Dustin C. Hatch
534c4bfca0
`keyserv` is a little utility I wrote to dispense *age* keys to clients. It uses SSH certificates for authentication. If the client presents an SSH certificate signed by a trusted key, the server will return all the keys the principal(s) listed in the certificate are allowed to use. The response is encrypted with the public key from the certificate, so the client must have access to the corresponding private key in order to read the response. I am currently using this server to provide keys for the new configuration policy. The keys herein are used to encrypt NUT monitor passwords.
92 lines
2.2 KiB
YAML
92 lines
2.2 KiB
YAML
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: keyserv
|
|
namespace: keyserv
|
|
labels:
|
|
app.kubernetes.io/name: keyserv
|
|
app.kubernetes.io/component: keyserv
|
|
app.kubernetes.io/instance: keyserv
|
|
app.kubernetes.io/part-of: keyserv
|
|
spec:
|
|
ports:
|
|
- port: 8087
|
|
name: keyserv
|
|
selector:
|
|
app.kubernetes.io/name: keyserv
|
|
app.kubernetes.io/component: keyserv
|
|
app.kubernetes.io/instance: keyserv
|
|
type: ClusterIP
|
|
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: keyserv
|
|
labels:
|
|
app.kubernetes.io/name: keyserv
|
|
app.kubernetes.io/component: keyserv
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: keyserv
|
|
app.kubernetes.io/component: keyserv
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: keyserv
|
|
app.kubernetes.io/component: keyserv
|
|
spec:
|
|
enableServiceLinks: false
|
|
imagePullSecrets:
|
|
- name: imagepull-gitea
|
|
containers:
|
|
- name: keyserv
|
|
image: git.pyrocufflink.net/packages/keyserv
|
|
args:
|
|
- --master-key
|
|
- /run/secrets/keyserv/master.key
|
|
- --key-map
|
|
- /run/keyserv/key-map.yml
|
|
workingDir: /run/keyserv
|
|
env:
|
|
- name: RUST_LOG
|
|
value: debug
|
|
readinessProbe: &probe
|
|
httpGet:
|
|
path: /
|
|
port: 8087
|
|
periodSeconds: 60
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
successThreshold: 1
|
|
startupProbe:
|
|
<<: *probe
|
|
periodSeconds: 1
|
|
timeoutSeconds: 1
|
|
failureThreshold: 30
|
|
securityContext:
|
|
readOnlyRootFilesystem: true
|
|
volumeMounts:
|
|
- mountPath: /run/keyserv
|
|
name: keyserv-config
|
|
readOnly: true
|
|
- mountPath: /run/keyserv/age-keys
|
|
name: age-keys
|
|
readOnly: true
|
|
- mountPath: /run/secrets/keyserv
|
|
name: master-key
|
|
readOnly: true
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
volumes:
|
|
- name: age-keys
|
|
secret:
|
|
secretName: age-keys
|
|
- name: master-key
|
|
secret:
|
|
secretName: master-key
|
|
- name: keyserv-config
|
|
configMap:
|
|
name: keyserv-config
|