Add demo apps for rhacs talk.

2025-01-29 09:35:32 +13:00
parent 8de67cfab2
commit df5b45164e
16 changed files with 2477 additions and 3 deletions
--- a/2025-01-28-advanced-cluster-security/payments-policies/everything.yml
+++ b/2025-01-28-advanced-cluster-security/payments-policies/everything.yml
@ -0,0 +1,446 @@
+# Secret named "ssh-keys"
+apiVersion: v1
+kind: Secret
+metadata:
+  namespace: payments
+  name: ssh-keys
+data:
+  id_rsa: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlDWGdJQkFBS0JnUURSVk4vbFYxOFFYMnBmQlNLYVowVVlDVlk2TDFSRDlhNy9QRGtmVlpJRXdTUCszczIzCmpHU3NZanhxZXliT0lEZzI3dndkWkw5R1dEd2Nsb2lVbmhjWUpDSlJaalN4VUw5MmJJSGVhYitYSnJQUGRFNmUKbnZLTmpsSE1nampxdVhQWGkrQmpjNDgvd1BGYnhLVndSclYwOUFZOUpDbXBWZUhqdUFHUStwbmk2d0lEQVFBQgpBb0dCQUpkWWpSUk1xaisxTEx3TWcyc3RGUWgrMzZmcnhqbm9iS0MrMHZIenRVSFl2b1NzWkFHNzhLR3QyTTZICndaT3dPZFNGenlRVlRqRzI0NmNyc3czNGl1cXJtd2Q1Qmhhb0hEbmhGN3pqZkMybUN5MjlkNGF4cGY0N1NZMGYKais5bHEzSzNrRDhkcVBQTzhGRnhjQlNmSGw3ejFWR2ppbmx1V1UwbHBUN1V4YlY1QWtFQTZkMElkYTJFMlo1LwpjYTZIQXdQVGpIOUFMYzhwQlI0bXg4Q2pUN1BWZk1ncUV5SGdTRGx3aGw4V3Z2OHFWVG0xRDdxUFhoS21FeTVhCnZWdDlnUE9PclFKQkFPVWxZdS85ZUNWODY0L2VacWhWYXlBT0JIUHNUQ3ZpZ04wNk83MDBHeldPVlVGR0pxUkoKY2dWRnNhVjBudytrU3FxaFdTRVJGS1JxM3RHYmFlK1JZdmNDUUUwSjRDQ0w0YWlpbXM4RE5EeWRCUkpTVlAwQwpNandhVzZJUDVueDUvRWpYMDJ4c0Myc2ZhTjhLOGY1SEpsWGU1Yk5odkpxN3YvT3ZvSHFpYWV5Unp4MENRUUM2CkM2TEtxNGRUR0p2QlVaY1Q4VlpxemphN1VBMkFUQVRJbWJGTEt2VTBoSDJmNDY4WUVER3RLaXJUNVY0SHV5S00KYXpnTWF1dlJtcHVTbjVaaFZpOTlBa0VBaWtIanNZZW5YVWNaSHpHZzVTZ3RGc29DdXV2eEdNenpNc2cyVWZIVgo5TnNXNXoxcytHNmM2bXhCMmxFaTRVcEswc0xJeTMyZG9NRVpKQkp2cGN5MVZ3PT0KLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
+  id_rsa.pub: c3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFBZ1FEUlZOL2xWMThRWDJwZkJTS2FaMFVZQ1ZZNkwxUkQ5YTcvUERrZlZaSUV3U1ArM3MyM2pHU3NZanhxZXliT0lEZzI3dndkWkw5R1dEd2Nsb2lVbmhjWUpDSlJaalN4VUw5MmJJSGVhYitYSnJQUGRFNmVudktOamxITWdqanF1WFBYaStCamM0OC93UEZieEtWd1JyVjA5QVk5SkNtcFZlSGp1QUdRK3BuaTZ3PT0gaGFja2VybWFuCg==
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: visa-processor
+  namespace: payments
+  labels:
+    app: visa-processor
+secrets:
+- name: rhacs-demo-pull-pull-secret
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: visa-processor
+  labels:
+    app: visa-processor
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: visa-processor
+    namespace: payments
+
+---
+# Deployment named "visa-processor"
+# Listens on :8080
+# Vulnerable to struts
+# Has SSH keys mounted
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: visa-processor
+  namespace: payments
+  labels:
+    app: visa-processor
+    demo: roadshow
+  annotations:
+    "admission.stackrox.io/break-glass": "jira-3423"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+       app: visa-processor
+  template:
+    metadata:
+     labels:
+       app: visa-processor
+    spec:
+      imagePullSecrets:
+      - name: rhacs-demo-pull-pull-secret
+      serviceAccountName: visa-processor
+      volumes:
+      - name: ssh-keys
+        secret:
+          secretName: ssh-keys
+      containers:
+      - image: quay.io/rhacs-demo/visa-processor:latest-v2
+        imagePullPolicy: Always
+        name: visa-processor
+        ports:
+        - containerPort: 22
+          protocol: TCP
+        - containerPort: 8080
+          protocol: TCP
+        volumeMounts:
+        - name: ssh-keys
+          mountPath: "/root/.ssh"
+          readOnly: false
+        securityContext:
+          capabilities:
+            add: ["SYS_ADMIN"]
+        env:
+        - name: I_HAVE_A_SECRET
+          value: "true"
+      - image: quay.io/rhacs-demo/visa-processor:sidecar-latest-v2
+        imagePullPolicy: Always
+        name: visa-processor-sidecar
+        command: ["/bin/entrypoint"]
+        securityContext:
+          privileged: true
+
+---
+# Service named "visa-processor-service"
+# Listens on :8080
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: visa-processor
+  name: visa-processor-service
+  namespace: payments
+spec:
+  ports:
+  - port: 8080
+    protocol: TCP
+    targetPort: 8080
+    name: http
+  selector:
+    app: visa-processor
+  type: ClusterIP
+
+---
+# Deployment named "gateway"
+# Listens on :7777
+# Has SSH keys mounted
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gateway
+  namespace: payments
+  labels:
+    app: gateway
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+       app: gateway
+  template:
+    metadata:
+     labels:
+       app: gateway
+    spec:
+      imagePullSecrets:
+      - name: rhacs-demo-pull-pull-secret
+      volumes:
+      - name: ssh-keys
+        secret:
+          secretName: ssh-keys
+      containers:
+      - image: quay.io/rhacs-demo/netflow:latest
+        command: ["/bin/entrypoint"]
+        args: ["-listen", "7777", "-connect", "visa-processor-service.payments.svc.cluster.local:8080,mastercard-processor-service.payments.svc.cluster.local:8080"]
+        imagePullPolicy: Always
+        name: gateway
+        ports:
+        - containerPort: 7777
+          protocol: TCP
+        volumeMounts:
+        - name: ssh-keys
+          mountPath: "/root/.ssh"
+
+---
+# Service named "gateway-service"
+# Listens on :7777
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: gateway
+  name: gateway-service
+  namespace: payments
+spec:
+  ports:
+  - port: 7777
+    protocol: TCP
+    targetPort: 7777
+    name: http
+  selector:
+    app: gateway
+  type: ClusterIP
+
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: mastercard-processor
+  namespace: payments
+  labels:
+    app: mastercard-processor
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: mastercard-processor
+  namespace: payments
+  labels:
+    app: mastercard-processor
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: mastercard-processor
+    namespace: payments
+
+---
+# Deployment named "mastercard-processor"
+# Listens on :8080
+# Vulnerable to struts
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mastercard-processor
+  namespace: payments
+  labels:
+    app: mastercard-processor
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+       app: mastercard-processor
+  template:
+    metadata:
+     labels:
+       app: mastercard-processor
+    spec:
+      imagePullSecrets:
+      - name: rhacs-demo-pull-pull-secret
+      serviceAccountName: mastercard-processor
+      containers:
+      - image: quay.io/rhacs-demo/mastercard-processor:latest
+        imagePullPolicy: Always
+        name: mastercard-processor
+        ports:
+        - containerPort: 8080
+          protocol: TCP
+
+---
+# Service named "mastercard-processor-service"
+# Listens on :8080
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: mastercard-processor
+  name: mastercard-processor-service
+  namespace: payments
+spec:
+  ports:
+  - port: 8080
+    protocol: TCP
+    targetPort: 8080
+    name: http
+  selector:
+    app: mastercard-processor
+  type: ClusterIP
+
+#---
+#kind: NetworkPolicy
+#apiVersion: networking.k8s.io/v1
+#metadata:
+#  name: backend-api-server-ingress-payments-gateway
+#  namespace: payments
+#spec:
+#  podSelector:
+#    matchLabels:
+#      app: gateway
+#  ingress:
+#  - from:
+#    - namespaceSelector:
+#        matchLabels:
+#          name: backend
+#      podSelector:
+#        matchLabels:
+#          app: api-server
+#    - podSelector:
+#        matchLabels:
+#          app: visa-processor
+#    - podSelector:
+#        matchLabels:
+#          app: mastercard-processor
+#  - ports:
+#    # Istio-proxy status port -- required for Istio to update routing
+#    - port: 15020
+#    from:
+#    - namespaceSelector:
+#        matchLabels:
+#          istio-system: "true"
+#  - ports:
+#    # Istio-proxy port -- required for Istio to update routing
+#    - port: 15090
+#    from:
+#    - namespaceSelector:
+#        matchLabels:
+#          istio-system: "true"
+#  egress:
+#  - to:
+#    - namespaceSelector:
+#        matchLabels:
+#          name: backend
+#      podSelector:
+#        matchLabels:
+#          app: api-server
+#    - podSelector:
+#        matchLabels:
+#           app: visa-processor
+#    - podSelector:
+#        matchLabels:
+#          app: mastercard-processor
+#  - ports:
+#    # Istio-pilot port -- required for istio-proxy registration
+#    - port: 15010
+#    to:
+#    - namespaceSelector:
+#        matchLabels:
+#          istio-system: "true"
+#  - ports:
+#    - protocol: UDP
+#      # kube-dns -- required for istio-proxy to find istio-pilot service
+#      port: 53
+#    to:
+#    - namespaceSelector:
+#        matchLabels:
+#          kube-system: "true"
+#
+#---
+#kind: NetworkPolicy
+#apiVersion: networking.k8s.io/v1
+#metadata:
+#  name: payments-gateway-ingress-payments-visa-processor
+#  namespace: payments
+#spec:
+#  podSelector:
+#    matchLabels:
+#      app: visa-processor
+#  ingress:
+#  - from:
+#    - podSelector:
+#        matchLabels:
+#          app: gateway
+#  - ports:
+#    # Istio-proxy status port -- required for Istio to update routing
+#    - port: 15020
+#    from:
+#    - namespaceSelector:
+#        matchLabels:
+#          istio-system: "true"
+#  - ports:
+#    # Istio-proxy port -- required for Istio to update routing
+#    - port: 15090
+#    from:
+#    - namespaceSelector:
+#        matchLabels:
+#          istio-system: "true"
+#  egress:
+#  - to:
+#    - podSelector:
+#        matchLabels:
+#          app: gateway
+#  - ports:
+#    # Istio-pilot port -- required for istio-proxy registration
+#    - port: 15010
+#    to:
+#    - namespaceSelector:
+#        matchLabels:
+#          istio-system: "true"
+#  - ports:
+#    - protocol: UDP
+#      # kube-dns -- required for istio-proxy to find istio-pilot service
+#      port: 53
+#    to:
+#    - namespaceSelector:
+#        matchLabels:
+#          kube-system: "true"
+#
+#---
+#kind: NetworkPolicy
+#apiVersion: networking.k8s.io/v1
+#metadata:
+#  name: payments-gateway-ingress-payments-mastercard-processor
+#  namespace: payments
+#spec:
+#  podSelector:
+#    matchLabels:
+#      app: mastercard-processor
+#  ingress:
+#  - from:
+#    - podSelector:
+#        matchLabels:
+#          app: gateway
+#  - ports:
+#    # Istio-proxy status port -- required for Istio to update routing
+#    - port: 15020
+#    from:
+#    - namespaceSelector:
+#        matchLabels:
+#          istio-system: "true"
+#  - ports:
+#    # Istio-proxy port -- required for Istio to update routing
+#    - port: 15090
+#    from:
+#    - namespaceSelector:
+#        matchLabels:
+#          istio-system: "true"
+#  egress:
+#  - to:
+#    - podSelector:
+#        matchLabels:
+#          app: gateway
+#  - ports:
+#    # Istio-pilot port -- required for istio-proxy registration
+#    - port: 15010
+#    to:
+#    - namespaceSelector:
+#        matchLabels:
+#          istio-system: "true"
+#  - ports:
+#    - protocol: UDP
+#      # kube-dns -- required for istio-proxy to find istio-pilot service
+#      port: 53
+#    to:
+#    - namespaceSelector:
+#        matchLabels:
+#          kube-system: "true"
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: payments-secrets
+  namespace: payments
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["*"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: payments-secrets
+  namespace: payments
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: payments-secrets
+subjects:
+- kind: User
+  name: "joe@example.com"
+  apiGroup: rbac.authorization.k8s.io
+