
--set admin.volumeMounts[0].mountPath=/tmp
|
||||
# Since chart 0.184.0 the hardened Admin runtime is the default; these flags
|
||||
# opt back into a legacy image on port 80.
|
||||
legacy_admin_flags=(
|
||||
--set admin.repository=uugai/admin
|
||||
--set admin.tag=v1.3.0
|
||||
--set admin.containerPort=80
|
||||
--set admin.securityContext=null
|
||||
--set admin.readinessProbe=null
|
||||
--set admin.livenessProbe=null
|
||||
--set admin.volumes=null
|
||||
--set admin.volumeMounts=null
|
||||
--set admin.oauth2Proxy.enabled=true
|
||||
)
|
||||
for mode in all ui pipeline; do
|
||||
legacy="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set admin.oauth2Proxy.enabled=true)"
|
||||
configured="$(helm template hub "$CHART_DIR" --set "mode=$mode" "${admin_flags[@]}")"
|
||||
helm lint "$CHART_DIR" --quiet --set "mode=$mode" "${admin_flags[@]}"
|
||||
legacy="$(helm template hub "$CHART_DIR" --set "mode=$mode" "${legacy_admin_flags[@]}")"
|
||||
configured="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set admin.oauth2Proxy.enabled=true)"
|
||||
helm lint "$CHART_DIR" --quiet --set "mode=$mode" "${legacy_admin_flags[@]}"
|
||||
if [[ "$mode" == pipeline ]]; then
|
||||
[[ -z "$(resource Deployment admin <<< "$configured")" ]]
|
||||
[[ -z "$(resource Service admin-svc <<< "$configured")" ]]
|
||||
@@ -186,9 +192,11 @@ for mode in all ui pipeline; do
|
||||
[[ "$(resource Ingress admin-ingress <<< "$legacy")" == "$(resource Ingress admin-ingress <<< "$configured")" ]]
|
||||
[[ "$(resource Deployment oauth2-proxy-admin <<< "$legacy")" == "$(resource Deployment oauth2-proxy-admin <<< "$configured")" ]]
|
||||
[[ "$(resource Service oauth2-proxy-admin <<< "$legacy")" == "$(resource Service oauth2-proxy-admin <<< "$configured")" ]]
|
||||
[[ "$(grep 'image:' <<< "$legacy")" == "$(grep 'image:' <<< "$configured")" ]]
|
||||
[[ "$(without_admin <<< "$legacy" | grep 'image:')" == "$(without_admin <<< "$configured" | grep 'image:')" ]]
|
||||
assert_line "$old" 'image: "uugai/admin:v1.3.0"$'
|
||||
assert_line "$block" 'image: "ghcr.io/uug-ai/admin:v1.4.6"$'
|
||||
# No other workload inherits Admin's container port or security settings.
|
||||
[[ "$(without_frontends <<< "$configured" | grep -c 'runAsUser: 65532')" == 1 ]]
|
||||
echo "OK ($mode): Admin opt-in port/security/tmpfs; legacy image, Service port, ingress and OAuth2-proxy preserved"
|
||||
echo "OK ($mode): Admin hardened defaults; legacy opt-out; Service port, ingress and OAuth2-proxy preserved"
|
||||
done
|
||||
echo "All hardened Admin checks passed."
|
||||
|
||||
Reference in New Issue
Block a user