jakman85andClaude Opus 5.5
b85d1e3ed7
Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>), five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with mutation self-tests. src/ and the bot workflow are integrated separately. Co-Authored-By: Claude Opus 5.5 <[email protected]>
29 lines
1.4 KiB
Plaintext
29 lines
1.4 KiB
Plaintext
# =============================================================================
|
|
# TEMPLATE, NOT APPLIED, NOT ENCRYPTED. The OIDC client and cookie secrets for the per-pod oauth2-proxy
|
|
# sidecar gating the CVE page (deployment.yaml, container oauth2-proxy). The sidecar reads these three
|
|
# keys by name only (R-IDP-04).
|
|
#
|
|
# The `client-secret` value MUST equal `vuln-scanner-client-secret` in
|
|
# platform/keycloak/keycloak-realm-clients.sops.yaml (a cross-namespace mirror, like crafty). See
|
|
# platform/vuln-scanner/README.md, "Operator step". Never decrypt this to a terminal or a log.
|
|
#
|
|
# Regenerate (encrypts to the repo's public recipient via .sops.yaml, values never echoed):
|
|
# ./infra/devcontainer/dev.sh run bash -c '
|
|
# cs=$(openssl rand -hex 32); ck=$(openssl rand -base64 32 | tr -- "+/" "-_")
|
|
# sops -e --input-type yaml --output-type yaml \
|
|
# --filename-override platform/vuln-scanner/vuln-scanner-oauth2-proxy-credentials.sops.yaml \
|
|
# /dev/stdin <<YAML > platform/vuln-scanner/vuln-scanner-oauth2-proxy-credentials.sops.yaml
|
|
# ...this document with client-secret: $cs and cookie-secret: $ck...
|
|
# YAML'
|
|
# =============================================================================
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: vuln-scanner-oauth2-proxy
|
|
namespace: vuln-scanner
|
|
type: Opaque
|
|
stringData:
|
|
client-id: vuln-scanner
|
|
client-secret: REPLACE-ME
|
|
cookie-secret: REPLACE-ME
|