34553f3bec
Mirrors the prod deploy-k3s/ setup but runs all services in-cluster on a single node: PostgreSQL (replaces Neon), MinIO S3-compatible storage (replaces B2), Redis, API, worker, and admin. Includes fully automated setup scripts (00-init through 04-verify), server hardening (SSH, fail2ban, ufw), Let's Encrypt TLS via Traefik, network policies, RBAC, and security contexts matching prod. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
47 lines
1008 B
YAML
47 lines
1008 B
YAML
# RBAC — Dedicated service accounts with no K8s API access
|
|
# Each pod gets its own SA with automountServiceAccountToken: false,
|
|
# so a compromised pod cannot query the Kubernetes API.
|
|
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: api
|
|
namespace: honeydue
|
|
labels:
|
|
app.kubernetes.io/name: api
|
|
app.kubernetes.io/part-of: honeydue
|
|
automountServiceAccountToken: false
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: worker
|
|
namespace: honeydue
|
|
labels:
|
|
app.kubernetes.io/name: worker
|
|
app.kubernetes.io/part-of: honeydue
|
|
automountServiceAccountToken: false
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: admin
|
|
namespace: honeydue
|
|
labels:
|
|
app.kubernetes.io/name: admin
|
|
app.kubernetes.io/part-of: honeydue
|
|
automountServiceAccountToken: false
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: redis
|
|
namespace: honeydue
|
|
labels:
|
|
app.kubernetes.io/name: redis
|
|
app.kubernetes.io/part-of: honeydue
|
|
automountServiceAccountToken: false
|