ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/argo-workflows/config/canary-workflowtemplate.yaml

@@ -0,0 +1,54 @@
+# Phase A canary: write an artifact via the executor → VersityGW path.
+# Submit after install (not auto-run by Flux):
+#   kubectl -n argo create -f - <<'EOF'
+#   apiVersion: argoproj.io/v1alpha1
+#   kind: Workflow
+#   metadata:
+#     generateName: artifact-canary-
+#     namespace: argo
+#   spec:
+#     workflowTemplateRef:
+#       name: artifact-canary
+#   EOF
+---
+apiVersion: argoproj.io/v1alpha1
+kind: WorkflowTemplate
+metadata:
+  name: artifact-canary
+  namespace: argo
+  labels:
+    app.kubernetes.io/name: argo-workflow
+    app.kubernetes.io/instance: argo-workflows
+    app.kubernetes.io/component: canary
+spec:
+  entrypoint: main
+  serviceAccountName: argo-workflow
+  podMetadata:
+    labels:
+      app.kubernetes.io/name: argo-workflow
+      app.kubernetes.io/instance: argo-workflows
+      app.kubernetes.io/component: canary
+  templates:
+    - name: main
+      container:
+        image: docker.io/library/busybox:1.37.0@sha256:9532d8c39891ca2ecde4d30d7710e01fb739c87a8b9299685c63704296b16028
+        command: [sh, -c]
+        args:
+          - echo "argo-workflows artifact canary $(date -u +%Y-%m-%dT%H:%M:%SZ)" > /tmp/hello.txt && cat /tmp/hello.txt
+        resources:
+          requests:
+            cpu: 10m
+            memory: 16Mi
+          limits:
+            memory: 32Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          runAsNonRoot: true
+          runAsUser: 1000
+      outputs:
+        artifacts:
+          - name: hello
+            path: /tmp/hello.txt

vendor/platform/argo-workflows/config/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - canary-workflowtemplate.yaml
+  - relay-admission-workflowtemplate.yaml
+  - relay-admission-cronworkflows.yaml
+  - relay-smtp-deny-workflowtemplate.yaml
+  - relay-smtp-deny-cronworkflow.yaml
+  - opnsense-certificate-workflowtemplate.yaml
+  - opnsense-certificate-cronworkflow.yaml

vendor/platform/argo-workflows/config/opnsense-certificate-cronworkflow.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: CronWorkflow
+metadata:
+  name: opnsense-certificate-daily
+  namespace: argo-opnsense-certificate
+  labels:
+    app.kubernetes.io/name: opnsense-certificate-rotator
+    app.kubernetes.io/instance: opnsense-certificate-rotator
+spec:
+  schedules:
+    - "47 17 * * *"
+  timezone: UTC
+  suspend: false
+  concurrencyPolicy: Forbid
+  startingDeadlineSeconds: 1800
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 7
+  workflowSpec:
+    workflowTemplateRef:
+      name: opnsense-certificate-rotator

vendor/platform/argo-workflows/config/opnsense-certificate-workflowtemplate.yaml

@@ -0,0 +1,100 @@
+apiVersion: argoproj.io/v1alpha1
+kind: WorkflowTemplate
+metadata:
+  name: opnsense-certificate-rotator
+  namespace: argo-opnsense-certificate
+  labels:
+    app.kubernetes.io/name: opnsense-certificate-rotator
+    app.kubernetes.io/instance: opnsense-certificate-rotator
+spec:
+  entrypoint: rotate
+  arguments:
+    parameters:
+      - name: bootstrap-mode
+        value: "false"
+  serviceAccountName: opnsense-certificate-rotator
+  nodeSelector:
+    node-role.kubernetes.io/control-plane: "true"
+  activeDeadlineSeconds: 300
+  parallelism: 1
+  synchronization:
+    mutexes:
+      - name: opnsense-certificate-rotator
+  podMetadata:
+    labels:
+      app.kubernetes.io/name: opnsense-certificate-rotator
+      app.kubernetes.io/instance: opnsense-certificate-rotator
+  securityContext:
+    fsGroup: 65532
+    fsGroupChangePolicy: OnRootMismatch
+    runAsNonRoot: true
+    runAsUser: 65532
+    runAsGroup: 65532
+    seccompProfile:
+      type: RuntimeDefault
+  volumes:
+    - name: opnsense-credentials
+      secret:
+        secretName: opnsense-certificate-credentials
+        defaultMode: 0440
+    - name: opnsense-bootstrap-ca
+      secret:
+        secretName: opnsense-certificate-bootstrap-ca
+        defaultMode: 0440
+    - name: vault-ca
+      secret:
+        secretName: opnsense-certificate-vault-ca
+        defaultMode: 0440
+    - name: opnsense-managed-ca
+      secret:
+        secretName: opnsense-certificate-managed-ca
+        defaultMode: 0440
+  ttlStrategy:
+    secondsAfterCompletion: 604800
+    secondsAfterSuccess: 86400
+    secondsAfterFailure: 604800
+  templates:
+    - name: rotate
+      container:
+        image: registry.quorate.internal/quorate/opnsense-certificate-rotator@sha256:f50651bcfc1cba33f4d631205bebfa748f647a400e9bafa69db1411a140b7936
+        imagePullPolicy: IfNotPresent
+        command:
+          - /opnsense-certificate-rotator
+        env:
+          - name: OPNSENSE_URL
+            value: https://10.212.111.120:8443
+          - name: OPNSENSE_IP_SANS
+            value: 10.77.102.91,10.212.111.120,10.31.87.181,10.86.169.153,10.146.95.240
+          - name: BOOTSTRAP_MODE
+            value: "{{workflow.parameters.bootstrap-mode}}"
+          - name: RENEW_BEFORE
+            value: 720h
+          - name: CERTIFICATE_TTL
+            value: 2160h
+          - name: ACTIVATION_TIMEOUT
+            value: 180s
+        volumeMounts:
+          - name: opnsense-credentials
+            mountPath: /opnsense-credentials
+            readOnly: true
+          - name: opnsense-bootstrap-ca
+            mountPath: /opnsense-bootstrap-ca
+            readOnly: true
+          - name: vault-ca
+            mountPath: /vault-ca
+            readOnly: true
+          - name: opnsense-managed-ca
+            mountPath: /opnsense-managed-ca
+            readOnly: true
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+          limits:
+            memory: 128Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+              - ALL

vendor/platform/argo-workflows/config/relay-admission-cronworkflows.yaml

@@ -0,0 +1,99 @@
+apiVersion: argoproj.io/v1alpha1
+kind: CronWorkflow
+metadata:
+  name: relay-admission-daily
+  namespace: argo-relay-admission
+  labels:
+    app.kubernetes.io/name: relay-admission-publisher
+    app.kubernetes.io/instance: relay-admission-publisher
+spec:
+  schedules:
+    - "23 16 * * *"
+  timezone: UTC
+  suspend: false
+  concurrencyPolicy: Forbid
+  startingDeadlineSeconds: 1800
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 7
+  workflowSpec:
+    workflowTemplateRef:
+      name: relay-admission-publisher
+    arguments:
+      parameters:
+        - name: sources
+          value: iplocate-country,iplocate-asn,spamhaus-drop,oci
+---
+apiVersion: argoproj.io/v1alpha1
+kind: CronWorkflow
+metadata:
+  name: relay-admission-maxmind
+  namespace: argo-relay-admission
+  labels:
+    app.kubernetes.io/name: relay-admission-publisher
+    app.kubernetes.io/instance: relay-admission-publisher
+spec:
+  schedules:
+    - "23 17 * * 2,5"
+  timezone: UTC
+  suspend: false
+  concurrencyPolicy: Forbid
+  startingDeadlineSeconds: 1800
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 7
+  workflowSpec:
+    workflowTemplateRef:
+      name: relay-admission-publisher
+    arguments:
+      parameters:
+        - name: sources
+          value: maxmind-country
+---
+apiVersion: argoproj.io/v1alpha1
+kind: CronWorkflow
+metadata:
+  name: relay-admission-azure
+  namespace: argo-relay-admission
+  labels:
+    app.kubernetes.io/name: relay-admission-publisher
+    app.kubernetes.io/instance: relay-admission-publisher
+spec:
+  schedules:
+    - "23 18 * * 0"
+  timezone: UTC
+  suspend: false
+  concurrencyPolicy: Forbid
+  startingDeadlineSeconds: 1800
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 7
+  workflowSpec:
+    workflowTemplateRef:
+      name: relay-admission-publisher
+    arguments:
+      parameters:
+        - name: sources
+          value: azure
+---
+apiVersion: argoproj.io/v1alpha1
+kind: CronWorkflow
+metadata:
+  name: relay-admission-reconcile
+  namespace: argo-relay-admission
+  labels:
+    app.kubernetes.io/name: relay-admission-publisher
+    app.kubernetes.io/instance: relay-admission-publisher
+spec:
+  schedules:
+    - "23 19 * * 6"
+  timezone: UTC
+  suspend: false
+  concurrencyPolicy: Forbid
+  startingDeadlineSeconds: 1800
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 7
+  workflowSpec:
+    workflowTemplateRef:
+      name: relay-admission-publisher
+    arguments:
+      parameters:
+        - name: sources
+          value: tor-exits,aws,gcp,cloudflare,fastly,github,atlassian,digitalocean,linode,vultr

vendor/platform/argo-workflows/config/relay-admission-workflowtemplate.yaml

@@ -0,0 +1,368 @@
+apiVersion: argoproj.io/v1alpha1
+kind: WorkflowTemplate
+metadata:
+  name: relay-admission-publisher
+  namespace: argo-relay-admission
+  labels:
+    app.kubernetes.io/name: relay-admission-publisher
+    app.kubernetes.io/instance: relay-admission-publisher
+spec:
+  entrypoint: refresh
+  serviceAccountName: relay-admission-publisher
+  activeDeadlineSeconds: 3600
+  parallelism: 1
+  synchronization:
+    mutexes:
+      - name: relay-admission-publisher
+  podMetadata:
+    labels:
+      app.kubernetes.io/name: relay-admission-publisher
+      app.kubernetes.io/instance: relay-admission-publisher
+  securityContext:
+    fsGroup: 65532
+    fsGroupChangePolicy: OnRootMismatch
+    runAsNonRoot: true
+    runAsUser: 65532
+    runAsGroup: 65532
+    seccompProfile:
+      type: RuntimeDefault
+  arguments:
+    parameters:
+      - name: sources
+        value: iplocate-country,iplocate-asn,spamhaus-drop,oci
+  volumes:
+    - name: cache
+      persistentVolumeClaim:
+        claimName: relay-admission-cache
+    - name: maxmind
+      secret:
+        secretName: relay-admission-maxmind
+        defaultMode: 0440
+    - name: ip2location
+      secret:
+        secretName: relay-admission-ip2location
+        defaultMode: 0440
+    - name: oci
+      secret:
+        secretName: relay-admission-oci
+        defaultMode: 0440
+  ttlStrategy:
+    secondsAfterCompletion: 604800
+    secondsAfterSuccess: 86400
+    secondsAfterFailure: 604800
+  templates:
+    - name: refresh
+      inputs:
+        parameters:
+          - name: sources
+      dag:
+        tasks:
+          - name: fetch
+            template: fetch
+            arguments:
+              parameters:
+                - name: sources
+                  value: '{{inputs.parameters.sources}}'
+          - name: compile
+            depends: fetch.Succeeded
+            template: compile
+          - name: validate
+            depends: compile.Succeeded
+            template: validate
+          - name: publish
+            depends: validate.Succeeded
+            template: publish
+            arguments:
+              parameters:
+                - name: promote-current
+                  value: "true"
+    - name: bootstrap
+      dag:
+        tasks:
+          - name: fetch-ip2proxy
+            template: fetch-ip2proxy
+          - name: fetch
+            depends: fetch-ip2proxy.Succeeded
+            template: fetch
+            arguments:
+              parameters:
+                - name: sources
+                  value: maxmind-country,iplocate-country,iplocate-asn,spamhaus-drop,tor-exits,aws,gcp,azure,oci,cloudflare,fastly,github,atlassian,digitalocean,linode,vultr
+          - name: compile
+            depends: fetch.Succeeded
+            template: compile
+          - name: validate
+            depends: compile.Succeeded
+            template: validate
+    - name: resume-bootstrap
+      dag:
+        tasks:
+          - name: fetch
+            template: fetch
+            arguments:
+              parameters:
+                - name: sources
+                  value: maxmind-country,iplocate-country,iplocate-asn,spamhaus-drop,tor-exits,aws,gcp,azure,oci,cloudflare,fastly,github,atlassian,digitalocean,linode,vultr
+          - name: compile
+            depends: fetch.Succeeded
+            template: compile
+          - name: validate
+            depends: compile.Succeeded
+            template: validate
+    - name: probe-candidate
+      dag:
+        tasks:
+          - name: validate
+            template: validate
+          - name: publish
+            depends: validate.Succeeded
+            template: publish
+            arguments:
+              parameters:
+                - name: promote-current
+                  value: "false"
+    - name: compile-cached
+      dag:
+        tasks:
+          - name: compile
+            template: compile
+          - name: validate
+            depends: compile.Succeeded
+            template: validate
+    - name: restore-current
+      inputs:
+        parameters:
+          - name: bundle-sha256
+      dag:
+        tasks:
+          - name: download
+            template: download-version
+            arguments:
+              parameters:
+                - name: bundle-sha256
+                  value: '{{inputs.parameters.bundle-sha256}}'
+          - name: validate
+            depends: download.Succeeded
+            template: validate
+            arguments:
+              parameters:
+                - name: bundle-path
+                  value: /work/run/{{workflow.uid}}/restore.json.gz
+          - name: publish
+            depends: validate.Succeeded
+            template: publish
+            arguments:
+              parameters:
+                - name: bundle-path
+                  value: /work/run/{{workflow.uid}}/restore.json.gz
+                - name: promote-current
+                  value: "true"
+    - name: publish-candidate
+      dag:
+        tasks:
+          - name: validate
+            template: validate
+          - name: publish
+            depends: validate.Succeeded
+            template: publish
+            arguments:
+              parameters:
+                - name: promote-current
+                  value: "true"
+    - name: fetch
+      inputs:
+        parameters:
+          - name: sources
+      retryStrategy:
+        limit: "2"
+        retryPolicy: OnFailure
+        backoff:
+          duration: 30s
+          factor: 2
+          maxDuration: 5m
+      container:
+        image: registry.quorate.internal/quorate/oci-l4-relay-publisher@sha256:3cc58cbdf9709777a016c5546b4747b1f0392b14052ee8bb7db15ef88b43ae45
+        imagePullPolicy: IfNotPresent
+        command: [/publisher/fetch-public]
+        args:
+          - -sources
+          - '{{inputs.parameters.sources}}'
+          - -changed-file
+          - /work/run/{{workflow.uid}}/fetch-changed
+          - -summary-file
+          - /work/run/{{workflow.uid}}/fetch-summary.json
+        resources:
+          requests:
+            cpu: 50m
+            memory: 128Mi
+          limits:
+            memory: 768Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          readOnlyRootFilesystem: true
+        volumeMounts:
+          - name: cache
+            mountPath: /work
+          - name: maxmind
+            mountPath: /credentials/maxmind
+            readOnly: true
+    - name: fetch-ip2proxy
+      container:
+        image: registry.quorate.internal/quorate/oci-l4-relay-publisher@sha256:3cc58cbdf9709777a016c5546b4747b1f0392b14052ee8bb7db15ef88b43ae45
+        imagePullPolicy: IfNotPresent
+        command: [/publisher/fetch-ip2proxy]
+        resources:
+          requests:
+            cpu: 50m
+            memory: 128Mi
+          limits:
+            memory: 768Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          readOnlyRootFilesystem: true
+        volumeMounts:
+          - name: cache
+            mountPath: /work
+          - name: ip2location
+            mountPath: /credentials/ip2location
+            readOnly: true
+    - name: compile
+      container:
+        image: registry.quorate.internal/quorate/oci-l4-relay-publisher@sha256:3cc58cbdf9709777a016c5546b4747b1f0392b14052ee8bb7db15ef88b43ae45
+        imagePullPolicy: IfNotPresent
+        command: [/publisher/compile]
+        args:
+          - -bundle-output
+          - /work/output/candidate.json.gz
+          - -vpn-exception-asn
+          - "147049"
+        resources:
+          requests:
+            cpu: 100m
+            memory: 256Mi
+          limits:
+            memory: 1Gi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          readOnlyRootFilesystem: true
+        volumeMounts:
+          - name: cache
+            mountPath: /work
+    - name: validate
+      inputs:
+        parameters:
+          - name: bundle-path
+            default: /work/output/candidate.json.gz
+      container:
+        image: registry.quorate.internal/quorate/oci-l4-relay-publisher@sha256:3cc58cbdf9709777a016c5546b4747b1f0392b14052ee8bb7db15ef88b43ae45
+        imagePullPolicy: IfNotPresent
+        command: [/publisher/validate]
+        args:
+          - validate
+          - -input
+          - '{{inputs.parameters.bundle-path}}'
+          - -minimum-admitted-addresses
+          - "1000000000"
+          - -maximum-admitted-addresses
+          - "3500000000"
+          - -minimum-admitted-intervals
+          - "10000"
+          - -maximum-exception-addresses
+          - "4096"
+          - -maximum-exception-intervals
+          - "512"
+          - -summary-output
+          - /work/run/{{workflow.uid}}/validation-summary.json
+        resources:
+          requests:
+            cpu: 50m
+            memory: 128Mi
+          limits:
+            memory: 512Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          readOnlyRootFilesystem: true
+        volumeMounts:
+          - name: cache
+            mountPath: /work
+    - name: publish
+      inputs:
+        parameters:
+          - name: bundle-path
+            default: /work/output/candidate.json.gz
+          - name: promote-current
+      container:
+        image: registry.quorate.internal/quorate/oci-l4-relay-publisher@sha256:3cc58cbdf9709777a016c5546b4747b1f0392b14052ee8bb7db15ef88b43ae45
+        imagePullPolicy: IfNotPresent
+        command: [/publisher/publish]
+        args:
+          - -bundle
+          - '{{inputs.parameters.bundle-path}}'
+          - -result-file
+          - /work/run/{{workflow.uid}}/publication-result.json
+          - -object-prefix
+          - admission/v1
+          - -additional-object-prefix
+          - web-allow/v1
+          - -promote-current={{inputs.parameters.promote-current}}
+        resources:
+          requests:
+            cpu: 50m
+            memory: 128Mi
+          limits:
+            memory: 512Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          readOnlyRootFilesystem: true
+        volumeMounts:
+          - name: cache
+            mountPath: /work
+          - name: oci
+            mountPath: /credentials/oci
+            readOnly: true
+    - name: download-version
+      inputs:
+        parameters:
+          - name: bundle-sha256
+      container:
+        image: registry.quorate.internal/quorate/oci-l4-relay-publisher@sha256:3cc58cbdf9709777a016c5546b4747b1f0392b14052ee8bb7db15ef88b43ae45
+        imagePullPolicy: IfNotPresent
+        command: [/publisher/publish]
+        args:
+          - -restore-version-sha256
+          - '{{inputs.parameters.bundle-sha256}}'
+          - -restore-output
+          - /work/run/{{workflow.uid}}/restore.json.gz
+        resources:
+          requests:
+            cpu: 50m
+            memory: 128Mi
+          limits:
+            memory: 512Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          readOnlyRootFilesystem: true
+        volumeMounts:
+          - name: cache
+            mountPath: /work
+          - name: oci
+            mountPath: /credentials/oci
+            readOnly: true

vendor/platform/argo-workflows/config/relay-smtp-deny-cronworkflow.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: CronWorkflow
+metadata:
+  name: relay-smtp-deny-refresh
+  namespace: argo-relay-smtp-deny
+  labels:
+    app.kubernetes.io/name: relay-smtp-deny-publisher
+    app.kubernetes.io/instance: relay-smtp-deny-publisher
+spec:
+  schedules:
+    - "23 */6 * * *"
+  timezone: UTC
+  suspend: false
+  concurrencyPolicy: Forbid
+  startingDeadlineSeconds: 1800
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 7
+  workflowSpec:
+    workflowTemplateRef:
+      name: relay-smtp-deny-publisher

vendor/platform/argo-workflows/config/relay-smtp-deny-workflowtemplate.yaml

@@ -0,0 +1,130 @@
+apiVersion: argoproj.io/v1alpha1
+kind: WorkflowTemplate
+metadata:
+  name: relay-smtp-deny-publisher
+  namespace: argo-relay-smtp-deny
+  labels:
+    app.kubernetes.io/name: relay-smtp-deny-publisher
+    app.kubernetes.io/instance: relay-smtp-deny-publisher
+spec:
+  entrypoint: publish-empty
+  serviceAccountName: relay-smtp-deny-publisher
+  activeDeadlineSeconds: 600
+  parallelism: 1
+  synchronization:
+    mutexes:
+      - name: relay-smtp-deny-publisher
+  podMetadata:
+    labels:
+      app.kubernetes.io/name: relay-smtp-deny-publisher
+      app.kubernetes.io/instance: relay-smtp-deny-publisher
+  securityContext:
+    fsGroup: 65532
+    fsGroupChangePolicy: OnRootMismatch
+    runAsNonRoot: true
+    runAsUser: 65532
+    runAsGroup: 65532
+    seccompProfile:
+      type: RuntimeDefault
+  volumes:
+    - name: work
+      emptyDir: {}
+    - name: oci
+      secret:
+        secretName: relay-smtp-deny-oci
+        defaultMode: 0440
+  ttlStrategy:
+    secondsAfterCompletion: 604800
+    secondsAfterSuccess: 86400
+    secondsAfterFailure: 604800
+  templates:
+    - name: publish-empty
+      containerSet:
+        volumeMounts:
+          - name: work
+            mountPath: /work
+          - name: oci
+            mountPath: /credentials/oci
+            readOnly: true
+        containers:
+          - name: create
+            image: registry.quorate.internal/quorate/oci-l4-relay-publisher@sha256:3cc58cbdf9709777a016c5546b4747b1f0392b14052ee8bb7db15ef88b43ae45
+            imagePullPolicy: IfNotPresent
+            command: [/publisher/smtp-deny]
+            args:
+              - empty
+              - -output
+              - /work/current.json.gz
+              - -lifetime
+              - 24h
+            resources:
+              requests:
+                cpu: 10m
+                memory: 32Mi
+              limits:
+                memory: 64Mi
+            securityContext:
+              allowPrivilegeEscalation: false
+              capabilities:
+                drop:
+                  - ALL
+              readOnlyRootFilesystem: true
+          - name: validate
+            dependencies: [create]
+            image: registry.quorate.internal/quorate/oci-l4-relay-publisher@sha256:3cc58cbdf9709777a016c5546b4747b1f0392b14052ee8bb7db15ef88b43ae45
+            imagePullPolicy: IfNotPresent
+            command: [/publisher/smtp-deny]
+            args:
+              - validate
+              - -input
+              - /work/current.json.gz
+              - -minimum-observations
+              - "20"
+              - -maximum-addresses
+              - "4096"
+              - -maximum-intervals
+              - "1024"
+              - -maximum-lifetime
+              - 24h
+              - -maximum-observation-window
+              - 10m
+              - -summary-output
+              - /work/validation-summary.json
+            resources:
+              requests:
+                cpu: 10m
+                memory: 32Mi
+              limits:
+                memory: 64Mi
+            securityContext:
+              allowPrivilegeEscalation: false
+              capabilities:
+                drop:
+                  - ALL
+              readOnlyRootFilesystem: true
+          - name: publish
+            dependencies: [validate]
+            image: registry.quorate.internal/quorate/oci-l4-relay-publisher@sha256:3cc58cbdf9709777a016c5546b4747b1f0392b14052ee8bb7db15ef88b43ae45
+            imagePullPolicy: IfNotPresent
+            command: [/publisher/publish]
+            args:
+              - -bundle
+              - /work/current.json.gz
+              - -object-prefix
+              - smtp-deny/v1
+              - -smtp-deny-summary
+              - /work/validation-summary.json
+              - -result-file
+              - /work/publication-result.json
+            resources:
+              requests:
+                cpu: 10m
+                memory: 32Mi
+              limits:
+                memory: 64Mi
+            securityContext:
+              allowPrivilegeEscalation: false
+              capabilities:
+                drop:
+                  - ALL
+              readOnlyRootFilesystem: true