cluster

commit b87894ff8d3d882acca24f0db5d04f9992d77ce2
parent 6fb787332a91fba6818fc696d5eedef56b5a93d7
Author: MTRNord <mtrnord1@gmail.com>
Date:   Sun, 19 Mar 2023 16:21:50 +0100

Add cosign

Diffstat:
A
apps/base/cosign/kustomization.yaml
 | 
7
+++++++
A
apps/base/cosign/namespace.yaml
 | 
4
++++
A
apps/base/cosign/release.yaml
 | 
58
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
A
apps/base/cosign/repository.yaml
 | 
8
++++++++
M
apps/production/kustomization.yaml
 | 
1
+
A
apps/production/secrets/cosign-secret.yaml
 | 
55
+++++++++++++++++++++++++++++++++++++++++++++++++++++++
M
apps/production/secrets/kustomization.yaml
 | 
1
+

7 files changed, 134 insertions(+), 0 deletions(-)
diff --git a/apps/base/cosign/kustomization.yaml b/apps/base/cosign/kustomization.yaml
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: cosign-system
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - release.yaml
diff --git a/apps/base/cosign/namespace.yaml b/apps/base/cosign/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cosign-system
diff --git a/apps/base/cosign/release.yaml b/apps/base/cosign/release.yaml
@@ -0,0 +1,58 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: cosign
+  namespace: cosign-system
+spec:
+  releaseName: cosign-system
+  chart:
+    spec:
+      chart: policy-controller
+      sourceRef:
+        kind: HelmRepository
+        name: k8s-at-home
+  interval: 50m
+  install:
+    remediation:
+      retries: 3
+  # Default values
+  # https://github.com/stefanprodan/podinfo/blob/master/charts/podinfo/values.yaml
+  values:
+    policy-controller:
+      cosign:
+        secretKeyRef:
+          name: cosign-secret
+      serviceMonitor:
+        enabled: true
+      imagePullSecrets:
+        - name: docker
+---
+apiVersion: policy.sigstore.dev/v1beta1
+kind: ClusterImagePolicy
+metadata:
+  name: redis-cluster-policy
+  namespace: cosign-system
+spec:
+  images:
+    - glob: "index.docker.io/library/redis**"
+  authorities:
+    - static:
+        action: pass
+    - key:
+        secretRef:
+          name: cosign-secret
+---
+apiVersion: policy.sigstore.dev/v1beta1
+kind: ClusterImagePolicy
+metadata:
+  name: mariadb-cluster-policy
+  namespace: cosign-system
+spec:
+  images:
+    - glob: "index.docker.io/library/mariadb**"
+  authorities:
+    - static:
+        action: pass
+    - key:
+        secretRef:
+          name: cosign-secret
diff --git a/apps/base/cosign/repository.yaml b/apps/base/cosign/repository.yaml
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+  name: cosign
+  namespace: cosign-system
+spec:
+  interval: 5m
+  url: https://sigstore.github.io/helm-charts
diff --git a/apps/production/kustomization.yaml b/apps/production/kustomization.yaml
@@ -2,5 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base/vaultwarden
+  - ../base/cosign
 patchesStrategicMerge:
   - vaultwarden-values.yaml
diff --git a/apps/production/secrets/cosign-secret.yaml b/apps/production/secrets/cosign-secret.yaml
@@ -0,0 +1,55 @@
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+    name: cosign-secret
+data:
+    cosign.pub: ENC[AES256_GCM,data:y2K4obz1xRcohMwEG/v3juvfl2GKSxWk4kd9W7DKdWl6M/EvFs6QV/OiXVpD6zNwWLam7k0nVKXR/1DUZsctcfwubJar/sjRdNZLqXewlrFqvCoWom0UT419CWdgUg3JXz9BMEUKvGgG+A/J8D2M7qsdeKh/y4x0PZbG57X8FckPrVxOPG2Y1WgBrMifUJwAQuQx1kRArIE4MT/r0pHt7uvAV2x+jdBQB8KdNnvXBkgp/oJl5APzZG3ypM6qHI/6Vtsl40+EGUusRbqWiHTqC56jOP9qjWI5C4WeAkL7rxq/PABrD045jfYqDsFim553,iv:roGzDkFDnIyuLeNl+tMSvmXVzp3geaL/XQlJqUV8df0=,tag:b4xNh7ZpV17ce6X7e4ZVrg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvTU1zaHRtbXlscHk5NjhZ
+            Zkw5NGpNMTgwRkxPNldNL3ZzbWhYR2gyd240CnFGWVZ5cUQya0Q1alJqc2dBWnFJ
+            S3ZlaG5XZXJvSENSYlM0NDMzUnNUQmMKLS0tIFBjcVJ0RHVUNHhVL21uNGFtN0g5
+            dmtGNERzV0c2a1BYTkc4RkNDKzUyRlUKqCvBkDKigQfZBQZ2TDRxfpsmobPJLDCj
+            6am5YIR5e7OetSA8PsiBbWpXltHrHoB5qPTr6CYjYlVZ0t6MrsUUrA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-03-19T15:21:10Z"
+    mac: ENC[AES256_GCM,data:dYwOqkm8qXkfNkH68y0mObWgnKQfaMivfsqodBewbQ7w7PatuSB82P1TVBU//De4Vt0ByTIage5xe1iN8O1lte4sRgebITbzKPfFqInRVJLLncMRhWdDnTrTgvoV82uGbqrqG5ewRx0VDlBXLbIWa2dAkQ9kca8gKEexbTlsmQ0=,iv:0Ln1R32mv+YSOM7ssCT9+UK93L7MKSjkoIx+laeOQ4w=,tag:O+fJ8XeLRYiK1KELzyUFGA==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3
+---
+apiVersion: v1
+kind: Secret
+type: kubernetes.io/dockerconfigjson
+metadata:
+    name: docker
+data:
+    .dockerconfigjson: ENC[AES256_GCM,data:w+SRZX5sZX4ksv2z7Khu58d/jSarLWIObmVB0Z7elvtPb6ZJmBldaRliIcBZSq5b8zf4tQ8eZy8HI62/+aubLue1FgmwNfzD2CPjbNiJfXMVH9I2AmMJxF3Kp0FaZz7MdLvArHDBlOfdlv+eWUa7gjCwak96V536X/bX2WKri4YcCGlDeHUZ52t7Exl+V+z5lnRIYU/nwd6lOqvagOwew52GH+Gk3y9Bgy82Qytgx3xGK5gkolWyFpGdBeWrPzZ368xhGSAV+X+YhWuLwrlD+lilvHaHSO0mK65QhuySkqleLFqIdbICFH6tZs87wmor3YoKXqVtciw=,iv:Me/GWy8ihZAzIfHeZnSiDyBIQBgP26m7ZKCDm3NQaz8=,tag:da0qypLcMVOswXgIb7pZ8Q==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvTU1zaHRtbXlscHk5NjhZ
+            Zkw5NGpNMTgwRkxPNldNL3ZzbWhYR2gyd240CnFGWVZ5cUQya0Q1alJqc2dBWnFJ
+            S3ZlaG5XZXJvSENSYlM0NDMzUnNUQmMKLS0tIFBjcVJ0RHVUNHhVL21uNGFtN0g5
+            dmtGNERzV0c2a1BYTkc4RkNDKzUyRlUKqCvBkDKigQfZBQZ2TDRxfpsmobPJLDCj
+            6am5YIR5e7OetSA8PsiBbWpXltHrHoB5qPTr6CYjYlVZ0t6MrsUUrA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-03-19T15:21:10Z"
+    mac: ENC[AES256_GCM,data:dYwOqkm8qXkfNkH68y0mObWgnKQfaMivfsqodBewbQ7w7PatuSB82P1TVBU//De4Vt0ByTIage5xe1iN8O1lte4sRgebITbzKPfFqInRVJLLncMRhWdDnTrTgvoV82uGbqrqG5ewRx0VDlBXLbIWa2dAkQ9kca8gKEexbTlsmQ0=,iv:0Ln1R32mv+YSOM7ssCT9+UK93L7MKSjkoIx+laeOQ4w=,tag:O+fJ8XeLRYiK1KELzyUFGA==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3
diff --git a/apps/production/secrets/kustomization.yaml b/apps/production/secrets/kustomization.yaml
@@ -2,3 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - vaultwarden-secret.yaml
+  - cosign-secret.yaml