# Secret named "ssh-keys"
apiVersion: v1
kind: Secret
metadata:
  namespace: payments
  name: ssh-keys
data:
  id_rsa: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlDWGdJQkFBS0JnUURSVk4vbFYxOFFYMnBmQlNLYVowVVlDVlk2TDFSRDlhNy9QRGtmVlpJRXdTUCszczIzCmpHU3NZanhxZXliT0lEZzI3dndkWkw5R1dEd2Nsb2lVbmhjWUpDSlJaalN4VUw5MmJJSGVhYitYSnJQUGRFNmUKbnZLTmpsSE1nampxdVhQWGkrQmpjNDgvd1BGYnhLVndSclYwOUFZOUpDbXBWZUhqdUFHUStwbmk2d0lEQVFBQgpBb0dCQUpkWWpSUk1xaisxTEx3TWcyc3RGUWgrMzZmcnhqbm9iS0MrMHZIenRVSFl2b1NzWkFHNzhLR3QyTTZICndaT3dPZFNGenlRVlRqRzI0NmNyc3czNGl1cXJtd2Q1Qmhhb0hEbmhGN3pqZkMybUN5MjlkNGF4cGY0N1NZMGYKais5bHEzSzNrRDhkcVBQTzhGRnhjQlNmSGw3ejFWR2ppbmx1V1UwbHBUN1V4YlY1QWtFQTZkMElkYTJFMlo1LwpjYTZIQXdQVGpIOUFMYzhwQlI0bXg4Q2pUN1BWZk1ncUV5SGdTRGx3aGw4V3Z2OHFWVG0xRDdxUFhoS21FeTVhCnZWdDlnUE9PclFKQkFPVWxZdS85ZUNWODY0L2VacWhWYXlBT0JIUHNUQ3ZpZ04wNk83MDBHeldPVlVGR0pxUkoKY2dWRnNhVjBudytrU3FxaFdTRVJGS1JxM3RHYmFlK1JZdmNDUUUwSjRDQ0w0YWlpbXM4RE5EeWRCUkpTVlAwQwpNandhVzZJUDVueDUvRWpYMDJ4c0Myc2ZhTjhLOGY1SEpsWGU1Yk5odkpxN3YvT3ZvSHFpYWV5Unp4MENRUUM2CkM2TEtxNGRUR0p2QlVaY1Q4VlpxemphN1VBMkFUQVRJbWJGTEt2VTBoSDJmNDY4WUVER3RLaXJUNVY0SHV5S00KYXpnTWF1dlJtcHVTbjVaaFZpOTlBa0VBaWtIanNZZW5YVWNaSHpHZzVTZ3RGc29DdXV2eEdNenpNc2cyVWZIVgo5TnNXNXoxcytHNmM2bXhCMmxFaTRVcEswc0xJeTMyZG9NRVpKQkp2cGN5MVZ3PT0KLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
  id_rsa.pub: c3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFBZ1FEUlZOL2xWMThRWDJwZkJTS2FaMFVZQ1ZZNkwxUkQ5YTcvUERrZlZaSUV3U1ArM3MyM2pHU3NZanhxZXliT0lEZzI3dndkWkw5R1dEd2Nsb2lVbmhjWUpDSlJaalN4VUw5MmJJSGVhYitYSnJQUGRFNmVudktOamxITWdqanF1WFBYaStCamM0OC93UEZieEtWd1JyVjA5QVk5SkNtcFZlSGp1QUdRK3BuaTZ3PT0gaGFja2VybWFuCg==
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: visa-processor
  namespace: payments
  labels:
    app: visa-processor
secrets:
- name: rhacs-demo-pull-pull-secret

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: visa-processor
  labels:
    app: visa-processor
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: visa-processor
    namespace: payments

---
# Deployment named "visa-processor"
# Listens on :8080
# Vulnerable to struts
# Has SSH keys mounted
apiVersion: apps/v1
kind: Deployment
metadata:
  name: visa-processor
  namespace: payments
  labels:
    app: visa-processor
    demo: roadshow
  annotations:
    "admission.stackrox.io/break-glass": "jira-3423"
spec:
  replicas: 1
  selector:
    matchLabels:
       app: visa-processor
  template:
    metadata:
     labels:
       app: visa-processor
    spec:
      imagePullSecrets:
      - name: rhacs-demo-pull-pull-secret
      serviceAccountName: visa-processor
      volumes:
      - name: ssh-keys
        secret:
          secretName: ssh-keys
      containers:
      - image: quay.io/rhacs-demo/visa-processor:latest-v2
        imagePullPolicy: Always
        name: visa-processor
        ports:
        - containerPort: 22
          protocol: TCP
        - containerPort: 8080
          protocol: TCP
        volumeMounts:
        - name: ssh-keys
          mountPath: "/root/.ssh"
          readOnly: false
        securityContext:
          capabilities:
            add: ["SYS_ADMIN"]
        env:
        - name: I_HAVE_A_SECRET
          value: "true"
      - image: quay.io/rhacs-demo/visa-processor:sidecar-latest-v2
        imagePullPolicy: Always
        name: visa-processor-sidecar
        command: ["/bin/entrypoint"]
        securityContext:
          privileged: true

---
# Service named "visa-processor-service"
# Listens on :8080
apiVersion: v1
kind: Service
metadata:
  labels:
    app: visa-processor
  name: visa-processor-service
  namespace: payments
spec:
  ports:
  - port: 8080
    protocol: TCP
    targetPort: 8080
    name: http
  selector:
    app: visa-processor
  type: ClusterIP

---
# Deployment named "gateway"
# Listens on :7777
# Has SSH keys mounted
apiVersion: apps/v1
kind: Deployment
metadata:
  name: gateway
  namespace: payments
  labels:
    app: gateway
spec:
  replicas: 1
  selector:
    matchLabels:
       app: gateway
  template:
    metadata:
     labels:
       app: gateway
    spec:
      imagePullSecrets:
      - name: rhacs-demo-pull-pull-secret
      volumes:
      - name: ssh-keys
        secret:
          secretName: ssh-keys
      containers:
      - image: quay.io/rhacs-demo/netflow:latest
        command: ["/bin/entrypoint"]
        args: ["-listen", "7777", "-connect", "visa-processor-service.payments.svc.cluster.local:8080,mastercard-processor-service.payments.svc.cluster.local:8080"]
        imagePullPolicy: Always
        name: gateway
        ports:
        - containerPort: 7777
          protocol: TCP
        volumeMounts:
        - name: ssh-keys
          mountPath: "/root/.ssh"

---
# Service named "gateway-service"
# Listens on :7777
apiVersion: v1
kind: Service
metadata:
  labels:
    app: gateway
  name: gateway-service
  namespace: payments
spec:
  ports:
  - port: 7777
    protocol: TCP
    targetPort: 7777
    name: http
  selector:
    app: gateway
  type: ClusterIP

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: mastercard-processor
  namespace: payments
  labels:
    app: mastercard-processor

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: mastercard-processor
  namespace: payments
  labels:
    app: mastercard-processor
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: mastercard-processor
    namespace: payments

---
# Deployment named "mastercard-processor"
# Listens on :8080
# Vulnerable to struts
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mastercard-processor
  namespace: payments
  labels:
    app: mastercard-processor
spec:
  replicas: 1
  selector:
    matchLabels:
       app: mastercard-processor
  template:
    metadata:
     labels:
       app: mastercard-processor
    spec:
      imagePullSecrets:
      - name: rhacs-demo-pull-pull-secret
      serviceAccountName: mastercard-processor
      containers:
      - image: quay.io/rhacs-demo/mastercard-processor:latest
        imagePullPolicy: Always
        name: mastercard-processor
        ports:
        - containerPort: 8080
          protocol: TCP

---
# Service named "mastercard-processor-service"
# Listens on :8080
apiVersion: v1
kind: Service
metadata:
  labels:
    app: mastercard-processor
  name: mastercard-processor-service
  namespace: payments
spec:
  ports:
  - port: 8080
    protocol: TCP
    targetPort: 8080
    name: http
  selector:
    app: mastercard-processor
  type: ClusterIP

#---
#kind: NetworkPolicy
#apiVersion: networking.k8s.io/v1
#metadata:
#  name: backend-api-server-ingress-payments-gateway
#  namespace: payments
#spec:
#  podSelector:
#    matchLabels:
#      app: gateway
#  ingress:
#  - from:
#    - namespaceSelector:
#        matchLabels:
#          name: backend
#      podSelector:
#        matchLabels:
#          app: api-server
#    - podSelector:
#        matchLabels:
#          app: visa-processor
#    - podSelector:
#        matchLabels:
#          app: mastercard-processor
#  - ports:
#    # Istio-proxy status port -- required for Istio to update routing
#    - port: 15020
#    from:
#    - namespaceSelector:
#        matchLabels:
#          istio-system: "true"
#  - ports:
#    # Istio-proxy port -- required for Istio to update routing
#    - port: 15090
#    from:
#    - namespaceSelector:
#        matchLabels:
#          istio-system: "true"
#  egress:
#  - to:
#    - namespaceSelector:
#        matchLabels:
#          name: backend
#      podSelector:
#        matchLabels:
#          app: api-server
#    - podSelector:
#        matchLabels:
#           app: visa-processor
#    - podSelector:
#        matchLabels:
#          app: mastercard-processor
#  - ports:
#    # Istio-pilot port -- required for istio-proxy registration
#    - port: 15010
#    to:
#    - namespaceSelector:
#        matchLabels:
#          istio-system: "true"
#  - ports:
#    - protocol: UDP
#      # kube-dns -- required for istio-proxy to find istio-pilot service
#      port: 53
#    to:
#    - namespaceSelector:
#        matchLabels:
#          kube-system: "true"
#
#---
#kind: NetworkPolicy
#apiVersion: networking.k8s.io/v1
#metadata:
#  name: payments-gateway-ingress-payments-visa-processor
#  namespace: payments
#spec:
#  podSelector:
#    matchLabels:
#      app: visa-processor
#  ingress:
#  - from:
#    - podSelector:
#        matchLabels:
#          app: gateway
#  - ports:
#    # Istio-proxy status port -- required for Istio to update routing
#    - port: 15020
#    from:
#    - namespaceSelector:
#        matchLabels:
#          istio-system: "true"
#  - ports:
#    # Istio-proxy port -- required for Istio to update routing
#    - port: 15090
#    from:
#    - namespaceSelector:
#        matchLabels:
#          istio-system: "true"
#  egress:
#  - to:
#    - podSelector:
#        matchLabels:
#          app: gateway
#  - ports:
#    # Istio-pilot port -- required for istio-proxy registration
#    - port: 15010
#    to:
#    - namespaceSelector:
#        matchLabels:
#          istio-system: "true"
#  - ports:
#    - protocol: UDP
#      # kube-dns -- required for istio-proxy to find istio-pilot service
#      port: 53
#    to:
#    - namespaceSelector:
#        matchLabels:
#          kube-system: "true"
#
#---
#kind: NetworkPolicy
#apiVersion: networking.k8s.io/v1
#metadata:
#  name: payments-gateway-ingress-payments-mastercard-processor
#  namespace: payments
#spec:
#  podSelector:
#    matchLabels:
#      app: mastercard-processor
#  ingress:
#  - from:
#    - podSelector:
#        matchLabels:
#          app: gateway
#  - ports:
#    # Istio-proxy status port -- required for Istio to update routing
#    - port: 15020
#    from:
#    - namespaceSelector:
#        matchLabels:
#          istio-system: "true"
#  - ports:
#    # Istio-proxy port -- required for Istio to update routing
#    - port: 15090
#    from:
#    - namespaceSelector:
#        matchLabels:
#          istio-system: "true"
#  egress:
#  - to:
#    - podSelector:
#        matchLabels:
#          app: gateway
#  - ports:
#    # Istio-pilot port -- required for istio-proxy registration
#    - port: 15010
#    to:
#    - namespaceSelector:
#        matchLabels:
#          istio-system: "true"
#  - ports:
#    - protocol: UDP
#      # kube-dns -- required for istio-proxy to find istio-pilot service
#      port: 53
#    to:
#    - namespaceSelector:
#        matchLabels:
#          kube-system: "true"

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: payments-secrets
  namespace: payments
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["*"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: payments-secrets
  namespace: payments
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: payments-secrets
subjects:
- kind: User
  name: "joe@example.com"
  apiGroup: rbac.authorization.k8s.io