f0d695ec97
QRun-IO/ci-policy: ci / fork-guard (push) Skipped
QRun-IO/ci-policy: ci / head-profile (push) Skipped
QRun-IO/ci-policy: ci / application-template-0 (push) Skipped
QRun-IO/ci-policy: ci / gradle-1 (push) Skipped
QRun-IO/ci-policy: ci / java-docker-3 (push) Skipped
QRun-IO/ci-policy: ci / java-docker-4 (push) Skipped
QRun-IO/ci-policy: ci / java-frontend-browser-5 (push) Skipped
QRun-IO/ci-policy: ci / java-maven-6 (push) Skipped
QRun-IO/ci-policy: ci / java-maven-7 (push) Skipped
QRun-IO/ci-policy: ci / node-8 (push) Skipped
QRun-IO/ci-policy: ci / node-9 (push) Skipped
QRun-IO/ci-policy: ci / node-10 (push) Skipped
QRun-IO/ci-policy: ci / node-playwright-11 (push) Skipped
QRun-IO/ci-policy: ci / repository-policy-12 (push) Skipped
QRun-IO/ci-policy: ci / source-config-13 (push) Skipped
QRun-IO/ci-policy: ci / source-config-14 (push) Skipped
QRun-IO/ci-policy: ci / android-0 (push) Skipped
QRun-IO/ci-policy: ci / original-business (push) Skipped
QRun-IO/ci-policy: ci / original-mcp (push) Skipped
QRun-IO/ci-policy: ci / original-voyage (push) Skipped
QRun-IO/ci-policy: ci / original-cli (push) Skipped
QRun-IO/ci-policy: ci / repository-policy (push) Skipped
QRun-IO/ci-policy: ci / java-core-2-head (push) Skipped
QRun-IO/ci-policy: ci / java-docker-3-head (push) Skipped
QRun-IO/ci-policy: ci / java-maven-6-head (push) Skipped
QRun-IO/ci-policy: ci / java-maven-7-head (push) Skipped
QRun-IO/ci-policy: ci / not-enrolled (push) Failing after 7s
QRun-IO/ci-policy: native / fork-deny (push) Skipped
QRun-IO/ci-policy: native / dotnet-0 (push) Skipped
QRun-IO/ci-policy: ci / ci-result (push) Failing after 6s
QRun-IO/ci-policy: native / native-result (push) Successful in 6s
Save the current implementation and README, status, and known-issue documentation at the user-requested stop. No completed release or deployment is claimed. Co-Authored-By: Claude <noreply@anthropic.com> Co-Authored-By: GPT-6 Codex <noreply@openai.com>
296 lines
11 KiB
JSON
296 lines
11 KiB
JSON
{
|
|
"apiVersion": "v1",
|
|
"kind": "List",
|
|
"items": [
|
|
{
|
|
"apiVersion": "v1",
|
|
"kind": "Namespace",
|
|
"metadata": {
|
|
"name": "qqq-qual-unit",
|
|
"labels": {
|
|
"pod-security.kubernetes.io/enforce": "restricted",
|
|
"pod-security.kubernetes.io/enforce-version": "v1.34",
|
|
"pod-security.kubernetes.io/audit": "restricted",
|
|
"pod-security.kubernetes.io/warn": "restricted"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"apiVersion": "v1",
|
|
"kind": "ConfigMap",
|
|
"metadata": {
|
|
"name": "execution-supervisor",
|
|
"namespace": "qqq-qual-unit"
|
|
},
|
|
"immutable": true,
|
|
"data": {
|
|
"config.json": "{\"bind\":\"0.0.0.0\",\"port\":18443,\"keyStore\":\"/run/qqq-supervisor/tls/server.p12\",\"trustStore\":\"/run/qqq-supervisor/trust/clients.p12\",\"certificateNamespaces\":{\"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\":\"unit-client\"},\"profile\":\"unit-profile\",\"toolchain\":\"unit-toolchain\",\"evidence\":\"unit-evidence\",\"requiredEvidence\":\"unit-evidence\",\"runtimePath\":\"/opt/qqq-supervisor/runtime/qqq_javy_runtime.wasm\",\"runtimeSha256\":\"4b247288d6cdff6783f8087a2a9039935f50af9099451cc841a3639c9625a18c\",\"nativePath\":\"/opt/qqq-supervisor/native/libextism.so\",\"nativeSha256\":\"44eb7ed56c6b5610b97b9aa62a436e6ff7e3175730e487c42bb67105185d7e01\",\"slots\":1,\"connections\":2,\"coldOperations\":1,\"entries\":8,\"codeBytes\":8388608,\"memoryBytes\":67108864,\"idleMillis\":30000,\"fuel\":100000000}"
|
|
}
|
|
},
|
|
{
|
|
"apiVersion": "apps/v1",
|
|
"kind": "Deployment",
|
|
"metadata": {
|
|
"name": "execution-supervisor",
|
|
"namespace": "qqq-qual-unit"
|
|
},
|
|
"spec": {
|
|
"replicas": 1,
|
|
"strategy": {
|
|
"type": "Recreate"
|
|
},
|
|
"selector": {
|
|
"matchLabels": {
|
|
"app.kubernetes.io/name": "execution-supervisor"
|
|
}
|
|
},
|
|
"template": {
|
|
"metadata": {
|
|
"labels": {
|
|
"app.kubernetes.io/name": "execution-supervisor"
|
|
},
|
|
"annotations": {
|
|
"qqq.kingsrook.com/productionQualified": "false",
|
|
"qqq.kingsrook.com/redistributionCleared": "false",
|
|
"qqq.kingsrook.com/expected-pod-pids-limit": "256",
|
|
"qqq.kingsrook.com/pids-policy-evidence": "unit-node-policy",
|
|
"qqq.kingsrook.com/readiness-scope": "cold-listener-only-not-required-bindings"
|
|
}
|
|
},
|
|
"spec": {
|
|
"automountServiceAccountToken": false,
|
|
"enableServiceLinks": false,
|
|
"runtimeClassName": "unit-sandbox",
|
|
"nodeSelector": {
|
|
"qualification-pool": "unit"
|
|
},
|
|
"terminationGracePeriodSeconds": 30,
|
|
"securityContext": {
|
|
"runAsNonRoot": true,
|
|
"runAsUser": 65532,
|
|
"runAsGroup": 65532,
|
|
"fsGroup": 65532,
|
|
"seccompProfile": {
|
|
"type": "RuntimeDefault"
|
|
}
|
|
},
|
|
"containers": [
|
|
{
|
|
"name": "execution-supervisor",
|
|
"image": "registry.invalid/qqq/synthetic-execution@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
|
"imagePullPolicy": "IfNotPresent",
|
|
"ports": [
|
|
{
|
|
"name": "mtls",
|
|
"containerPort": 18443
|
|
}
|
|
],
|
|
"securityContext": {
|
|
"allowPrivilegeEscalation": false,
|
|
"readOnlyRootFilesystem": true,
|
|
"capabilities": {
|
|
"drop": [
|
|
"ALL"
|
|
]
|
|
}
|
|
},
|
|
"resources": {
|
|
"requests": {
|
|
"cpu": "1000m",
|
|
"memory": "1024Mi",
|
|
"ephemeral-storage": "64Mi"
|
|
},
|
|
"limits": {
|
|
"cpu": "1000m",
|
|
"memory": "1024Mi",
|
|
"ephemeral-storage": "128Mi"
|
|
}
|
|
},
|
|
"startupProbe": {
|
|
"tcpSocket": {
|
|
"port": "mtls"
|
|
},
|
|
"timeoutSeconds": 1,
|
|
"periodSeconds": 5,
|
|
"failureThreshold": 24
|
|
},
|
|
"readinessProbe": {
|
|
"tcpSocket": {
|
|
"port": "mtls"
|
|
},
|
|
"timeoutSeconds": 1,
|
|
"periodSeconds": 5,
|
|
"failureThreshold": 1
|
|
},
|
|
"env": [
|
|
{
|
|
"name": "QQQ_SUPERVISOR_KEYSTORE_PASSWORD",
|
|
"valueFrom": {
|
|
"secretKeyRef": {
|
|
"name": "unit-passwords",
|
|
"key": "keyStorePassword"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"name": "QQQ_SUPERVISOR_TRUSTSTORE_PASSWORD",
|
|
"valueFrom": {
|
|
"secretKeyRef": {
|
|
"name": "unit-passwords",
|
|
"key": "trustStorePassword"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"volumeMounts": [
|
|
{
|
|
"name": "config",
|
|
"mountPath": "/run/qqq-supervisor/config",
|
|
"readOnly": true
|
|
},
|
|
{
|
|
"name": "tls",
|
|
"mountPath": "/run/qqq-supervisor/tls",
|
|
"readOnly": true
|
|
},
|
|
{
|
|
"name": "trust",
|
|
"mountPath": "/run/qqq-supervisor/trust",
|
|
"readOnly": true
|
|
},
|
|
{
|
|
"name": "tmp",
|
|
"mountPath": "/tmp"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"volumes": [
|
|
{
|
|
"name": "config",
|
|
"configMap": {
|
|
"name": "execution-supervisor",
|
|
"defaultMode": 292
|
|
}
|
|
},
|
|
{
|
|
"name": "tls",
|
|
"secret": {
|
|
"secretName": "unit-server",
|
|
"defaultMode": 288,
|
|
"items": [
|
|
{
|
|
"key": "server.p12",
|
|
"path": "server.p12"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"name": "trust",
|
|
"secret": {
|
|
"secretName": "unit-clients",
|
|
"defaultMode": 288,
|
|
"items": [
|
|
{
|
|
"key": "clients.p12",
|
|
"path": "clients.p12"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"name": "tmp",
|
|
"emptyDir": {
|
|
"medium": "Memory",
|
|
"sizeLimit": "16Mi"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"apiVersion": "v1",
|
|
"kind": "Service",
|
|
"metadata": {
|
|
"name": "execution-supervisor",
|
|
"namespace": "qqq-qual-unit"
|
|
},
|
|
"spec": {
|
|
"type": "ClusterIP",
|
|
"selector": {
|
|
"app.kubernetes.io/name": "execution-supervisor"
|
|
},
|
|
"ports": [
|
|
{
|
|
"name": "mtls",
|
|
"port": 18443,
|
|
"targetPort": "mtls"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"apiVersion": "networking.k8s.io/v1",
|
|
"kind": "NetworkPolicy",
|
|
"metadata": {
|
|
"name": "default-deny",
|
|
"namespace": "qqq-qual-unit"
|
|
},
|
|
"spec": {
|
|
"podSelector": {},
|
|
"policyTypes": [
|
|
"Ingress",
|
|
"Egress"
|
|
],
|
|
"ingress": [],
|
|
"egress": []
|
|
}
|
|
},
|
|
{
|
|
"apiVersion": "networking.k8s.io/v1",
|
|
"kind": "NetworkPolicy",
|
|
"metadata": {
|
|
"name": "execution-supervisor",
|
|
"namespace": "qqq-qual-unit"
|
|
},
|
|
"spec": {
|
|
"podSelector": {
|
|
"matchLabels": {
|
|
"app.kubernetes.io/name": "execution-supervisor"
|
|
}
|
|
},
|
|
"policyTypes": [
|
|
"Ingress"
|
|
],
|
|
"ingress": [
|
|
{
|
|
"from": [
|
|
{
|
|
"namespaceSelector": {
|
|
"matchLabels": {
|
|
"kubernetes.io/metadata.name": "unit-client"
|
|
}
|
|
},
|
|
"podSelector": {
|
|
"matchLabels": {
|
|
"app": "unit-client"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"ports": [
|
|
{
|
|
"protocol": "TCP",
|
|
"port": 18443
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|