open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-20 16:07:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): validate cluster credential key rotation

Browse Source
This commit is contained in:
whyour
2026-08-26 03:31:13 +08:00
parent b45a5e04b7
commit ac0992081e
23 changed files with 1119 additions and 167 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/kubernetes/ql3-cluster/operations/security-administration/base/job.yaml
+3 -3
View File
@@ -72,7 +72,7 @@ spec:
- --command=/var/run/qinglong3/security-administration-private/input/command.json
- --assertion=/var/run/qinglong3/security-administration-private/input/assertion.jwt
- --keyset=/var/run/qinglong3/security-administration-private/input/keyset.json
- --pepper=/var/run/qinglong3/security-administration-private/input/pepper
- --pepper-keyring=/var/run/qinglong3/security-administration-private/input/pepper-keyring.json
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
@@ -120,8 +120,8 @@ spec:
path: assertion.jwt
- key: keyset.json
path: keyset.json
- key: pepper
path: pepper
- key: pepper-keyring.json
path: pepper-keyring.json
- name: private-input
emptyDir:
medium: Memory
deploy/kubernetes/ql3-cluster/operations/security-administration/input-secret.example.yaml
+2 -1
View File
@@ -11,4 +11,5 @@ stringData:
{"schemaVersion":1,"operation":"audit.list","request":{"limit":25,"filter":{"outcome":"allowed"}}}
assertion.jwt: REPLACE_WITH_SHORT_LIVED_MULTI_FACTOR_ASSERTION
keyset.json: REPLACE_WITH_PINNED_SECURITY_ADMINISTRATION_KEYSET
pepper: REPLACE_WITH_CANONICAL_32_BYTE_BASE64URL_API_CREDENTIAL_PEPPER
pepper-keyring.json: |
{"schemaVersion":1,"activePepperKeyId":"REPLACE_WITH_ACTIVE_KEY_ID","keys":[{"pepperKeyId":"REPLACE_WITH_ACTIVE_KEY_ID","pepper":"REPLACE_WITH_CANONICAL_32_BYTE_BASE64URL_API_CREDENTIAL_PEPPER"}]}