29 lines
1.6 KiB
Markdown
29 lines
1.6 KiB
Markdown
# Default deployment permissions
|
|
|
|
This deployment uses the Longhorn backend. It reads inventory across namespaces
|
|
and updates only `soteria-policies` and `soteria-backup-usage` in its own namespace.
|
|
The empty Secret declarations create those records on first deployment; they
|
|
deliberately contain no data field, so application-written state is preserved.
|
|
The optional `soteria-restic` credential is readable by exact name only.
|
|
|
|
Changing the state or credential names also requires updating the Role. Do not
|
|
restore cluster-wide Secret access to accommodate another deployment.
|
|
|
|
The optional restic backend needs additional, explicitly approved Roles and
|
|
RoleBindings in each backup/restore target namespace: Job creation and the
|
|
credential-copy operations in `internal/k8s/jobs.go`. Those grants are not part
|
|
of this Longhorn deployment. Review credential distribution before enabling
|
|
restic; Kubernetes RBAC cannot restrict Secret creation by resource name.
|
|
|
|
## CI image construction
|
|
|
|
Jenkins compiles the UI and ARM64 Go binary in its `ci-scratch` workspace PVC.
|
|
Compiler and package caches also use that PVC. The final Kaniko step receives
|
|
only `build/image/` and `Dockerfile.runtime`, so it packages the binary without
|
|
unpacking Node/Go toolchains or compiling on the node's runtime filesystem.
|
|
The ordinary multistage `Dockerfile` remains available for workstation builds.
|
|
|
|
Keep `CGO_ENABLED=0`, the UI embedding step and the runtime architecture aligned.
|
|
The runtime image stays nonroot and exposes the same port and entrypoint. Image
|
|
publication still requires all existing quality and supply-chain gates.
|