ms2k/nuthatch
SHA256
Watch
0
Code Releases Activity

Implement confidential OIDC authentication boundary

Browse source
This commit is contained in:
ms2k 2026-07-18 18:08:41 +09:00
commit a4e615096c
1 changed files with 1896 additions and 329 deletions
Download patch file Download diff file Expand all files Collapse all files

37
tests/kind/dependencies.yaml.in
View file

@ -207,6 +207,9 @@ spec:
spec:
automountServiceAccountToken: false
enableServiceLinks: false
volumes:
- name: bootstrap
emptyDir: {}
containers:
- name: zitadel
image: @@ZITADEL_IMAGE@@
@ -220,6 +223,21 @@ spec:
- {name: ZITADEL_EXTERNALPORT, value: "8080"}
- {name: ZITADEL_FIRSTINSTANCE_ORG_HUMAN_USERNAME, value: nuthatch-admin}
- {name: ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD, value: Synthetic-Zitadel-1!}
- {name: ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORDCHANGEREQUIRED, value: "false"}
- {name: ZITADEL_FIRSTINSTANCE_PATPATH, value: /bootstrap/admin.pat}
- {name: ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINE_USERNAME, value: nuthatch-provisioner}
- {name: ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINE_NAME, value: Nuthatch Provisioner}
- {name: ZITADEL_FIRSTINSTANCE_ORG_MACHINE_PAT_EXPIRATIONDATE, value: "2036-01-01T00:00:00Z"}
- {name: ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH, value: /bootstrap/login-client.pat}
- {name: ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_MACHINE_USERNAME, value: nuthatch-login-client}
- {name: ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_MACHINE_NAME, value: Nuthatch Login Client}
- {name: ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_PAT_EXPIRATIONDATE, value: "2036-01-01T00:00:00Z"}
- {name: ZITADEL_DEFAULTINSTANCE_OIDCSETTINGS_ACCESSTOKENLIFETIME, value: 5m}
- {name: ZITADEL_DEFAULTINSTANCE_OIDCSETTINGS_IDTOKENLIFETIME, value: 5m}
- {name: ZITADEL_DEFAULTINSTANCE_OIDCSETTINGS_REFRESHTOKENIDLEEXPIRATION, value: 1h}
- {name: ZITADEL_DEFAULTINSTANCE_OIDCSETTINGS_REFRESHTOKENEXPIRATION, value: 2h}
volumeMounts:
- {name: bootstrap, mountPath: /bootstrap}
ports:
- {name: http, containerPort: 8080}
readinessProbe:
@ -233,6 +251,25 @@ spec:
resources:
requests: {cpu: 200m, memory: 512Mi}
limits: {cpu: "2", memory: 1Gi}
- name: oidc-provisioner
image: @@CURL_IMAGE@@
imagePullPolicy: Never
command: [/bin/sh, -ec]
args:
- |
while [ ! -s /bootstrap/admin.pat ] || [ ! -s /bootstrap/login-client.pat ]; do
sleep 1
done
exec sleep 2147483647
securityContext:
allowPrivilegeEscalation: false
capabilities: {drop: ["ALL"]}
runAsUser: 0
volumeMounts:
- {name: bootstrap, mountPath: /bootstrap, readOnly: true}
resources:
requests: {cpu: 10m, memory: 16Mi}
limits: {cpu: 100m, memory: 32Mi}
---
apiVersion: v1
kind: Service