Add demo apps for rhacs talk.

2025-01-28-advanced-cluster-security/medical-application/frontend/everything.yml

@@ -0,0 +1,214 @@
+
+# Secret named "ssh-keys"
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ssh-keys
+  namespace: frontend
+data:
+  id_rsa: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlDWGdJQkFBS0JnUURSVk4vbFYxOFFYMnBmQlNLYVowVVlDVlk2TDFSRDlhNy9QRGtmVlpJRXdTUCszczIzCmpHU3NZanhxZXliT0lEZzI3dndkWkw5R1dEd2Nsb2lVbmhjWUpDSlJaalN4VUw5MmJJSGVhYitYSnJQUGRFNmUKbnZLTmpsSE1nampxdVhQWGkrQmpjNDgvd1BGYnhLVndSclYwOUFZOUpDbXBWZUhqdUFHUStwbmk2d0lEQVFBQgpBb0dCQUpkWWpSUk1xaisxTEx3TWcyc3RGUWgrMzZmcnhqbm9iS0MrMHZIenRVSFl2b1NzWkFHNzhLR3QyTTZICndaT3dPZFNGenlRVlRqRzI0NmNyc3czNGl1cXJtd2Q1Qmhhb0hEbmhGN3pqZkMybUN5MjlkNGF4cGY0N1NZMGYKais5bHEzSzNrRDhkcVBQTzhGRnhjQlNmSGw3ejFWR2ppbmx1V1UwbHBUN1V4YlY1QWtFQTZkMElkYTJFMlo1LwpjYTZIQXdQVGpIOUFMYzhwQlI0bXg4Q2pUN1BWZk1ncUV5SGdTRGx3aGw4V3Z2OHFWVG0xRDdxUFhoS21FeTVhCnZWdDlnUE9PclFKQkFPVWxZdS85ZUNWODY0L2VacWhWYXlBT0JIUHNUQ3ZpZ04wNk83MDBHeldPVlVGR0pxUkoKY2dWRnNhVjBudytrU3FxaFdTRVJGS1JxM3RHYmFlK1JZdmNDUUUwSjRDQ0w0YWlpbXM4RE5EeWRCUkpTVlAwQwpNandhVzZJUDVueDUvRWpYMDJ4c0Myc2ZhTjhLOGY1SEpsWGU1Yk5odkpxN3YvT3ZvSHFpYWV5Unp4MENRUUM2CkM2TEtxNGRUR0p2QlVaY1Q4VlpxemphN1VBMkFUQVRJbWJGTEt2VTBoSDJmNDY4WUVER3RLaXJUNVY0SHV5S00KYXpnTWF1dlJtcHVTbjVaaFZpOTlBa0VBaWtIanNZZW5YVWNaSHpHZzVTZ3RGc29DdXV2eEdNenpNc2cyVWZIVgo5TnNXNXoxcytHNmM2bXhCMmxFaTRVcEswc0xJeTMyZG9NRVpKQkp2cGN5MVZ3PT0KLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
+  id_rsa.pub: c3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFBZ1FEUlZOL2xWMThRWDJwZkJTS2FaMFVZQ1ZZNkwxUkQ5YTcvUERrZlZaSUV3U1ArM3MyM2pHU3NZanhxZXliT0lEZzI3dndkWkw5R1dEd2Nsb2lVbmhjWUpDSlJaalN4VUw5MmJJSGVhYitYSnJQUGRFNmVudktOamxITWdqanF1WFBYaStCamM0OC93UEZieEtWd1JyVjA5QVk5SkNtcFZlSGp1QUdRK3BuaTZ3PT0gaGFja2VybWFuCg==
+
+---
+
+# Deployment named "asset-cache"
+# Listens on :8080
+# Vulnerable to struts
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: asset-cache
+  namespace: frontend
+  labels:
+    app: asset-cache
+    demo: roadshow
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+       app: asset-cache
+  template:
+    metadata:
+     labels:
+       app: asset-cache
+    spec:
+      imagePullSecrets:
+      - name: rhacs-demo-pull-pull-secret
+      containers:
+      - image: quay.io/rhacs-demo/asset-cache:latest
+        imagePullPolicy: Always
+        name: asset-cache
+        ports:
+        - containerPort: 8080
+          protocol: TCP
+        securityContext:
+          capabilities:
+            drop: ["NET_ADMIN"]
+      - image: quay.io/rhacs-demo/asset-cache:sidecar-latest
+        imagePullPolicy: Always
+        name: asset-cache-sidecar
+        command: ["/bin/entrypoint"]
+        securityContext:
+          privileged: false
+
+---
+
+# Service named "asset-cache-service"
+# Listens on :8080
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: asset-cache
+  name: asset-cache-service
+  namespace: frontend
+spec:
+  ports:
+  - port: 8080
+    protocol: TCP
+    targetPort: 8080
+    name: http
+  selector:
+    app: asset-cache
+  type: ClusterIP
+
+---
+
+# Deployment named "tls-proxy"
+# Listens on :80 and :443
+# Has SSH keys mounted
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tls-proxy
+  namespace: frontend
+  labels:
+    app: tls-proxy
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+       app: tls-proxy
+  template:
+    metadata:
+     labels:
+       app: tls-proxy
+    spec:
+      imagePullSecrets:
+      - name: rhacs-demo-pull-pull-secret
+      volumes:
+      - name: ssh-keys
+        secret:
+          secretName: ssh-keys
+      containers:
+      - image: quay.io/rhacs-demo/netflow:latest
+        command: ["/bin/entrypoint"]
+        args: ["-listen", "80,443", "-connect", "asset-cache-service.frontend.svc.cluster.local:8080,wordpress-service.frontend.svc.cluster.local:80"]
+        imagePullPolicy: Always
+        name: tls-proxy
+        ports:
+        - containerPort: 80
+          protocol: TCP
+        - containerPort: 443
+          protocol: TCP
+        volumeMounts:
+        - name: ssh-keys
+          mountPath: "/root/.ssh"
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: tls-proxy
+  name: tls-proxy-service
+  namespace: frontend
+spec:
+  ports:
+  - port: 80
+    protocol: TCP
+    targetPort: 80
+    name: http
+  - port: 443
+    protocol: TCP
+    targetPort: 443
+    name: tls
+  selector:
+    app: tls-proxy
+  type: ClusterIP
+
+---
+
+# Deployment named "wordpress"
+# Listens on :80
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: wordpress
+  namespace: frontend
+  labels:
+    app: wordpress
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+       app: wordpress
+  template:
+    metadata:
+     labels:
+       app: wordpress
+    spec:
+      containers:
+      - image: wordpress:latest
+        imagePullPolicy: Always
+        name: wordpress
+        ports:
+        - containerPort: 80
+          protocol: TCP
+
+---
+
+# Service named "wordpress-service"
+# Listens on :80
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: wordpress
+  name: wordpress-service
+  namespace: frontend
+spec:
+  ports:
+  - port: 80
+    protocol: TCP
+    targetPort: 80
+    name: http
+  selector:
+    app: wordpress
+  type: ClusterIP
+
+---
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: monitor
+  namespace: frontend
+  labels:
+    app: monitor
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+       app: monitor
+  template:
+    metadata:
+     labels:
+       app: monitor
+    spec:
+      imagePullSecrets:
+      - name: rhacs-demo-pull-pull-secret
+      containers:
+      - image: quay.io/rhacs-demo/monitor:latest
+        imagePullPolicy: Always
+        name: monitor