P6: S3 blob store, Helm chart, air-gapped installer verify loop

- S3BlobStore (object_store, path-style) behind the same BlobStore trait, tested against a REAL MinIO container (round trip, overwrite, NotFound on get and delete, nested keys); [storage] backend=local|s3 config with validation + server-side selection (S3 creds via env overlay) - Helm chart: server pod with the secret broker as a SIDECAR sharing a private emptyDir unix socket (no network hop carries credentials), frontend, optional local PVC vs S3, OIDC/oauth values, unbuffered-SSE ingress annotations, NetworkPolicies (frontend->server only), hardened securityContexts; ci/check-helm.sh lints AND asserts the rendered topology properties - deploy/airgapped/install.sh: offline signature+checksum verification via the bundled teamclaw-bundler BEFORE any docker load; --verify-only mode; ci/test-install.sh rehearses clean/tampered/wrong-key paths with the real binary - CI: helm gate + installer rehearsal wired in 149 Rust tests; helm lint + rendered assertions green; installer verify-path rehearsal green. Co-Authored-By: Claude Fable 5 <[email protected]>
2026-06-10 08:19:43 -05:00
parent ccf96053e6
commit 70ec39f696
20 changed files with 851 additions and 3 deletions
@@ -0,0 +1,20 @@
+{{- define "teamclaw.labels" -}}
+app.kubernetes.io/name: teamclaw
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{- define "teamclaw.serverSelector" -}}
+app.kubernetes.io/name: teamclaw
+app.kubernetes.io/component: server
+{{- end }}
+
+{{- define "teamclaw.brokerSelector" -}}
+app.kubernetes.io/name: teamclaw
+app.kubernetes.io/component: broker
+{{- end }}
+
+{{- define "teamclaw.frontendSelector" -}}
+app.kubernetes.io/name: teamclaw
+app.kubernetes.io/component: frontend
+{{- end }}
@@ -0,0 +1,46 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: teamclaw-config
+  labels: {{- include "teamclaw.labels" . | nindent 4 }}
+data:
+  teamclaw.toml: |
+    deploy_target = "cloud"
+    listen_addr = "0.0.0.0:8080"
+
+    [database]
+    # Overlaid by TEAMCLAW_DATABASE__URL from the Secret.
+    url = "postgres://overridden-by-env"
+
+    [llm]
+    provider = "{{ .Values.llm.provider }}"
+    model = "{{ .Values.llm.model }}"
+    {{- if .Values.llm.baseUrl }}
+    base_url = "{{ .Values.llm.baseUrl }}"
+    {{- end }}
+
+    [auth]
+    mode = "{{ .Values.auth.mode }}"
+    {{- if eq .Values.auth.mode "oidc" }}
+    issuer_url = "{{ required "auth.issuerUrl is required for oidc" .Values.auth.issuerUrl }}"
+    client_id = "{{ .Values.auth.clientId }}"
+    {{- end }}
+
+    [storage]
+    data_dir = "{{ .Values.storage.dataDir }}"
+    backend = "{{ .Values.storage.backend }}"
+    {{- if eq .Values.storage.backend "s3" }}
+    s3_endpoint = "{{ required "storage.s3.endpoint required" .Values.storage.s3.endpoint }}"
+    s3_bucket = "{{ required "storage.s3.bucket required" .Values.storage.s3.bucket }}"
+    {{- end }}
+
+    [broker]
+    socket_path = "/run/teamclaw/broker.sock"
+
+    {{- if .Values.oauth.issuerUrl }}
+
+    [oauth]
+    issuer_url = "{{ .Values.oauth.issuerUrl }}"
+    client_id = "{{ .Values.oauth.clientId }}"
+    redirect_base = "{{ .Values.oauth.redirectBase }}"
+    {{- end }}
@@ -0,0 +1,41 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: teamclaw-frontend
+  labels: {{- include "teamclaw.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.frontend.replicas }}
+  selector:
+    matchLabels: {{- include "teamclaw.frontendSelector" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "teamclaw.frontendSelector" . | nindent 8 }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile: { type: RuntimeDefault }
+      containers:
+        - name: frontend
+          image: "{{ .Values.image.registry }}/frontend:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - { containerPort: 3000, name: http }
+          env:
+            - name: API_ORIGIN
+              value: http://teamclaw-server:8080
+          resources: {{- toYaml .Values.frontend.resources | nindent 12 }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities: { drop: ["ALL"] }
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: teamclaw-frontend
+  labels: {{- include "teamclaw.labels" . | nindent 4 }}
+spec:
+  selector: {{- include "teamclaw.frontendSelector" . | nindent 4 }}
+  ports:
+    - { name: http, port: 3000, targetPort: http }
@@ -0,0 +1,37 @@
+{{- if .Values.ingress.enabled }}
+# SSE streaming (POST /api/gateway) requires unbuffered proxying with long
+# read timeouts; without these annotations approvals and live transcripts
+# stall behind nginx buffering.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: teamclaw
+  labels: {{- include "teamclaw.labels" . | nindent 4 }}
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-buffering: "off"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+spec:
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- if .Values.ingress.tlsSecretName }}
+  tls:
+    - hosts: [{{ .Values.ingress.host | quote }}]
+      secretName: {{ .Values.ingress.tlsSecretName }}
+  {{- end }}
+  rules:
+    - host: {{ .Values.ingress.host | quote }}
+      http:
+        paths:
+          - path: /api
+            pathType: Prefix
+            backend:
+              service:
+                name: teamclaw-server
+                port: { name: http }
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: teamclaw-frontend
+                port: { name: http }
+{{- end }}
@@ -0,0 +1,44 @@
+# The broker has no Service and shares the server pod, so its socket is
+# already unreachable over the network. These policies enforce the rest of
+# the §15 topology: the database secret-holders are the only egress-capable
+# pods, and the frontend can reach only the server.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: teamclaw-frontend-egress
+  labels: {{- include "teamclaw.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels: {{- include "teamclaw.frontendSelector" . | nindent 6 }}
+  policyTypes: [Egress]
+  egress:
+    # DNS, then only the server.
+    - to: []
+      ports:
+        - { protocol: UDP, port: 53 }
+        - { protocol: TCP, port: 53 }
+    - to:
+        - podSelector:
+            matchLabels: {{- include "teamclaw.serverSelector" . | nindent 14 }}
+      ports:
+        - { protocol: TCP, port: 8080 }
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: teamclaw-server-ingress
+  labels: {{- include "teamclaw.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels: {{- include "teamclaw.serverSelector" . | nindent 6 }}
+  policyTypes: [Ingress]
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels: {{- include "teamclaw.frontendSelector" . | nindent 14 }}
+        # Ingress controller namespaces vary; admit via namespace selector.
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: ingress-nginx
+      ports:
+        - { protocol: TCP, port: 8080 }
@@ -0,0 +1,124 @@
+# The server pod runs teamclaw-server with the secret broker as a sidecar
+# sharing a private emptyDir for the unix socket — the §15 topology: no
+# network hop carries credentials, and nothing else can reach the socket.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: teamclaw-server
+  labels: {{- include "teamclaw.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.server.replicas }}
+  selector:
+    matchLabels: {{- include "teamclaw.serverSelector" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "teamclaw.serverSelector" . | nindent 8 }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        seccompProfile: { type: RuntimeDefault }
+      containers:
+        - name: server
+          image: "{{ .Values.image.registry }}/server:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - { containerPort: 8080, name: http }
+          env:
+            - name: TEAMCLAW_CONFIG
+              value: /etc/teamclaw/teamclaw.toml
+            - name: TEAMCLAW_DATABASE__URL
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.database.urlSecretName }}
+                  key: url
+            {{- if eq .Values.llm.provider "anthropic" }}
+            - name: ANTHROPIC_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.llm.apiKeySecretName }}
+                  key: api-key
+            {{- end }}
+            {{- if eq .Values.storage.backend "s3" }}
+            - name: TEAMCLAW_STORAGE__S3_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.storage.s3.credentialsSecretName }}
+                  key: access-key
+            - name: TEAMCLAW_STORAGE__S3_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.storage.s3.credentialsSecretName }}
+                  key: secret-key
+            {{- end }}
+          volumeMounts:
+            - { name: config, mountPath: /etc/teamclaw, readOnly: true }
+            - { name: broker-socket, mountPath: /run/teamclaw }
+            {{- if eq .Values.storage.backend "local" }}
+            - { name: data, mountPath: {{ .Values.storage.dataDir }} }
+            {{- end }}
+          readinessProbe:
+            httpGet: { path: /healthz, port: http }
+            initialDelaySeconds: 3
+          resources: {{- toYaml .Values.server.resources | nindent 12 }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities: { drop: ["ALL"] }
+            readOnlyRootFilesystem: true
+        - name: broker
+          image: "{{ .Values.image.registry }}/broker:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          env:
+            - name: TEAMCLAW_BROKER_SOCKET
+              value: /run/teamclaw/broker.sock
+            - name: TEAMCLAW_BROKER_KEY_FILE
+              value: /etc/teamclaw-broker/broker.key
+            - name: TEAMCLAW_DATABASE__URL
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.database.urlSecretName }}
+                  key: url
+          volumeMounts:
+            - { name: broker-socket, mountPath: /run/teamclaw }
+            - { name: broker-key, mountPath: /etc/teamclaw-broker, readOnly: true }
+          resources: {{- toYaml .Values.broker.resources | nindent 12 }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities: { drop: ["ALL"] }
+            readOnlyRootFilesystem: true
+      volumes:
+        - name: config
+          configMap: { name: teamclaw-config }
+        - name: broker-socket
+          emptyDir: {}
+        - name: broker-key
+          secret: { secretName: {{ .Values.broker.keySecretName }} }
+        {{- if eq .Values.storage.backend "local" }}
+        - name: data
+          persistentVolumeClaim: { claimName: teamclaw-data }
+        {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: teamclaw-server
+  labels: {{- include "teamclaw.labels" . | nindent 4 }}
+spec:
+  selector: {{- include "teamclaw.serverSelector" . | nindent 4 }}
+  ports:
+    - { name: http, port: 8080, targetPort: http }
+{{- if eq .Values.storage.backend "local" }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: teamclaw-data
+  labels: {{- include "teamclaw.labels" . | nindent 4 }}
+spec:
+  accessModes: ["ReadWriteOnce"]
+  resources:
+    requests:
+      storage: {{ .Values.storage.pvcSize }}
+{{- end }}