talks/2025-01-28-advanced-cluster-security/medical-application/frontend/everything.yml

# Secret named "ssh-keys"
apiVersion: v1
kind: Secret
metadata:
  name: ssh-keys
  namespace: frontend
data:
  id_rsa: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlDWGdJQkFBS0JnUURSVk4vbFYxOFFYMnBmQlNLYVowVVlDVlk2TDFSRDlhNy9QRGtmVlpJRXdTUCszczIzCmpHU3NZanhxZXliT0lEZzI3dndkWkw5R1dEd2Nsb2lVbmhjWUpDSlJaalN4VUw5MmJJSGVhYitYSnJQUGRFNmUKbnZLTmpsSE1nampxdVhQWGkrQmpjNDgvd1BGYnhLVndSclYwOUFZOUpDbXBWZUhqdUFHUStwbmk2d0lEQVFBQgpBb0dCQUpkWWpSUk1xaisxTEx3TWcyc3RGUWgrMzZmcnhqbm9iS0MrMHZIenRVSFl2b1NzWkFHNzhLR3QyTTZICndaT3dPZFNGenlRVlRqRzI0NmNyc3czNGl1cXJtd2Q1Qmhhb0hEbmhGN3pqZkMybUN5MjlkNGF4cGY0N1NZMGYKais5bHEzSzNrRDhkcVBQTzhGRnhjQlNmSGw3ejFWR2ppbmx1V1UwbHBUN1V4YlY1QWtFQTZkMElkYTJFMlo1LwpjYTZIQXdQVGpIOUFMYzhwQlI0bXg4Q2pUN1BWZk1ncUV5SGdTRGx3aGw4V3Z2OHFWVG0xRDdxUFhoS21FeTVhCnZWdDlnUE9PclFKQkFPVWxZdS85ZUNWODY0L2VacWhWYXlBT0JIUHNUQ3ZpZ04wNk83MDBHeldPVlVGR0pxUkoKY2dWRnNhVjBudytrU3FxaFdTRVJGS1JxM3RHYmFlK1JZdmNDUUUwSjRDQ0w0YWlpbXM4RE5EeWRCUkpTVlAwQwpNandhVzZJUDVueDUvRWpYMDJ4c0Myc2ZhTjhLOGY1SEpsWGU1Yk5odkpxN3YvT3ZvSHFpYWV5Unp4MENRUUM2CkM2TEtxNGRUR0p2QlVaY1Q4VlpxemphN1VBMkFUQVRJbWJGTEt2VTBoSDJmNDY4WUVER3RLaXJUNVY0SHV5S00KYXpnTWF1dlJtcHVTbjVaaFZpOTlBa0VBaWtIanNZZW5YVWNaSHpHZzVTZ3RGc29DdXV2eEdNenpNc2cyVWZIVgo5TnNXNXoxcytHNmM2bXhCMmxFaTRVcEswc0xJeTMyZG9NRVpKQkp2cGN5MVZ3PT0KLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
  id_rsa.pub: c3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFBZ1FEUlZOL2xWMThRWDJwZkJTS2FaMFVZQ1ZZNkwxUkQ5YTcvUERrZlZaSUV3U1ArM3MyM2pHU3NZanhxZXliT0lEZzI3dndkWkw5R1dEd2Nsb2lVbmhjWUpDSlJaalN4VUw5MmJJSGVhYitYSnJQUGRFNmVudktOamxITWdqanF1WFBYaStCamM0OC93UEZieEtWd1JyVjA5QVk5SkNtcFZlSGp1QUdRK3BuaTZ3PT0gaGFja2VybWFuCg==

---

# Deployment named "asset-cache"
# Listens on :8080
# Vulnerable to struts
apiVersion: apps/v1
kind: Deployment
metadata:
  name: asset-cache
  namespace: frontend
  labels:
    app: asset-cache
    demo: roadshow
spec:
  replicas: 1
  selector:
    matchLabels:
       app: asset-cache
  template:
    metadata:
     labels:
       app: asset-cache
    spec:
      imagePullSecrets:
      - name: rhacs-demo-pull-pull-secret
      containers:
      - image: quay.io/rhacs-demo/asset-cache:latest
        imagePullPolicy: Always
        name: asset-cache
        ports:
        - containerPort: 8080
          protocol: TCP
        securityContext:
          capabilities:
            drop: ["NET_ADMIN"]
      - image: quay.io/rhacs-demo/asset-cache:sidecar-latest
        imagePullPolicy: Always
        name: asset-cache-sidecar
        command: ["/bin/entrypoint"]
        securityContext:
          privileged: false

---

# Service named "asset-cache-service"
# Listens on :8080
apiVersion: v1
kind: Service
metadata:
  labels:
    app: asset-cache
  name: asset-cache-service
  namespace: frontend
spec:
  ports:
  - port: 8080
    protocol: TCP
    targetPort: 8080
    name: http
  selector:
    app: asset-cache
  type: ClusterIP

---

# Deployment named "tls-proxy"
# Listens on :80 and :443
# Has SSH keys mounted
apiVersion: apps/v1
kind: Deployment
metadata:
  name: tls-proxy
  namespace: frontend
  labels:
    app: tls-proxy
spec:
  replicas: 1
  selector:
    matchLabels:
       app: tls-proxy
  template:
    metadata:
     labels:
       app: tls-proxy
    spec:
      imagePullSecrets:
      - name: rhacs-demo-pull-pull-secret
      volumes:
      - name: ssh-keys
        secret:
          secretName: ssh-keys
      containers:
      - image: quay.io/rhacs-demo/netflow:latest
        command: ["/bin/entrypoint"]
        args: ["-listen", "80,443", "-connect", "asset-cache-service.frontend.svc.cluster.local:8080,wordpress-service.frontend.svc.cluster.local:80"]
        imagePullPolicy: Always
        name: tls-proxy
        ports:
        - containerPort: 80
          protocol: TCP
        - containerPort: 443
          protocol: TCP
        volumeMounts:
        - name: ssh-keys
          mountPath: "/root/.ssh"

---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: tls-proxy
  name: tls-proxy-service
  namespace: frontend
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
    name: http
  - port: 443
    protocol: TCP
    targetPort: 443
    name: tls
  selector:
    app: tls-proxy
  type: ClusterIP

---

# Deployment named "wordpress"
# Listens on :80
apiVersion: apps/v1
kind: Deployment
metadata:
  name: wordpress
  namespace: frontend
  labels:
    app: wordpress
spec:
  replicas: 1
  selector:
    matchLabels:
       app: wordpress
  template:
    metadata:
     labels:
       app: wordpress
    spec:
      containers:
      - image: wordpress:latest
        imagePullPolicy: Always
        name: wordpress
        ports:
        - containerPort: 80
          protocol: TCP

---

# Service named "wordpress-service"
# Listens on :80
apiVersion: v1
kind: Service
metadata:
  labels:
    app: wordpress
  name: wordpress-service
  namespace: frontend
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
    name: http
  selector:
    app: wordpress
  type: ClusterIP

---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: monitor
  namespace: frontend
  labels:
    app: monitor
spec:
  replicas: 1
  selector:
    matchLabels:
       app: monitor
  template:
    metadata:
     labels:
       app: monitor
    spec:
      imagePullSecrets:
      - name: rhacs-demo-pull-pull-secret
      containers:
      - image: quay.io/rhacs-demo/monitor:latest
        imagePullPolicy: Always
        name: monitor