447 lines
11 KiB
YAML
447 lines
11 KiB
YAML
# Secret named "ssh-keys"
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
namespace: payments
|
|
name: ssh-keys
|
|
data:
|
|
id_rsa: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlDWGdJQkFBS0JnUURSVk4vbFYxOFFYMnBmQlNLYVowVVlDVlk2TDFSRDlhNy9QRGtmVlpJRXdTUCszczIzCmpHU3NZanhxZXliT0lEZzI3dndkWkw5R1dEd2Nsb2lVbmhjWUpDSlJaalN4VUw5MmJJSGVhYitYSnJQUGRFNmUKbnZLTmpsSE1nampxdVhQWGkrQmpjNDgvd1BGYnhLVndSclYwOUFZOUpDbXBWZUhqdUFHUStwbmk2d0lEQVFBQgpBb0dCQUpkWWpSUk1xaisxTEx3TWcyc3RGUWgrMzZmcnhqbm9iS0MrMHZIenRVSFl2b1NzWkFHNzhLR3QyTTZICndaT3dPZFNGenlRVlRqRzI0NmNyc3czNGl1cXJtd2Q1Qmhhb0hEbmhGN3pqZkMybUN5MjlkNGF4cGY0N1NZMGYKais5bHEzSzNrRDhkcVBQTzhGRnhjQlNmSGw3ejFWR2ppbmx1V1UwbHBUN1V4YlY1QWtFQTZkMElkYTJFMlo1LwpjYTZIQXdQVGpIOUFMYzhwQlI0bXg4Q2pUN1BWZk1ncUV5SGdTRGx3aGw4V3Z2OHFWVG0xRDdxUFhoS21FeTVhCnZWdDlnUE9PclFKQkFPVWxZdS85ZUNWODY0L2VacWhWYXlBT0JIUHNUQ3ZpZ04wNk83MDBHeldPVlVGR0pxUkoKY2dWRnNhVjBudytrU3FxaFdTRVJGS1JxM3RHYmFlK1JZdmNDUUUwSjRDQ0w0YWlpbXM4RE5EeWRCUkpTVlAwQwpNandhVzZJUDVueDUvRWpYMDJ4c0Myc2ZhTjhLOGY1SEpsWGU1Yk5odkpxN3YvT3ZvSHFpYWV5Unp4MENRUUM2CkM2TEtxNGRUR0p2QlVaY1Q4VlpxemphN1VBMkFUQVRJbWJGTEt2VTBoSDJmNDY4WUVER3RLaXJUNVY0SHV5S00KYXpnTWF1dlJtcHVTbjVaaFZpOTlBa0VBaWtIanNZZW5YVWNaSHpHZzVTZ3RGc29DdXV2eEdNenpNc2cyVWZIVgo5TnNXNXoxcytHNmM2bXhCMmxFaTRVcEswc0xJeTMyZG9NRVpKQkp2cGN5MVZ3PT0KLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
|
|
id_rsa.pub: c3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFBZ1FEUlZOL2xWMThRWDJwZkJTS2FaMFVZQ1ZZNkwxUkQ5YTcvUERrZlZaSUV3U1ArM3MyM2pHU3NZanhxZXliT0lEZzI3dndkWkw5R1dEd2Nsb2lVbmhjWUpDSlJaalN4VUw5MmJJSGVhYitYSnJQUGRFNmVudktOamxITWdqanF1WFBYaStCamM0OC93UEZieEtWd1JyVjA5QVk5SkNtcFZlSGp1QUdRK3BuaTZ3PT0gaGFja2VybWFuCg==
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: visa-processor
|
|
namespace: payments
|
|
labels:
|
|
app: visa-processor
|
|
secrets:
|
|
- name: rhacs-demo-pull-pull-secret
|
|
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: visa-processor
|
|
labels:
|
|
app: visa-processor
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: cluster-admin
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: visa-processor
|
|
namespace: payments
|
|
|
|
---
|
|
# Deployment named "visa-processor"
|
|
# Listens on :8080
|
|
# Vulnerable to struts
|
|
# Has SSH keys mounted
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: visa-processor
|
|
namespace: payments
|
|
labels:
|
|
app: visa-processor
|
|
demo: roadshow
|
|
annotations:
|
|
"admission.stackrox.io/break-glass": "jira-3423"
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: visa-processor
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: visa-processor
|
|
spec:
|
|
imagePullSecrets:
|
|
- name: rhacs-demo-pull-pull-secret
|
|
serviceAccountName: visa-processor
|
|
volumes:
|
|
- name: ssh-keys
|
|
secret:
|
|
secretName: ssh-keys
|
|
containers:
|
|
- image: quay.io/rhacs-demo/visa-processor:latest-v2
|
|
imagePullPolicy: Always
|
|
name: visa-processor
|
|
ports:
|
|
- containerPort: 22
|
|
protocol: TCP
|
|
- containerPort: 8080
|
|
protocol: TCP
|
|
volumeMounts:
|
|
- name: ssh-keys
|
|
mountPath: "/root/.ssh"
|
|
readOnly: false
|
|
securityContext:
|
|
capabilities:
|
|
add: ["SYS_ADMIN"]
|
|
env:
|
|
- name: I_HAVE_A_SECRET
|
|
value: "true"
|
|
- image: quay.io/rhacs-demo/visa-processor:sidecar-latest-v2
|
|
imagePullPolicy: Always
|
|
name: visa-processor-sidecar
|
|
command: ["/bin/entrypoint"]
|
|
securityContext:
|
|
privileged: true
|
|
|
|
---
|
|
# Service named "visa-processor-service"
|
|
# Listens on :8080
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
labels:
|
|
app: visa-processor
|
|
name: visa-processor-service
|
|
namespace: payments
|
|
spec:
|
|
ports:
|
|
- port: 8080
|
|
protocol: TCP
|
|
targetPort: 8080
|
|
name: http
|
|
selector:
|
|
app: visa-processor
|
|
type: ClusterIP
|
|
|
|
---
|
|
# Deployment named "gateway"
|
|
# Listens on :7777
|
|
# Has SSH keys mounted
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: gateway
|
|
namespace: payments
|
|
labels:
|
|
app: gateway
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: gateway
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: gateway
|
|
spec:
|
|
imagePullSecrets:
|
|
- name: rhacs-demo-pull-pull-secret
|
|
volumes:
|
|
- name: ssh-keys
|
|
secret:
|
|
secretName: ssh-keys
|
|
containers:
|
|
- image: quay.io/rhacs-demo/netflow:latest
|
|
command: ["/bin/entrypoint"]
|
|
args: ["-listen", "7777", "-connect", "visa-processor-service.payments.svc.cluster.local:8080,mastercard-processor-service.payments.svc.cluster.local:8080"]
|
|
imagePullPolicy: Always
|
|
name: gateway
|
|
ports:
|
|
- containerPort: 7777
|
|
protocol: TCP
|
|
volumeMounts:
|
|
- name: ssh-keys
|
|
mountPath: "/root/.ssh"
|
|
|
|
---
|
|
# Service named "gateway-service"
|
|
# Listens on :7777
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
labels:
|
|
app: gateway
|
|
name: gateway-service
|
|
namespace: payments
|
|
spec:
|
|
ports:
|
|
- port: 7777
|
|
protocol: TCP
|
|
targetPort: 7777
|
|
name: http
|
|
selector:
|
|
app: gateway
|
|
type: ClusterIP
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: mastercard-processor
|
|
namespace: payments
|
|
labels:
|
|
app: mastercard-processor
|
|
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: mastercard-processor
|
|
namespace: payments
|
|
labels:
|
|
app: mastercard-processor
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: cluster-admin
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: mastercard-processor
|
|
namespace: payments
|
|
|
|
---
|
|
# Deployment named "mastercard-processor"
|
|
# Listens on :8080
|
|
# Vulnerable to struts
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: mastercard-processor
|
|
namespace: payments
|
|
labels:
|
|
app: mastercard-processor
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: mastercard-processor
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: mastercard-processor
|
|
spec:
|
|
imagePullSecrets:
|
|
- name: rhacs-demo-pull-pull-secret
|
|
serviceAccountName: mastercard-processor
|
|
containers:
|
|
- image: quay.io/rhacs-demo/mastercard-processor:latest
|
|
imagePullPolicy: Always
|
|
name: mastercard-processor
|
|
ports:
|
|
- containerPort: 8080
|
|
protocol: TCP
|
|
|
|
---
|
|
# Service named "mastercard-processor-service"
|
|
# Listens on :8080
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
labels:
|
|
app: mastercard-processor
|
|
name: mastercard-processor-service
|
|
namespace: payments
|
|
spec:
|
|
ports:
|
|
- port: 8080
|
|
protocol: TCP
|
|
targetPort: 8080
|
|
name: http
|
|
selector:
|
|
app: mastercard-processor
|
|
type: ClusterIP
|
|
|
|
#---
|
|
#kind: NetworkPolicy
|
|
#apiVersion: networking.k8s.io/v1
|
|
#metadata:
|
|
# name: backend-api-server-ingress-payments-gateway
|
|
# namespace: payments
|
|
#spec:
|
|
# podSelector:
|
|
# matchLabels:
|
|
# app: gateway
|
|
# ingress:
|
|
# - from:
|
|
# - namespaceSelector:
|
|
# matchLabels:
|
|
# name: backend
|
|
# podSelector:
|
|
# matchLabels:
|
|
# app: api-server
|
|
# - podSelector:
|
|
# matchLabels:
|
|
# app: visa-processor
|
|
# - podSelector:
|
|
# matchLabels:
|
|
# app: mastercard-processor
|
|
# - ports:
|
|
# # Istio-proxy status port -- required for Istio to update routing
|
|
# - port: 15020
|
|
# from:
|
|
# - namespaceSelector:
|
|
# matchLabels:
|
|
# istio-system: "true"
|
|
# - ports:
|
|
# # Istio-proxy port -- required for Istio to update routing
|
|
# - port: 15090
|
|
# from:
|
|
# - namespaceSelector:
|
|
# matchLabels:
|
|
# istio-system: "true"
|
|
# egress:
|
|
# - to:
|
|
# - namespaceSelector:
|
|
# matchLabels:
|
|
# name: backend
|
|
# podSelector:
|
|
# matchLabels:
|
|
# app: api-server
|
|
# - podSelector:
|
|
# matchLabels:
|
|
# app: visa-processor
|
|
# - podSelector:
|
|
# matchLabels:
|
|
# app: mastercard-processor
|
|
# - ports:
|
|
# # Istio-pilot port -- required for istio-proxy registration
|
|
# - port: 15010
|
|
# to:
|
|
# - namespaceSelector:
|
|
# matchLabels:
|
|
# istio-system: "true"
|
|
# - ports:
|
|
# - protocol: UDP
|
|
# # kube-dns -- required for istio-proxy to find istio-pilot service
|
|
# port: 53
|
|
# to:
|
|
# - namespaceSelector:
|
|
# matchLabels:
|
|
# kube-system: "true"
|
|
#
|
|
#---
|
|
#kind: NetworkPolicy
|
|
#apiVersion: networking.k8s.io/v1
|
|
#metadata:
|
|
# name: payments-gateway-ingress-payments-visa-processor
|
|
# namespace: payments
|
|
#spec:
|
|
# podSelector:
|
|
# matchLabels:
|
|
# app: visa-processor
|
|
# ingress:
|
|
# - from:
|
|
# - podSelector:
|
|
# matchLabels:
|
|
# app: gateway
|
|
# - ports:
|
|
# # Istio-proxy status port -- required for Istio to update routing
|
|
# - port: 15020
|
|
# from:
|
|
# - namespaceSelector:
|
|
# matchLabels:
|
|
# istio-system: "true"
|
|
# - ports:
|
|
# # Istio-proxy port -- required for Istio to update routing
|
|
# - port: 15090
|
|
# from:
|
|
# - namespaceSelector:
|
|
# matchLabels:
|
|
# istio-system: "true"
|
|
# egress:
|
|
# - to:
|
|
# - podSelector:
|
|
# matchLabels:
|
|
# app: gateway
|
|
# - ports:
|
|
# # Istio-pilot port -- required for istio-proxy registration
|
|
# - port: 15010
|
|
# to:
|
|
# - namespaceSelector:
|
|
# matchLabels:
|
|
# istio-system: "true"
|
|
# - ports:
|
|
# - protocol: UDP
|
|
# # kube-dns -- required for istio-proxy to find istio-pilot service
|
|
# port: 53
|
|
# to:
|
|
# - namespaceSelector:
|
|
# matchLabels:
|
|
# kube-system: "true"
|
|
#
|
|
#---
|
|
#kind: NetworkPolicy
|
|
#apiVersion: networking.k8s.io/v1
|
|
#metadata:
|
|
# name: payments-gateway-ingress-payments-mastercard-processor
|
|
# namespace: payments
|
|
#spec:
|
|
# podSelector:
|
|
# matchLabels:
|
|
# app: mastercard-processor
|
|
# ingress:
|
|
# - from:
|
|
# - podSelector:
|
|
# matchLabels:
|
|
# app: gateway
|
|
# - ports:
|
|
# # Istio-proxy status port -- required for Istio to update routing
|
|
# - port: 15020
|
|
# from:
|
|
# - namespaceSelector:
|
|
# matchLabels:
|
|
# istio-system: "true"
|
|
# - ports:
|
|
# # Istio-proxy port -- required for Istio to update routing
|
|
# - port: 15090
|
|
# from:
|
|
# - namespaceSelector:
|
|
# matchLabels:
|
|
# istio-system: "true"
|
|
# egress:
|
|
# - to:
|
|
# - podSelector:
|
|
# matchLabels:
|
|
# app: gateway
|
|
# - ports:
|
|
# # Istio-pilot port -- required for istio-proxy registration
|
|
# - port: 15010
|
|
# to:
|
|
# - namespaceSelector:
|
|
# matchLabels:
|
|
# istio-system: "true"
|
|
# - ports:
|
|
# - protocol: UDP
|
|
# # kube-dns -- required for istio-proxy to find istio-pilot service
|
|
# port: 53
|
|
# to:
|
|
# - namespaceSelector:
|
|
# matchLabels:
|
|
# kube-system: "true"
|
|
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: payments-secrets
|
|
namespace: payments
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["*"]
|
|
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: payments-secrets
|
|
namespace: payments
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: payments-secrets
|
|
subjects:
|
|
- kind: User
|
|
name: "joe@example.com"
|
|
apiGroup: rbac.authorization.k8s.io
|
|
|