woggioni
4f3a632f4b
- kaya backend with OIDC sessions, API tokens, Postgres/Tortoise models - AES-256-GCM private key storage and full certificate/CSR/CRL domain logic - Sycamore/WASM SPA for vaults, keys, requests, certificates, CRLs and templates - imports/exports, XCA .xdb migration, Docker Compose stack and tests
133 lines
2.7 KiB
YAML
133 lines
2.7 KiB
YAML
# KCA — Kubernetes deployment sketch (namespace: kca).
|
|
#
|
|
# Replace every REPLACE_ME. Postgres and the OIDC provider are external; Redis
|
|
# is included because sessions are disposable. KCA_MASTER_KEY is the AES key
|
|
# protecting private keys at rest: generate it once and never lose it.
|
|
#
|
|
# kubectl apply -f deploy/k8s/kca.yaml
|
|
# kubectl port-forward -n kca svc/kca 8080:80
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: kca
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: kca-config
|
|
namespace: kca
|
|
data:
|
|
REDIS_URL: redis://redis.kca.svc.cluster.local:6379/0
|
|
DATABASE_ENGINE: postgres
|
|
DATABASE_HOST: REPLACE_ME
|
|
DATABASE_PORT: "5432"
|
|
DATABASE_NAME: kca
|
|
DATABASE_USER: kca
|
|
STATIC_DIR: /app/web/dist
|
|
OIDC_0_PROVIDER: default
|
|
OIDC_0_CLIENT_ID: kca
|
|
OIDC_0_ISSUER: REPLACE_ME
|
|
OIDC_0_REDIRECT_URI: REPLACE_ME
|
|
OIDC_0_POST_LOGIN_REDIRECT: /
|
|
OIDC_0_POST_LOGOUT_REDIRECT: /
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: kca-secrets
|
|
namespace: kca
|
|
type: Opaque
|
|
stringData:
|
|
DATABASE_PASSWORD: REPLACE_ME
|
|
OIDC_0_CLIENT_SECRET: REPLACE_ME
|
|
# openssl rand -base64 32
|
|
KCA_MASTER_KEY: REPLACE_ME
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: redis
|
|
namespace: kca
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: kca-redis
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: kca-redis
|
|
spec:
|
|
containers:
|
|
- name: redis
|
|
image: redis:8-alpine
|
|
ports:
|
|
- containerPort: 6379
|
|
resources:
|
|
requests: {cpu: 10m, memory: 32Mi}
|
|
limits: {memory: 128Mi}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: redis
|
|
namespace: kca
|
|
spec:
|
|
selector:
|
|
app: kca-redis
|
|
ports:
|
|
- port: 6379
|
|
targetPort: 6379
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: kca
|
|
namespace: kca
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: kca
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: kca
|
|
spec:
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
containers:
|
|
- name: kca
|
|
image: gitea.woggioni.net/woggioni/kca:latest
|
|
ports:
|
|
- containerPort: 8080
|
|
envFrom:
|
|
- configMapRef:
|
|
name: kca-config
|
|
- secretRef:
|
|
name: kca-secrets
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /api/health
|
|
port: 8080
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /api/health
|
|
port: 8080
|
|
resources:
|
|
requests: {cpu: 100m, memory: 128Mi}
|
|
limits: {memory: 512Mi}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: kca
|
|
namespace: kca
|
|
spec:
|
|
selector:
|
|
app: kca
|
|
ports:
|
|
- port: 80
|
|
targetPort: 8080
|