jschoubben
35ff67bda0
mesh/delivery-group group feat/774-l3-reland rejected: composed together: the checker's verdict at the members' heads (b48c90fea31f): integration: mesh-self-ch…
mesh/delivery closed: a newer head of the same pull request
mesh/check failed: integration: mesh-self-check/cmd/mesh-self-check.TestTheSelfCheckWholeRunsOnTheBus: the run answered {Run:doctor-1793351737-1 At:20…
One commit with exactly the tree of the reviewed head35b4509c0a, on main12c2574c9d, so two compiled programs added and removed on the branch leave no trace in history (issue 1577).
110 lines
2.5 KiB
JSON
110 lines
2.5 KiB
JSON
{
|
|
"module": "step-ca",
|
|
"version": "1",
|
|
"capabilities": [
|
|
"container-runtime"
|
|
],
|
|
"provides": [
|
|
{
|
|
"name": "internal-acme-ca",
|
|
"scope": "mesh",
|
|
"credential": {
|
|
"form": "none"
|
|
}
|
|
}
|
|
],
|
|
"serves": {
|
|
"internal-acme-ca": {
|
|
"path": "/acme/acme/directory",
|
|
"roots": "/roots.pem"
|
|
}
|
|
},
|
|
"listens": [
|
|
{
|
|
"name": "acme",
|
|
"port": 9000,
|
|
"protocol": "tcp",
|
|
"from": "mesh",
|
|
"why": "the ACME directory and step-ca API; a proxy on any node reaches it here over the mesh to obtain certificates, and its single listen is what the consumer is told the port is"
|
|
}
|
|
],
|
|
"own-secrets": {
|
|
"password": "${dir:mesh-state}/password"
|
|
},
|
|
"data": {
|
|
"own": [
|
|
{
|
|
"id": "home",
|
|
"path": "${dir:home}",
|
|
"class": "valuable",
|
|
"why": "the mesh's certificate authority: its keys and its database of what it issued"
|
|
}
|
|
]
|
|
},
|
|
"resources": [
|
|
{
|
|
"id": "mesh-state",
|
|
"type": "directory",
|
|
"mode": "0700",
|
|
"place": "mesh",
|
|
"unknown": "program"
|
|
},
|
|
{
|
|
"id": "home",
|
|
"type": "directory",
|
|
"mode": "0700",
|
|
"owner": "1000:1000",
|
|
"place": ".",
|
|
"unknown": "program"
|
|
},
|
|
{
|
|
"id": "config",
|
|
"type": "file",
|
|
"path": "${dir:mesh-state}/config.json",
|
|
"mode": "0644",
|
|
"template": "files/config.json",
|
|
"takes-config": [],
|
|
"merge": "json"
|
|
},
|
|
{
|
|
"id": "init-env",
|
|
"type": "file",
|
|
"path": "${dir:mesh-state}/init.env",
|
|
"mode": "0600",
|
|
"template": "files/init.env"
|
|
},
|
|
{
|
|
"id": "server",
|
|
"type": "container",
|
|
"name": "step-ca",
|
|
"image": "smallstep/step-ca@sha256:a2b17872915c193259b75a5474c398326f41bd199f0842093e52cf4182bc8270",
|
|
"health": {
|
|
"kind": "runtime"
|
|
},
|
|
"network": "host",
|
|
"env-file": [
|
|
"${dir:mesh-state}/init.env"
|
|
],
|
|
"env": {
|
|
"DOCKER_STEPCA_INIT_NAME": "Mesh Internal CA",
|
|
"DOCKER_STEPCA_INIT_ACME": "true",
|
|
"DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT": "false"
|
|
},
|
|
"volumes": [
|
|
"${dir:home}:/home/step",
|
|
"${dir:mesh-state}:/run/mesh:ro"
|
|
],
|
|
"secrets-in-environment": "the entrypoint honours DOCKER_STEPCA_INIT_PASSWORD_FILE; convertible, awaiting a bed that proves it"
|
|
}
|
|
],
|
|
"build": {
|
|
"artifacts": [
|
|
{
|
|
"name": "files",
|
|
"kind": "archive",
|
|
"from": "files"
|
|
}
|
|
]
|
|
}
|
|
}
|