Add demo apps for rhacs talk.

2025-01-28-advanced-cluster-security/medical-application/operations/everything.yml

@@ -0,0 +1,176 @@
+# Secret named "ssh-keys"
+apiVersion: v1
+kind: Secret
+metadata:
+  namespace: operations
+  name: ssh-keys
+data:
+  id_rsa: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlDWGdJQkFBS0JnUURSVk4vbFYxOFFYMnBmQlNLYVowVVlDVlk2TDFSRDlhNy9QRGtmVlpJRXdTUCszczIzCmpHU3NZanhxZXliT0lEZzI3dndkWkw5R1dEd2Nsb2lVbmhjWUpDSlJaalN4VUw5MmJJSGVhYitYSnJQUGRFNmUKbnZLTmpsSE1nampxdVhQWGkrQmpjNDgvd1BGYnhLVndSclYwOUFZOUpDbXBWZUhqdUFHUStwbmk2d0lEQVFBQgpBb0dCQUpkWWpSUk1xaisxTEx3TWcyc3RGUWgrMzZmcnhqbm9iS0MrMHZIenRVSFl2b1NzWkFHNzhLR3QyTTZICndaT3dPZFNGenlRVlRqRzI0NmNyc3czNGl1cXJtd2Q1Qmhhb0hEbmhGN3pqZkMybUN5MjlkNGF4cGY0N1NZMGYKais5bHEzSzNrRDhkcVBQTzhGRnhjQlNmSGw3ejFWR2ppbmx1V1UwbHBUN1V4YlY1QWtFQTZkMElkYTJFMlo1LwpjYTZIQXdQVGpIOUFMYzhwQlI0bXg4Q2pUN1BWZk1ncUV5SGdTRGx3aGw4V3Z2OHFWVG0xRDdxUFhoS21FeTVhCnZWdDlnUE9PclFKQkFPVWxZdS85ZUNWODY0L2VacWhWYXlBT0JIUHNUQ3ZpZ04wNk83MDBHeldPVlVGR0pxUkoKY2dWRnNhVjBudytrU3FxaFdTRVJGS1JxM3RHYmFlK1JZdmNDUUUwSjRDQ0w0YWlpbXM4RE5EeWRCUkpTVlAwQwpNandhVzZJUDVueDUvRWpYMDJ4c0Myc2ZhTjhLOGY1SEpsWGU1Yk5odkpxN3YvT3ZvSHFpYWV5Unp4MENRUUM2CkM2TEtxNGRUR0p2QlVaY1Q4VlpxemphN1VBMkFUQVRJbWJGTEt2VTBoSDJmNDY4WUVER3RLaXJUNVY0SHV5S00KYXpnTWF1dlJtcHVTbjVaaFZpOTlBa0VBaWtIanNZZW5YVWNaSHpHZzVTZ3RGc29DdXV2eEdNenpNc2cyVWZIVgo5TnNXNXoxcytHNmM2bXhCMmxFaTRVcEswc0xJeTMyZG9NRVpKQkp2cGN5MVZ3PT0KLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
+  id_rsa.pub: c3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFBZ1FEUlZOL2xWMThRWDJwZkJTS2FaMFVZQ1ZZNkwxUkQ5YTcvUERrZlZaSUV3U1ArM3MyM2pHU3NZanhxZXliT0lEZzI3dndkWkw5R1dEd2Nsb2lVbmhjWUpDSlJaalN4VUw5MmJJSGVhYitYSnJQUGRFNmVudktOamxITWdqanF1WFBYaStCamM0OC93UEZieEtWd1JyVjA5QVk5SkNtcFZlSGp1QUdRK3BuaTZ3PT0gaGFja2VybWFuCg==
+
+---
+# Deployment named "jump-host"
+# Listens on :22
+# Has SSH keys mounted
+# Connects to "visa-processor-service" in the "payments" namespace
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: jump-host
+  namespace: operations
+  labels:
+    app: jump-host
+    demo: roadshow
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+       app: jump-host
+  template:
+    metadata:
+     labels:
+       app: jump-host
+    spec:
+      volumes:
+      - name: ssh-keys
+        secret:
+          secretName: ssh-keys
+      imagePullSecrets:
+      - name: rhacs-demo-pull-pull-secret
+      containers:
+      - image: quay.io/rhacs-demo/jump-host:latest
+        command: ["/bin/entrypoint"]
+        args: ["-listen", "22", "-connect", "pupper-master-service.operations.svc.cluster.local:8140,visa-processor-service.payments.svc.cluster.local:8080,patient-db-service.medical.svc.cluster.local:8080"]
+        imagePullPolicy: Always
+        name: jump-host
+        ports:
+        - containerPort: 22
+          name: tcp
+          protocol: TCP
+        volumeMounts:
+        - name: ssh-keys
+          mountPath: "/root/.ssh"
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: jump-host
+  name: jump-host-service
+  namespace: operations
+spec:
+  ports:
+  - port: 8001
+    protocol: TCP
+    targetPort: 22
+    name: tcp
+  selector:
+    app: jump-host
+  type: ClusterIP
+
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: puppet-master
+  namespace: operations
+  labels:
+    app: puppet-master
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: puppet-master
+  namespace: operations
+  labels:
+    app: puppet-master
+rules:
+- apiGroups: ["*"]
+  resources: ["*"]
+  verbs: ["get", "watch", "list"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: puppet-master
+  namespace: operations
+  labels:
+    app: puppet-master
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: puppet-master
+subjects:
+  - kind: ServiceAccount
+    name: puppet-master
+    namespace: operations
+
+---
+# Deployment named "puppet-master"
+# Listens on :8140
+# Runs apt-get
+# Runs nmap
+# Mounts the host Docker socket
+# Runs as privileged
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: puppet-master
+  namespace: operations
+  labels:
+    app: puppet-master
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+       app: puppet-master
+  template:
+    metadata:
+     labels:
+       app: puppet-master
+    spec:
+      imagePullSecrets:
+      - name: rhacs-demo-pull-pull-secret
+      serviceAccountName: puppet-master
+      volumes:
+      - hostPath:
+          path: /var/run/docker.sock
+        name: var-run-docker-sock
+      containers:
+      - image: quay.io/rhacs-demo/netflow:latest
+        command: ["/bin/sh"]
+        args: ["-c", "/usr/bin/apt-get install nmap; /bin/nmap -Pn 10.0.0.0/24; /bin/entrypoint -listen 8140"]
+        imagePullPolicy: Always
+        name: puppet-master
+        securityContext:
+          privileged: true
+        ports:
+        - containerPort: 8140
+          protocol: TCP
+        volumeMounts:
+        - mountPath: /host/var/run/docker.sock
+          name: var-run-docker-sock
+
+---
+
+# Service named "pupper-master-service"
+# Listens on :8140
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: puppet-master
+  name: pupper-master-service
+  namespace: operations
+spec:
+  ports:
+  - port: 8140
+    protocol: TCP
+    targetPort: 8140
+    name: http
+  selector:
+    app: puppet-master
+  type: ClusterIP