mirror of
https://github.com/whyour/qinglong.git
synced 2026-09-22 19:29:13 +08:00
82 lines
2.7 KiB
YAML
82 lines
2.7 KiB
YAML
# Example only. Copy into a private overlay and replace every placeholder.
|
|
# Assertions must use this exact dedicated trust domain:
|
|
# aud=qinglong3-model-provider-credential-management,
|
|
# typ=ql3-model-provider-credential-management+jwt, and
|
|
# ql3_purpose=model-provider-credential-management.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: ql3-provider-credential-test-allowlist
|
|
namespace: qinglong3-system
|
|
data:
|
|
allowlist.json: |
|
|
{"schema":"qinglong/model-provider-credential-test-allowlist@v1","revision":"catalog-v1","providers":[{"provider":"openai-compatible","adapter":"openai-compatible","baseUrl":"https://provider.example.test/v1/","revision":"endpoint-v1","deadlineMs":5000,"maxResponseBytes":65536,"maxModels":64,"maxCostMicrousd":0,"retryLimit":0,"configDigest":"10ba6d6a33126ce623d63123b20994d177ed1da7720b4ebe335ca0e5dfc33db6"}],"catalogDigest":"86553a3cbcd8ea3e3d0b73fc310997c1060f6e39d5fe1deb8593b1b8fd098582"}
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: ql3-provider-credential-management-identity
|
|
namespace: qinglong3-system
|
|
type: Opaque
|
|
stringData:
|
|
keyset.json: |
|
|
{
|
|
"schemaVersion": 1,
|
|
"generation": 1,
|
|
"issuer": "https://identity.example.test/",
|
|
"audience": "qinglong3-model-provider-credential-management",
|
|
"keys": [
|
|
{
|
|
"alg": "EdDSA",
|
|
"crv": "Ed25519",
|
|
"kid": "REPLACE_WITH_KEY_ID",
|
|
"kty": "OKP",
|
|
"use": "sig",
|
|
"x": "REPLACE_WITH_ED25519_PUBLIC_JWK_X"
|
|
}
|
|
],
|
|
"revokedKids": [],
|
|
"assuranceMappings": [
|
|
{
|
|
"acr": "urn:example:mfa",
|
|
"assurance": "multi_factor",
|
|
"requiredAmr": ["pwd", "otp"]
|
|
},
|
|
{
|
|
"acr": "urn:example:hardware",
|
|
"assurance": "hardware",
|
|
"requiredAmr": ["hwk"]
|
|
}
|
|
],
|
|
"constraints": {
|
|
"maxAssertionBytes": 8192,
|
|
"maxLifetimeMs": 300000,
|
|
"maxAuthenticationAgeMs": 300000,
|
|
"clockSkewMs": 5000
|
|
}
|
|
}
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: ql3-provider-credential-management-tls
|
|
namespace: qinglong3-system
|
|
type: kubernetes.io/tls
|
|
stringData:
|
|
tls.crt: REPLACE_WITH_SERVER_CERTIFICATE_CHAIN
|
|
tls.key: REPLACE_WITH_SERVER_PRIVATE_KEY
|
|
ca.crt: REPLACE_WITH_1_TO_16_CLIENT_CERTIFICATE_AUTHORITIES
|
|
client.crl: REPLACE_WITH_1_TO_16_CLIENT_CERTIFICATE_REVOCATION_LISTS
|
|
---
|
|
# Non-CloudNativePG deployments only.
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: ql3-cluster-provider-credential-management-database
|
|
namespace: qinglong3-system
|
|
type: Opaque
|
|
stringData:
|
|
postgres-ai-credential-manager-url: REPLACE_WITH_AI_CREDENTIAL_MANAGER_DSN
|
|
postgres-tls-servername: REPLACE_WITH_POSTGRES_DNS_NAME
|
|
postgres-ca.crt: REPLACE_WITH_POSTGRES_CA_CERTIFICATE
|