talks/2025-01-28-advanced-cluster-security/medical-application/operations/everything.yml

# Secret named "ssh-keys"
apiVersion: v1
kind: Secret
metadata:
  namespace: operations
  name: ssh-keys
data:
  id_rsa: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlDWGdJQkFBS0JnUURSVk4vbFYxOFFYMnBmQlNLYVowVVlDVlk2TDFSRDlhNy9QRGtmVlpJRXdTUCszczIzCmpHU3NZanhxZXliT0lEZzI3dndkWkw5R1dEd2Nsb2lVbmhjWUpDSlJaalN4VUw5MmJJSGVhYitYSnJQUGRFNmUKbnZLTmpsSE1nampxdVhQWGkrQmpjNDgvd1BGYnhLVndSclYwOUFZOUpDbXBWZUhqdUFHUStwbmk2d0lEQVFBQgpBb0dCQUpkWWpSUk1xaisxTEx3TWcyc3RGUWgrMzZmcnhqbm9iS0MrMHZIenRVSFl2b1NzWkFHNzhLR3QyTTZICndaT3dPZFNGenlRVlRqRzI0NmNyc3czNGl1cXJtd2Q1Qmhhb0hEbmhGN3pqZkMybUN5MjlkNGF4cGY0N1NZMGYKais5bHEzSzNrRDhkcVBQTzhGRnhjQlNmSGw3ejFWR2ppbmx1V1UwbHBUN1V4YlY1QWtFQTZkMElkYTJFMlo1LwpjYTZIQXdQVGpIOUFMYzhwQlI0bXg4Q2pUN1BWZk1ncUV5SGdTRGx3aGw4V3Z2OHFWVG0xRDdxUFhoS21FeTVhCnZWdDlnUE9PclFKQkFPVWxZdS85ZUNWODY0L2VacWhWYXlBT0JIUHNUQ3ZpZ04wNk83MDBHeldPVlVGR0pxUkoKY2dWRnNhVjBudytrU3FxaFdTRVJGS1JxM3RHYmFlK1JZdmNDUUUwSjRDQ0w0YWlpbXM4RE5EeWRCUkpTVlAwQwpNandhVzZJUDVueDUvRWpYMDJ4c0Myc2ZhTjhLOGY1SEpsWGU1Yk5odkpxN3YvT3ZvSHFpYWV5Unp4MENRUUM2CkM2TEtxNGRUR0p2QlVaY1Q4VlpxemphN1VBMkFUQVRJbWJGTEt2VTBoSDJmNDY4WUVER3RLaXJUNVY0SHV5S00KYXpnTWF1dlJtcHVTbjVaaFZpOTlBa0VBaWtIanNZZW5YVWNaSHpHZzVTZ3RGc29DdXV2eEdNenpNc2cyVWZIVgo5TnNXNXoxcytHNmM2bXhCMmxFaTRVcEswc0xJeTMyZG9NRVpKQkp2cGN5MVZ3PT0KLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
  id_rsa.pub: c3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFBZ1FEUlZOL2xWMThRWDJwZkJTS2FaMFVZQ1ZZNkwxUkQ5YTcvUERrZlZaSUV3U1ArM3MyM2pHU3NZanhxZXliT0lEZzI3dndkWkw5R1dEd2Nsb2lVbmhjWUpDSlJaalN4VUw5MmJJSGVhYitYSnJQUGRFNmVudktOamxITWdqanF1WFBYaStCamM0OC93UEZieEtWd1JyVjA5QVk5SkNtcFZlSGp1QUdRK3BuaTZ3PT0gaGFja2VybWFuCg==

---
# Deployment named "jump-host"
# Listens on :22
# Has SSH keys mounted
# Connects to "visa-processor-service" in the "payments" namespace
apiVersion: apps/v1
kind: Deployment
metadata:
  name: jump-host
  namespace: operations
  labels:
    app: jump-host
    demo: roadshow
spec:
  replicas: 1
  selector:
    matchLabels:
       app: jump-host
  template:
    metadata:
     labels:
       app: jump-host
    spec:
      volumes:
      - name: ssh-keys
        secret:
          secretName: ssh-keys
      imagePullSecrets:
      - name: rhacs-demo-pull-pull-secret
      containers:
      - image: quay.io/rhacs-demo/jump-host:latest
        command: ["/bin/entrypoint"]
        args: ["-listen", "22", "-connect", "pupper-master-service.operations.svc.cluster.local:8140,visa-processor-service.payments.svc.cluster.local:8080,patient-db-service.medical.svc.cluster.local:8080"]
        imagePullPolicy: Always
        name: jump-host
        ports:
        - containerPort: 22
          name: tcp
          protocol: TCP
        volumeMounts:
        - name: ssh-keys
          mountPath: "/root/.ssh"

---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: jump-host
  name: jump-host-service
  namespace: operations
spec:
  ports:
  - port: 8001
    protocol: TCP
    targetPort: 22
    name: tcp
  selector:
    app: jump-host
  type: ClusterIP

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: puppet-master
  namespace: operations
  labels:
    app: puppet-master

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: puppet-master
  namespace: operations
  labels:
    app: puppet-master
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["get", "watch", "list"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: puppet-master
  namespace: operations
  labels:
    app: puppet-master
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: puppet-master
subjects:
  - kind: ServiceAccount
    name: puppet-master
    namespace: operations

---
# Deployment named "puppet-master"
# Listens on :8140
# Runs apt-get
# Runs nmap
# Mounts the host Docker socket
# Runs as privileged
apiVersion: apps/v1
kind: Deployment
metadata:
  name: puppet-master
  namespace: operations
  labels:
    app: puppet-master
spec:
  replicas: 1
  selector:
    matchLabels:
       app: puppet-master
  template:
    metadata:
     labels:
       app: puppet-master
    spec:
      imagePullSecrets:
      - name: rhacs-demo-pull-pull-secret
      serviceAccountName: puppet-master
      volumes:
      - hostPath:
          path: /var/run/docker.sock
        name: var-run-docker-sock
      containers:
      - image: quay.io/rhacs-demo/netflow:latest
        command: ["/bin/sh"]
        args: ["-c", "/usr/bin/apt-get install nmap; /bin/nmap -Pn 10.0.0.0/24; /bin/entrypoint -listen 8140"]
        imagePullPolicy: Always
        name: puppet-master
        securityContext:
          privileged: true
        ports:
        - containerPort: 8140
          protocol: TCP
        volumeMounts:
        - mountPath: /host/var/run/docker.sock
          name: var-run-docker-sock

---

# Service named "pupper-master-service"
# Listens on :8140
apiVersion: v1
kind: Service
metadata:
  labels:
    app: puppet-master
  name: pupper-master-service
  namespace: operations
spec:
  ports:
  - port: 8140
    protocol: TCP
    targetPort: 8140
    name: http
  selector:
    app: puppet-master
  type: ClusterIP