Omar SobhandClaude Fable 5
70ec39f696
- S3BlobStore (object_store, path-style) behind the same BlobStore trait, tested against a REAL MinIO container (round trip, overwrite, NotFound on get and delete, nested keys); [storage] backend=local|s3 config with validation + server-side selection (S3 creds via env overlay) - Helm chart: server pod with the secret broker as a SIDECAR sharing a private emptyDir unix socket (no network hop carries credentials), frontend, optional local PVC vs S3, OIDC/oauth values, unbuffered-SSE ingress annotations, NetworkPolicies (frontend->server only), hardened securityContexts; ci/check-helm.sh lints AND asserts the rendered topology properties - deploy/airgapped/install.sh: offline signature+checksum verification via the bundled teamclaw-bundler BEFORE any docker load; --verify-only mode; ci/test-install.sh rehearses clean/tampered/wrong-key paths with the real binary - CI: helm gate + installer rehearsal wired in 149 Rust tests; helm lint + rendered assertions green; installer verify-path rehearsal green. Co-Authored-By: Claude Fable 5 <[email protected]>
45 lines
1.5 KiB
YAML
45 lines
1.5 KiB
YAML
# The broker has no Service and shares the server pod, so its socket is
|
|
# already unreachable over the network. These policies enforce the rest of
|
|
# the §15 topology: the database secret-holders are the only egress-capable
|
|
# pods, and the frontend can reach only the server.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: teamclaw-frontend-egress
|
|
labels: {{- include "teamclaw.labels" . | nindent 4 }}
|
|
spec:
|
|
podSelector:
|
|
matchLabels: {{- include "teamclaw.frontendSelector" . | nindent 6 }}
|
|
policyTypes: [Egress]
|
|
egress:
|
|
# DNS, then only the server.
|
|
- to: []
|
|
ports:
|
|
- { protocol: UDP, port: 53 }
|
|
- { protocol: TCP, port: 53 }
|
|
- to:
|
|
- podSelector:
|
|
matchLabels: {{- include "teamclaw.serverSelector" . | nindent 14 }}
|
|
ports:
|
|
- { protocol: TCP, port: 8080 }
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: teamclaw-server-ingress
|
|
labels: {{- include "teamclaw.labels" . | nindent 4 }}
|
|
spec:
|
|
podSelector:
|
|
matchLabels: {{- include "teamclaw.serverSelector" . | nindent 6 }}
|
|
policyTypes: [Ingress]
|
|
ingress:
|
|
- from:
|
|
- podSelector:
|
|
matchLabels: {{- include "teamclaw.frontendSelector" . | nindent 14 }}
|
|
# Ingress controller namespaces vary; admit via namespace selector.
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: ingress-nginx
|
|
ports:
|
|
- { protocol: TCP, port: 8080 }
|