Skip to content

Commit 93b622c

Browse files
butler54butler54
authored
feat: initial drop (#5)
* feat: initial drop Signed-off-by: Chris Butler <chris.butler@redhat.com> * fix: include default vars in values.yaml Signed-off-by: Chris Butler <chris.butler@redhat.com> * fix: missing prettier file Signed-off-by: Chris Butler <chris.butler@redhat.com> * chore: add auotdocs Signed-off-by: Chris Butler <chris.butler@redhat.com> --------- Signed-off-by: Chris Butler <chris.butler@redhat.com>
1 parent 86bd22d commit 93b622c

18 files changed

Lines changed: 358 additions & 4 deletions

‎.github/workflows/conventional-pr.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: "Lint PR title"
2+
3+
on:
4+
pull_request_target:
5+
types:
6+
- opened
7+
- edited
8+
- synchronize
9+
branches:
10+
- 'main'
11+
- 'develop'
12+
jobs:
13+
lint:
14+
if: ${{ github.head_ref != 'develop' }}
15+
runs-on: ubuntu-latest
16+
steps:
17+
- name: Checkout code
18+
uses: actions/checkout@v4
19+
20+
- name: Install dependencies
21+
run: npm install @commitlint/cli @commitlint/config-conventional
22+
23+
- name: Validate PR title
24+
run: |
25+
PR_TITLE=$(jq -r '.pull_request.title' "$GITHUB_EVENT_PATH")
26+
echo "$PR_TITLE" | npx commitlint --config commitlint.config.js

‎.prettierrc‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
{
2+
"singleQuote": true,
3+
"semi": false
4+
}

‎Chart.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
apiVersion: v2
2-
description: A Helm chart to serve as the Validated Patterns Template
2+
description: A Helm chart to provide an opinionated deployment of Trustee in a validated pattern
33
keywords:
44
- pattern
5-
name: vp-template
5+
- trustee
6+
- confidential-computing
7+
- confidential-containers
8+
name: trustee
69
version: 0.0.1

‎README.md‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,23 @@
1-
# vp-template
1+
# trustee
22

33
![Version: 0.0.1](https://img.shields.io/badge/Version-0.0.1-informational?style=flat-square)
44

5-
A Helm chart to serve as the Validated Patterns Template
5+
A Helm chart to provide an opinionated deployment of Trustee in a validated pattern
66

77
This chart is used to serve as the template for Validated Patterns Charts
88

99
### Notable changes
1010

11+
## Values
12+
13+
| Key | Type | Default | Description |
14+
|-----|------|---------|-------------|
15+
| global.secretStore.backend | string | `""` | |
16+
| kbs.publicKey | string | `"secret/data/hub/kbsPublicKey"` | |
17+
| kbs.secretResources | list | `[]` | |
18+
| kbs.securityPolicy | string | `"secret/data/hub/securityPolicyConfig"` | |
19+
| secretStore.kind | string | `""` | |
20+
| secretStore.name | string | `""` | |
21+
1122
----------------------------------------------
1223
Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2)

‎commitlint.config.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
module.exports = { extends: ['@commitlint/config-conventional'] }

‎templates/.keep‎

Whitespace-only changes.

‎templates/dynamic-eso.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{{- if ne .Values.global.secretStore.backend "none" }}
2+
{{- range .Values.kbs.secretResources }}
3+
---
4+
apiVersion: "external-secrets.io/v1beta1"
5+
kind: ExternalSecret
6+
metadata:
7+
annotations:
8+
argocd.argoproj.io/sync-wave: "1"
9+
name: {{ .name }}-eso
10+
namespace: trustee-operator-system
11+
spec:
12+
refreshInterval: 15s
13+
secretStoreRef:
14+
name: {{ $.Values.secretStore.name }}
15+
kind: {{ $.Values.secretStore.kind }}
16+
target:
17+
name: {{ .name }}
18+
template:
19+
type: Opaque
20+
dataFrom:
21+
- extract:
22+
key: {{ .key }}
23+
{{- end }}
24+
{{- end }}
25+

‎templates/kbs-config-map.yaml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: kbs-config
5+
namespace: trustee-operator-system
6+
data:
7+
kbs-config.toml: |
8+
[http_server]
9+
sockets = ["0.0.0.0:8080"]
10+
insecure_http = false
11+
private_key = "/etc/https-key/tls.key"
12+
certificate = "/etc/https-cert/tls.crt"
13+
[admin]
14+
insecure_api = true
15+
auth_public_key = "/etc/auth-secret/publicKey"
16+
17+
[attestation_token]
18+
insecure_key = true
19+
attestation_token_type = "CoCo"
20+
21+
[attestation_service]
22+
type = "coco_as_builtin"
23+
work_dir = "/opt/confidential-containers/attestation-service"
24+
policy_engine = "opa"
25+
26+
[attestation_service.attestation_token_broker]
27+
type = "Ear"
28+
policy_dir = "/opt/confidential-containers/attestation-service/policies"
29+
30+
[attestation_service.attestation_token_config]
31+
duration_min = 5
32+
33+
[attestation_service.rvps_config]
34+
type = "BuiltIn"
35+
36+
[attestation_service.rvps_config.storage]
37+
type = "LocalJson"
38+
file_path = "/opt/confidential-containers/rvps/reference-values/reference-values.json"
39+
40+
[[plugins]]
41+
name = "resource"
42+
type = "LocalFs"
43+
dir_path = "/opt/confidential-containers/kbs/repository"
44+
45+
[policy_engine]
46+
policy_path = "/opt/confidential-containers/opa/policy.rego"

‎templates/kbs-operator-keys.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
{{- if ne .Values.global.secretStore.backend "none" }}
2+
---
3+
apiVersion: "external-secrets.io/v1beta1"
4+
kind: ExternalSecret
5+
metadata:
6+
annotations:
7+
argocd.argoproj.io/sync-wave: "1"
8+
name: kbs-auth-public-key-eso
9+
namespace: trustee-operator-system
10+
spec:
11+
refreshInterval: 15s
12+
secretStoreRef:
13+
name: {{ .Values.secretStore.name }}
14+
kind: {{ .Values.secretStore.kind }}
15+
data:
16+
target:
17+
name: kbs-auth-public-key
18+
template:
19+
type: Opaque
20+
dataFrom:
21+
- extract:
22+
key: {{ .Values.kbs.publicKey }}
23+
{{- end }}

‎templates/kbs-route.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# Single cluster deploy don't use the route yet.
2+
---
3+
apiVersion: route.openshift.io/v1
4+
kind: Route
5+
metadata:
6+
name: kbs
7+
namespace: trustee-operator-system
8+
spec:
9+
port:
10+
targetPort: 8080
11+
to:
12+
kind: Service
13+
name: kbs-service
14+
weight: 100
15+
tls:
16+
termination: passthrough

0 commit comments

Comments
 (0)