bakery-admin/bakery-ia
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Improve teh securty of teh DB

Browse Source
This commit is contained in:
Urtzi Alfaro
2025-10-19 19:22:37 +02:00
parent 62971c07d7
commit 05da20357d
87 changed files with 7998 additions and 932 deletions
Download Patch File Download Diff File Expand all files Collapse all files

62
infrastructure/kubernetes/base/components/databases/alert-processor-db.yaml
View File

@@ -19,9 +19,31 @@ spec:
app.kubernetes.io/name: alert-processor-db
app.kubernetes.io/component: database
spec:
securityContext:
fsGroup: 70
initContainers:
- name: fix-tls-permissions
image: busybox:latest
securityContext:
runAsUser: 0
command: ['sh', '-c']
args:
- |
cp /tls-source/* /tls/
chmod 600 /tls/server-key.pem
chmod 644 /tls/server-cert.pem /tls/ca-cert.pem
chown 70:70 /tls/*
ls -la /tls/
volumeMounts:
- name: tls-certs-source
mountPath: /tls-source
readOnly: true
- name: tls-certs-writable
mountPath: /tls
containers:
- name: postgres
image: postgres:17-alpine
command: ["docker-entrypoint.sh", "-c", "config_file=/etc/postgresql/postgresql.conf"]
ports:
- containerPort: 5432
name: postgres
@@ -48,11 +70,24 @@ spec:
key: POSTGRES_INITDB_ARGS
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
- name: POSTGRES_HOST_SSL
value: "on"
- name: PGSSLCERT
value: /tls/server-cert.pem
- name: PGSSLKEY
value: /tls/server-key.pem
- name: PGSSLROOTCERT
value: /tls/ca-cert.pem
volumeMounts:
- name: postgres-data
mountPath: /var/lib/postgresql/data
- name: init-scripts
mountPath: /docker-entrypoint-initdb.d
- name: tls-certs-writable
mountPath: /tls
- name: postgres-config
mountPath: /etc/postgresql
readOnly: true
resources:
requests:
memory: "256Mi"
@@ -82,10 +117,19 @@ spec:
failureThreshold: 3
volumes:
- name: postgres-data
emptyDir: {}
persistentVolumeClaim:
claimName: alert-processor-db-pvc
- name: init-scripts
configMap:
name: postgres-init-config
- name: tls-certs-source
secret:
secretName: postgres-tls
- name: tls-certs-writable
emptyDir: {}
- name: postgres-config
configMap:
name: postgres-logging-config
---
apiVersion: v1
@@ -107,3 +151,19 @@ spec:
app.kubernetes.io/name: alert-processor-db
app.kubernetes.io/component: database
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: alert-processor-db-pvc
namespace: bakery-ia
labels:
app.kubernetes.io/name: alert-processor-db
app.kubernetes.io/component: database
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 2Gi

63
infrastructure/kubernetes/base/components/databases/auth-db.yaml
View File

@@ -19,9 +19,31 @@ spec:
app.kubernetes.io/name: auth-db
app.kubernetes.io/component: database
spec:
securityContext:
fsGroup: 70
initContainers:
- name: fix-tls-permissions
image: busybox:latest
securityContext:
runAsUser: 0
command: ['sh', '-c']
args:
- |
cp /tls-source/* /tls/
chmod 600 /tls/server-key.pem
chmod 644 /tls/server-cert.pem /tls/ca-cert.pem
chown 70:70 /tls/*
ls -la /tls/
volumeMounts:
- name: tls-certs-source
mountPath: /tls-source
readOnly: true
- name: tls-certs-writable
mountPath: /tls
containers:
- name: postgres
image: postgres:17-alpine
command: ["docker-entrypoint.sh", "-c", "config_file=/etc/postgresql/postgresql.conf"]
ports:
- containerPort: 5432
name: postgres
@@ -48,11 +70,24 @@ spec:
key: POSTGRES_INITDB_ARGS
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
- name: POSTGRES_HOST_SSL
value: "on"
- name: PGSSLCERT
value: /tls/server-cert.pem
- name: PGSSLKEY
value: /tls/server-key.pem
- name: PGSSLROOTCERT
value: /tls/ca-cert.pem
volumeMounts:
- name: postgres-data
mountPath: /var/lib/postgresql/data
- name: init-scripts
mountPath: /docker-entrypoint-initdb.d
- name: tls-certs-writable
mountPath: /tls
- name: postgres-config
mountPath: /etc/postgresql
readOnly: true
resources:
requests:
memory: "256Mi"
@@ -82,10 +117,19 @@ spec:
failureThreshold: 3
volumes:
- name: postgres-data
emptyDir: {}
persistentVolumeClaim:
claimName: auth-db-pvc
- name: init-scripts
configMap:
name: postgres-init-config
- name: tls-certs-source
secret:
secretName: postgres-tls
- name: tls-certs-writable
emptyDir: {}
- name: postgres-config
configMap:
name: postgres-logging-config
---
apiVersion: v1
@@ -106,3 +150,20 @@ spec:
selector:
app.kubernetes.io/name: auth-db
app.kubernetes.io/component: database
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: auth-db-pvc
namespace: bakery-ia
labels:
app.kubernetes.io/name: auth-db
app.kubernetes.io/component: database
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 2Gi

62
infrastructure/kubernetes/base/components/databases/external-db.yaml
View File

@@ -19,9 +19,31 @@ spec:
app.kubernetes.io/name: external-db
app.kubernetes.io/component: database
spec:
securityContext:
fsGroup: 70
initContainers:
- name: fix-tls-permissions
image: busybox:latest
securityContext:
runAsUser: 0
command: ['sh', '-c']
args:
- |
cp /tls-source/* /tls/
chmod 600 /tls/server-key.pem
chmod 644 /tls/server-cert.pem /tls/ca-cert.pem
chown 70:70 /tls/*
ls -la /tls/
volumeMounts:
- name: tls-certs-source
mountPath: /tls-source
readOnly: true
- name: tls-certs-writable
mountPath: /tls
containers:
- name: postgres
image: postgres:17-alpine
command: ["docker-entrypoint.sh", "-c", "config_file=/etc/postgresql/postgresql.conf"]
ports:
- containerPort: 5432
name: postgres
@@ -48,11 +70,24 @@ spec:
key: POSTGRES_INITDB_ARGS
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
- name: POSTGRES_HOST_SSL
value: "on"
- name: PGSSLCERT
value: /tls/server-cert.pem
- name: PGSSLKEY
value: /tls/server-key.pem
- name: PGSSLROOTCERT
value: /tls/ca-cert.pem
volumeMounts:
- name: postgres-data
mountPath: /var/lib/postgresql/data
- name: init-scripts
mountPath: /docker-entrypoint-initdb.d
- name: tls-certs-writable
mountPath: /tls
- name: postgres-config
mountPath: /etc/postgresql
readOnly: true
resources:
requests:
memory: "256Mi"
@@ -82,10 +117,19 @@ spec:
failureThreshold: 3
volumes:
- name: postgres-data
emptyDir: {}
persistentVolumeClaim:
claimName: external-db-pvc
- name: init-scripts
configMap:
name: postgres-init-config
- name: tls-certs-source
secret:
secretName: postgres-tls
- name: tls-certs-writable
emptyDir: {}
- name: postgres-config
configMap:
name: postgres-logging-config
---
apiVersion: v1
@@ -107,3 +151,19 @@ spec:
app.kubernetes.io/name: external-db
app.kubernetes.io/component: database
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: external-db-pvc
namespace: bakery-ia
labels:
app.kubernetes.io/name: external-db
app.kubernetes.io/component: database
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 2Gi

62
infrastructure/kubernetes/base/components/databases/forecasting-db.yaml
View File

@@ -19,9 +19,31 @@ spec:
app.kubernetes.io/name: forecasting-db
app.kubernetes.io/component: database
spec:
securityContext:
fsGroup: 70
initContainers:
- name: fix-tls-permissions
image: busybox:latest
securityContext:
runAsUser: 0
command: ['sh', '-c']
args:
- |
cp /tls-source/* /tls/
chmod 600 /tls/server-key.pem
chmod 644 /tls/server-cert.pem /tls/ca-cert.pem
chown 70:70 /tls/*
ls -la /tls/
volumeMounts:
- name: tls-certs-source
mountPath: /tls-source
readOnly: true
- name: tls-certs-writable
mountPath: /tls
containers:
- name: postgres
image: postgres:17-alpine
command: ["docker-entrypoint.sh", "-c", "config_file=/etc/postgresql/postgresql.conf"]
ports:
- containerPort: 5432
name: postgres
@@ -48,11 +70,24 @@ spec:
key: POSTGRES_INITDB_ARGS
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
- name: POSTGRES_HOST_SSL
value: "on"
- name: PGSSLCERT
value: /tls/server-cert.pem
- name: PGSSLKEY
value: /tls/server-key.pem
- name: PGSSLROOTCERT
value: /tls/ca-cert.pem
volumeMounts:
- name: postgres-data
mountPath: /var/lib/postgresql/data
- name: init-scripts
mountPath: /docker-entrypoint-initdb.d
- name: tls-certs-writable
mountPath: /tls
- name: postgres-config
mountPath: /etc/postgresql
readOnly: true
resources:
requests:
memory: "256Mi"
@@ -82,10 +117,19 @@ spec:
failureThreshold: 3
volumes:
- name: postgres-data
emptyDir: {}
persistentVolumeClaim:
claimName: forecasting-db-pvc
- name: init-scripts
configMap:
name: postgres-init-config
- name: tls-certs-source
secret:
secretName: postgres-tls
- name: tls-certs-writable
emptyDir: {}
- name: postgres-config
configMap:
name: postgres-logging-config
---
apiVersion: v1
@@ -107,3 +151,19 @@ spec:
app.kubernetes.io/name: forecasting-db
app.kubernetes.io/component: database
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: forecasting-db-pvc
namespace: bakery-ia
labels:
app.kubernetes.io/name: forecasting-db
app.kubernetes.io/component: database
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 2Gi

62
infrastructure/kubernetes/base/components/databases/inventory-db.yaml
View File

@@ -19,9 +19,31 @@ spec:
app.kubernetes.io/name: inventory-db
app.kubernetes.io/component: database
spec:
securityContext:
fsGroup: 70
initContainers:
- name: fix-tls-permissions
image: busybox:latest
securityContext:
runAsUser: 0
command: ['sh', '-c']
args:
- |
cp /tls-source/* /tls/
chmod 600 /tls/server-key.pem
chmod 644 /tls/server-cert.pem /tls/ca-cert.pem
chown 70:70 /tls/*
ls -la /tls/
volumeMounts:
- name: tls-certs-source
mountPath: /tls-source
readOnly: true
- name: tls-certs-writable
mountPath: /tls
containers:
- name: postgres
image: postgres:17-alpine
command: ["docker-entrypoint.sh", "-c", "config_file=/etc/postgresql/postgresql.conf"]
ports:
- containerPort: 5432
name: postgres
@@ -48,11 +70,24 @@ spec:
key: POSTGRES_INITDB_ARGS
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
- name: POSTGRES_HOST_SSL
value: "on"
- name: PGSSLCERT
value: /tls/server-cert.pem
- name: PGSSLKEY
value: /tls/server-key.pem
- name: PGSSLROOTCERT
value: /tls/ca-cert.pem
volumeMounts:
- name: postgres-data
mountPath: /var/lib/postgresql/data
- name: init-scripts
mountPath: /docker-entrypoint-initdb.d
- name: tls-certs-writable
mountPath: /tls
- name: postgres-config
mountPath: /etc/postgresql
readOnly: true
resources:
requests:
memory: "256Mi"
@@ -82,10 +117,19 @@ spec:
failureThreshold: 3
volumes:
- name: postgres-data
emptyDir: {}
persistentVolumeClaim:
claimName: inventory-db-pvc
- name: init-scripts
configMap:
name: postgres-init-config
- name: tls-certs-source
secret:
secretName: postgres-tls
- name: tls-certs-writable
emptyDir: {}
- name: postgres-config
configMap:
name: postgres-logging-config
---
apiVersion: v1
@@ -107,3 +151,19 @@ spec:
app.kubernetes.io/name: inventory-db
app.kubernetes.io/component: database
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: inventory-db-pvc
namespace: bakery-ia
labels:
app.kubernetes.io/name: inventory-db
app.kubernetes.io/component: database
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 2Gi

62
infrastructure/kubernetes/base/components/databases/notification-db.yaml
View File

@@ -19,9 +19,31 @@ spec:
app.kubernetes.io/name: notification-db
app.kubernetes.io/component: database
spec:
securityContext:
fsGroup: 70
initContainers:
- name: fix-tls-permissions
image: busybox:latest
securityContext:
runAsUser: 0
command: ['sh', '-c']
args:
- |
cp /tls-source/* /tls/
chmod 600 /tls/server-key.pem
chmod 644 /tls/server-cert.pem /tls/ca-cert.pem
chown 70:70 /tls/*
ls -la /tls/
volumeMounts:
- name: tls-certs-source
mountPath: /tls-source
readOnly: true
- name: tls-certs-writable
mountPath: /tls
containers:
- name: postgres
image: postgres:17-alpine
command: ["docker-entrypoint.sh", "-c", "config_file=/etc/postgresql/postgresql.conf"]
ports:
- containerPort: 5432
name: postgres
@@ -48,11 +70,24 @@ spec:
key: POSTGRES_INITDB_ARGS
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
- name: POSTGRES_HOST_SSL
value: "on"
- name: PGSSLCERT
value: /tls/server-cert.pem
- name: PGSSLKEY
value: /tls/server-key.pem
- name: PGSSLROOTCERT
value: /tls/ca-cert.pem
volumeMounts:
- name: postgres-data
mountPath: /var/lib/postgresql/data
- name: init-scripts
mountPath: /docker-entrypoint-initdb.d
- name: tls-certs-writable
mountPath: /tls
- name: postgres-config
mountPath: /etc/postgresql
readOnly: true
resources:
requests:
memory: "256Mi"
@@ -82,10 +117,19 @@ spec:
failureThreshold: 3
volumes:
- name: postgres-data
emptyDir: {}
persistentVolumeClaim:
claimName: notification-db-pvc
- name: init-scripts
configMap:
name: postgres-init-config
- name: tls-certs-source
secret:
secretName: postgres-tls
- name: tls-certs-writable
emptyDir: {}
- name: postgres-config
configMap:
name: postgres-logging-config
---
apiVersion: v1
@@ -107,3 +151,19 @@ spec:
app.kubernetes.io/name: notification-db
app.kubernetes.io/component: database
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: notification-db-pvc
namespace: bakery-ia
labels:
app.kubernetes.io/name: notification-db
app.kubernetes.io/component: database
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 2Gi

62
infrastructure/kubernetes/base/components/databases/orders-db.yaml
View File

@@ -19,9 +19,31 @@ spec:
app.kubernetes.io/name: orders-db
app.kubernetes.io/component: database
spec:
securityContext:
fsGroup: 70
initContainers:
- name: fix-tls-permissions
image: busybox:latest
securityContext:
runAsUser: 0
command: ['sh', '-c']
args:
- |
cp /tls-source/* /tls/
chmod 600 /tls/server-key.pem
chmod 644 /tls/server-cert.pem /tls/ca-cert.pem
chown 70:70 /tls/*
ls -la /tls/
volumeMounts:
- name: tls-certs-source
mountPath: /tls-source
readOnly: true
- name: tls-certs-writable
mountPath: /tls
containers:
- name: postgres
image: postgres:17-alpine
command: ["docker-entrypoint.sh", "-c", "config_file=/etc/postgresql/postgresql.conf"]
ports:
- containerPort: 5432
name: postgres
@@ -48,11 +70,24 @@ spec:
key: POSTGRES_INITDB_ARGS
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
- name: POSTGRES_HOST_SSL
value: "on"
- name: PGSSLCERT
value: /tls/server-cert.pem
- name: PGSSLKEY
value: /tls/server-key.pem
- name: PGSSLROOTCERT
value: /tls/ca-cert.pem
volumeMounts:
- name: postgres-data
mountPath: /var/lib/postgresql/data
- name: init-scripts
mountPath: /docker-entrypoint-initdb.d
- name: tls-certs-writable
mountPath: /tls
- name: postgres-config
mountPath: /etc/postgresql
readOnly: true
resources:
requests:
memory: "256Mi"
@@ -82,10 +117,19 @@ spec:
failureThreshold: 3
volumes:
- name: postgres-data
emptyDir: {}
persistentVolumeClaim:
claimName: orders-db-pvc
- name: init-scripts
configMap:
name: postgres-init-config
- name: tls-certs-source
secret:
secretName: postgres-tls
- name: tls-certs-writable
emptyDir: {}
- name: postgres-config
configMap:
name: postgres-logging-config
---
apiVersion: v1
@@ -107,3 +151,19 @@ spec:
app.kubernetes.io/name: orders-db
app.kubernetes.io/component: database
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: orders-db-pvc
namespace: bakery-ia
labels:
app.kubernetes.io/name: orders-db
app.kubernetes.io/component: database
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 2Gi

62
infrastructure/kubernetes/base/components/databases/pos-db.yaml
View File

@@ -19,9 +19,31 @@ spec:
app.kubernetes.io/name: pos-db
app.kubernetes.io/component: database
spec:
securityContext:
fsGroup: 70
initContainers:
- name: fix-tls-permissions
image: busybox:latest
securityContext:
runAsUser: 0
command: ['sh', '-c']
args:
- |
cp /tls-source/* /tls/
chmod 600 /tls/server-key.pem
chmod 644 /tls/server-cert.pem /tls/ca-cert.pem
chown 70:70 /tls/*
ls -la /tls/
volumeMounts:
- name: tls-certs-source
mountPath: /tls-source
readOnly: true
- name: tls-certs-writable
mountPath: /tls
containers:
- name: postgres
image: postgres:17-alpine
command: ["docker-entrypoint.sh", "-c", "config_file=/etc/postgresql/postgresql.conf"]
ports:
- containerPort: 5432
name: postgres
@@ -48,11 +70,24 @@ spec:
key: POSTGRES_INITDB_ARGS
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
- name: POSTGRES_HOST_SSL
value: "on"
- name: PGSSLCERT
value: /tls/server-cert.pem
- name: PGSSLKEY
value: /tls/server-key.pem
- name: PGSSLROOTCERT
value: /tls/ca-cert.pem
volumeMounts:
- name: postgres-data
mountPath: /var/lib/postgresql/data
- name: init-scripts
mountPath: /docker-entrypoint-initdb.d
- name: tls-certs-writable
mountPath: /tls
- name: postgres-config
mountPath: /etc/postgresql
readOnly: true
resources:
requests:
memory: "256Mi"
@@ -82,10 +117,19 @@ spec:
failureThreshold: 3
volumes:
- name: postgres-data
emptyDir: {}
persistentVolumeClaim:
claimName: pos-db-pvc
- name: init-scripts
configMap:
name: postgres-init-config
- name: tls-certs-source
secret:
secretName: postgres-tls
- name: tls-certs-writable
emptyDir: {}
- name: postgres-config
configMap:
name: postgres-logging-config
---
apiVersion: v1
@@ -107,3 +151,19 @@ spec:
app.kubernetes.io/name: pos-db
app.kubernetes.io/component: database
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: pos-db-pvc
namespace: bakery-ia
labels:
app.kubernetes.io/name: pos-db
app.kubernetes.io/component: database
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 2Gi

62
infrastructure/kubernetes/base/components/databases/production-db.yaml
View File

@@ -19,9 +19,31 @@ spec:
app.kubernetes.io/name: production-db
app.kubernetes.io/component: database
spec:
securityContext:
fsGroup: 70
initContainers:
- name: fix-tls-permissions
image: busybox:latest
securityContext:
runAsUser: 0
command: ['sh', '-c']
args:
- |
cp /tls-source/* /tls/
chmod 600 /tls/server-key.pem
chmod 644 /tls/server-cert.pem /tls/ca-cert.pem
chown 70:70 /tls/*
ls -la /tls/
volumeMounts:
- name: tls-certs-source
mountPath: /tls-source
readOnly: true
- name: tls-certs-writable
mountPath: /tls
containers:
- name: postgres
image: postgres:17-alpine
command: ["docker-entrypoint.sh", "-c", "config_file=/etc/postgresql/postgresql.conf"]
ports:
- containerPort: 5432
name: postgres
@@ -48,11 +70,24 @@ spec:
key: POSTGRES_INITDB_ARGS
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
- name: POSTGRES_HOST_SSL
value: "on"
- name: PGSSLCERT
value: /tls/server-cert.pem
- name: PGSSLKEY
value: /tls/server-key.pem
- name: PGSSLROOTCERT
value: /tls/ca-cert.pem
volumeMounts:
- name: postgres-data
mountPath: /var/lib/postgresql/data
- name: init-scripts
mountPath: /docker-entrypoint-initdb.d
- name: tls-certs-writable
mountPath: /tls
- name: postgres-config
mountPath: /etc/postgresql
readOnly: true
resources:
requests:
memory: "256Mi"
@@ -82,10 +117,19 @@ spec:
failureThreshold: 3
volumes:
- name: postgres-data
emptyDir: {}
persistentVolumeClaim:
claimName: production-db-pvc
- name: init-scripts
configMap:
name: postgres-init-config
- name: tls-certs-source
secret:
secretName: postgres-tls
- name: tls-certs-writable
emptyDir: {}
- name: postgres-config
configMap:
name: postgres-logging-config
---
apiVersion: v1
@@ -107,3 +151,19 @@ spec:
app.kubernetes.io/name: production-db
app.kubernetes.io/component: database
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: production-db-pvc
namespace: bakery-ia
labels:
app.kubernetes.io/name: production-db
app.kubernetes.io/component: database
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 2Gi

62
infrastructure/kubernetes/base/components/databases/recipes-db.yaml
View File

@@ -19,9 +19,31 @@ spec:
app.kubernetes.io/name: recipes-db
app.kubernetes.io/component: database
spec:
securityContext:
fsGroup: 70
initContainers:
- name: fix-tls-permissions
image: busybox:latest
securityContext:
runAsUser: 0
command: ['sh', '-c']
args:
- |
cp /tls-source/* /tls/
chmod 600 /tls/server-key.pem
chmod 644 /tls/server-cert.pem /tls/ca-cert.pem
chown 70:70 /tls/*
ls -la /tls/
volumeMounts:
- name: tls-certs-source
mountPath: /tls-source
readOnly: true
- name: tls-certs-writable
mountPath: /tls
containers:
- name: postgres
image: postgres:17-alpine
command: ["docker-entrypoint.sh", "-c", "config_file=/etc/postgresql/postgresql.conf"]
ports:
- containerPort: 5432
name: postgres
@@ -48,11 +70,24 @@ spec:
key: POSTGRES_INITDB_ARGS
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
- name: POSTGRES_HOST_SSL
value: "on"
- name: PGSSLCERT
value: /tls/server-cert.pem
- name: PGSSLKEY
value: /tls/server-key.pem
- name: PGSSLROOTCERT
value: /tls/ca-cert.pem
volumeMounts:
- name: postgres-data
mountPath: /var/lib/postgresql/data
- name: init-scripts
mountPath: /docker-entrypoint-initdb.d
- name: tls-certs-writable
mountPath: /tls
- name: postgres-config
mountPath: /etc/postgresql
readOnly: true
resources:
requests:
memory: "256Mi"
@@ -82,10 +117,19 @@ spec:
failureThreshold: 3
volumes:
- name: postgres-data
emptyDir: {}
persistentVolumeClaim:
claimName: recipes-db-pvc
- name: init-scripts
configMap:
name: postgres-init-config
- name: tls-certs-source
secret:
secretName: postgres-tls
- name: tls-certs-writable
emptyDir: {}
- name: postgres-config
configMap:
name: postgres-logging-config
---
apiVersion: v1
@@ -107,3 +151,19 @@ spec:
app.kubernetes.io/name: recipes-db
app.kubernetes.io/component: database
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: recipes-db-pvc
namespace: bakery-ia
labels:
app.kubernetes.io/name: recipes-db
app.kubernetes.io/component: database
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 2Gi

54
infrastructure/kubernetes/base/components/databases/redis.yaml
View File

@@ -19,6 +19,27 @@ spec:
app.kubernetes.io/name: redis
app.kubernetes.io/component: cache
spec:
securityContext:
fsGroup: 999 # redis group
initContainers:
- name: fix-tls-permissions
image: busybox:latest
securityContext:
runAsUser: 0
command: ['sh', '-c']
args:
- |
cp /tls-source/* /tls/
chmod 600 /tls/redis-key.pem
chmod 644 /tls/redis-cert.pem /tls/ca-cert.pem
chown 999:999 /tls/*
ls -la /tls/
volumeMounts:
- name: tls-certs-source
mountPath: /tls-source
readOnly: true
- name: tls-certs-writable
mountPath: /tls
containers:
- name: redis
image: redis:7.4-alpine
@@ -41,9 +62,23 @@ spec:
- "512mb"
- --databases
- "16"
- --tls-port
- "6379"
- --port
- "0"
- --tls-cert-file
- /tls/redis-cert.pem
- --tls-key-file
- /tls/redis-key.pem
- --tls-ca-cert-file
- /tls/ca-cert.pem
- --tls-auth-clients
- "no"
volumeMounts:
- name: redis-data
mountPath: /data
- name: tls-certs-writable
mountPath: /tls
resources:
requests:
memory: "256Mi"
@@ -55,6 +90,13 @@ spec:
exec:
command:
- redis-cli
- --tls
- --cert
- /tls/redis-cert.pem
- --key
- /tls/redis-key.pem
- --cacert
- /tls/ca-cert.pem
- -a
- $(REDIS_PASSWORD)
- ping
@@ -66,6 +108,13 @@ spec:
exec:
command:
- redis-cli
- --tls
- --cert
- /tls/redis-cert.pem
- --key
- /tls/redis-key.pem
- --cacert
- /tls/ca-cert.pem
- -a
- $(REDIS_PASSWORD)
- ping
@@ -77,6 +126,11 @@ spec:
- name: redis-data
persistentVolumeClaim:
claimName: redis-pvc
- name: tls-certs-source
secret:
secretName: redis-tls
- name: tls-certs-writable
emptyDir: {}
---
apiVersion: v1

62
infrastructure/kubernetes/base/components/databases/sales-db.yaml
View File

@@ -19,9 +19,31 @@ spec:
app.kubernetes.io/name: sales-db
app.kubernetes.io/component: database
spec:
securityContext:
fsGroup: 70
initContainers:
- name: fix-tls-permissions
image: busybox:latest
securityContext:
runAsUser: 0
command: ['sh', '-c']
args:
- |
cp /tls-source/* /tls/
chmod 600 /tls/server-key.pem
chmod 644 /tls/server-cert.pem /tls/ca-cert.pem
chown 70:70 /tls/*
ls -la /tls/
volumeMounts:
- name: tls-certs-source
mountPath: /tls-source
readOnly: true
- name: tls-certs-writable
mountPath: /tls
containers:
- name: postgres
image: postgres:17-alpine
command: ["docker-entrypoint.sh", "-c", "config_file=/etc/postgresql/postgresql.conf"]
ports:
- containerPort: 5432
name: postgres
@@ -48,11 +70,24 @@ spec:
key: POSTGRES_INITDB_ARGS
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
- name: POSTGRES_HOST_SSL
value: "on"
- name: PGSSLCERT
value: /tls/server-cert.pem
- name: PGSSLKEY
value: /tls/server-key.pem
- name: PGSSLROOTCERT
value: /tls/ca-cert.pem
volumeMounts:
- name: postgres-data
mountPath: /var/lib/postgresql/data
- name: init-scripts
mountPath: /docker-entrypoint-initdb.d
- name: tls-certs-writable
mountPath: /tls
- name: postgres-config
mountPath: /etc/postgresql
readOnly: true
resources:
requests:
memory: "256Mi"
@@ -82,10 +117,19 @@ spec:
failureThreshold: 3
volumes:
- name: postgres-data
emptyDir: {}
persistentVolumeClaim:
claimName: sales-db-pvc
- name: init-scripts
configMap:
name: postgres-init-config
- name: tls-certs-source
secret:
secretName: postgres-tls
- name: tls-certs-writable
emptyDir: {}
- name: postgres-config
configMap:
name: postgres-logging-config
---
apiVersion: v1
@@ -107,3 +151,19 @@ spec:
app.kubernetes.io/name: sales-db
app.kubernetes.io/component: database
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: sales-db-pvc
namespace: bakery-ia
labels:
app.kubernetes.io/name: sales-db
app.kubernetes.io/component: database
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 2Gi

62
infrastructure/kubernetes/base/components/databases/suppliers-db.yaml
View File

@@ -19,9 +19,31 @@ spec:
app.kubernetes.io/name: suppliers-db
app.kubernetes.io/component: database
spec:
securityContext:
fsGroup: 70
initContainers:
- name: fix-tls-permissions
image: busybox:latest
securityContext:
runAsUser: 0
command: ['sh', '-c']
args:
- |
cp /tls-source/* /tls/
chmod 600 /tls/server-key.pem
chmod 644 /tls/server-cert.pem /tls/ca-cert.pem
chown 70:70 /tls/*
ls -la /tls/
volumeMounts:
- name: tls-certs-source
mountPath: /tls-source
readOnly: true
- name: tls-certs-writable
mountPath: /tls
containers:
- name: postgres
image: postgres:17-alpine
command: ["docker-entrypoint.sh", "-c", "config_file=/etc/postgresql/postgresql.conf"]
ports:
- containerPort: 5432
name: postgres
@@ -48,11 +70,24 @@ spec:
key: POSTGRES_INITDB_ARGS
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
- name: POSTGRES_HOST_SSL
value: "on"
- name: PGSSLCERT
value: /tls/server-cert.pem
- name: PGSSLKEY
value: /tls/server-key.pem
- name: PGSSLROOTCERT
value: /tls/ca-cert.pem
volumeMounts:
- name: postgres-data
mountPath: /var/lib/postgresql/data
- name: init-scripts
mountPath: /docker-entrypoint-initdb.d
- name: tls-certs-writable
mountPath: /tls
- name: postgres-config
mountPath: /etc/postgresql
readOnly: true
resources:
requests:
memory: "256Mi"
@@ -82,10 +117,19 @@ spec:
failureThreshold: 3
volumes:
- name: postgres-data
emptyDir: {}
persistentVolumeClaim:
claimName: suppliers-db-pvc
- name: init-scripts
configMap:
name: postgres-init-config
- name: tls-certs-source
secret:
secretName: postgres-tls
- name: tls-certs-writable
emptyDir: {}
- name: postgres-config
configMap:
name: postgres-logging-config
---
apiVersion: v1
@@ -107,3 +151,19 @@ spec:
app.kubernetes.io/name: suppliers-db
app.kubernetes.io/component: database
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: suppliers-db-pvc
namespace: bakery-ia
labels:
app.kubernetes.io/name: suppliers-db
app.kubernetes.io/component: database
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 2Gi

63
infrastructure/kubernetes/base/components/databases/tenant-db.yaml
View File

@@ -19,9 +19,31 @@ spec:
app.kubernetes.io/name: tenant-db
app.kubernetes.io/component: database
spec:
securityContext:
fsGroup: 70
initContainers:
- name: fix-tls-permissions
image: busybox:latest
securityContext:
runAsUser: 0
command: ['sh', '-c']
args:
- |
cp /tls-source/* /tls/
chmod 600 /tls/server-key.pem
chmod 644 /tls/server-cert.pem /tls/ca-cert.pem
chown 70:70 /tls/*
ls -la /tls/
volumeMounts:
- name: tls-certs-source
mountPath: /tls-source
readOnly: true
- name: tls-certs-writable
mountPath: /tls
containers:
- name: postgres
image: postgres:17-alpine
command: ["docker-entrypoint.sh", "-c", "config_file=/etc/postgresql/postgresql.conf"]
ports:
- containerPort: 5432
name: postgres
@@ -48,11 +70,24 @@ spec:
key: POSTGRES_INITDB_ARGS
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
- name: POSTGRES_HOST_SSL
value: "on"
- name: PGSSLCERT
value: /tls/server-cert.pem
- name: PGSSLKEY
value: /tls/server-key.pem
- name: PGSSLROOTCERT
value: /tls/ca-cert.pem
volumeMounts:
- name: postgres-data
mountPath: /var/lib/postgresql/data
- name: init-scripts
mountPath: /docker-entrypoint-initdb.d
- name: tls-certs-writable
mountPath: /tls
- name: postgres-config
mountPath: /etc/postgresql
readOnly: true
resources:
requests:
memory: "256Mi"
@@ -82,10 +117,19 @@ spec:
failureThreshold: 3
volumes:
- name: postgres-data
emptyDir: {}
persistentVolumeClaim:
claimName: tenant-db-pvc
- name: init-scripts
configMap:
name: postgres-init-config
- name: tls-certs-source
secret:
secretName: postgres-tls
- name: tls-certs-writable
emptyDir: {}
- name: postgres-config
configMap:
name: postgres-logging-config
---
apiVersion: v1
@@ -106,3 +150,20 @@ spec:
selector:
app.kubernetes.io/name: tenant-db
app.kubernetes.io/component: database
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: tenant-db-pvc
namespace: bakery-ia
labels:
app.kubernetes.io/name: tenant-db
app.kubernetes.io/component: database
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 2Gi

62
infrastructure/kubernetes/base/components/databases/training-db.yaml
View File

@@ -19,9 +19,31 @@ spec:
app.kubernetes.io/name: training-db
app.kubernetes.io/component: database
spec:
securityContext:
fsGroup: 70
initContainers:
- name: fix-tls-permissions
image: busybox:latest
securityContext:
runAsUser: 0
command: ['sh', '-c']
args:
- |
cp /tls-source/* /tls/
chmod 600 /tls/server-key.pem
chmod 644 /tls/server-cert.pem /tls/ca-cert.pem
chown 70:70 /tls/*
ls -la /tls/
volumeMounts:
- name: tls-certs-source
mountPath: /tls-source
readOnly: true
- name: tls-certs-writable
mountPath: /tls
containers:
- name: postgres
image: postgres:17-alpine
command: ["docker-entrypoint.sh", "-c", "config_file=/etc/postgresql/postgresql.conf"]
ports:
- containerPort: 5432
name: postgres
@@ -48,11 +70,24 @@ spec:
key: POSTGRES_INITDB_ARGS
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
- name: POSTGRES_HOST_SSL
value: "on"
- name: PGSSLCERT
value: /tls/server-cert.pem
- name: PGSSLKEY
value: /tls/server-key.pem
- name: PGSSLROOTCERT
value: /tls/ca-cert.pem
volumeMounts:
- name: postgres-data
mountPath: /var/lib/postgresql/data
- name: init-scripts
mountPath: /docker-entrypoint-initdb.d
- name: tls-certs-writable
mountPath: /tls
- name: postgres-config
mountPath: /etc/postgresql
readOnly: true
resources:
requests:
memory: "256Mi"
@@ -82,10 +117,19 @@ spec:
failureThreshold: 3
volumes:
- name: postgres-data
emptyDir: {}
persistentVolumeClaim:
claimName: training-db-pvc
- name: init-scripts
configMap:
name: postgres-init-config
- name: tls-certs-source
secret:
secretName: postgres-tls
- name: tls-certs-writable
emptyDir: {}
- name: postgres-config
configMap:
name: postgres-logging-config
---
apiVersion: v1
@@ -107,3 +151,19 @@ spec:
app.kubernetes.io/name: training-db
app.kubernetes.io/component: database
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: training-db-pvc
namespace: bakery-ia
labels:
app.kubernetes.io/name: training-db
app.kubernetes.io/component: database
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 2Gi

2
infrastructure/kubernetes/base/components/demo-session/deployment.yaml
View File

@@ -38,7 +38,7 @@ spec:
name: redis-secrets
key: REDIS_PASSWORD
- name: REDIS_URL
value: "redis://:$(REDIS_PASSWORD)@redis-service:6379/0"
value: "rediss://:$(REDIS_PASSWORD)@redis-service:6379/0?ssl_cert_reqs=none"
- name: AUTH_SERVICE_URL
value: "http://auth-service:8000"
- name: TENANT_SERVICE_URL

3
infrastructure/kubernetes/base/configmap.yaml
View File

@@ -309,6 +309,7 @@ data:
# ================================================================
# CACHE SETTINGS
# ================================================================
REDIS_TLS_ENABLED: "true"
REDIS_MAX_MEMORY: "512mb"
REDIS_MAX_CONNECTIONS: "50"
REDIS_DB: "1"
@@ -352,4 +353,4 @@ data:
EXTERNAL_ENABLED_CITIES: "madrid"
EXTERNAL_RETENTION_MONTHS: "6" # Reduced from 24 to avoid memory issues during init
EXTERNAL_CACHE_TTL_DAYS: "7"
EXTERNAL_REDIS_URL: "redis://redis-service:6379/0"
EXTERNAL_REDIS_URL: "rediss://redis-service:6379/0?ssl_cert_reqs=none"

60
infrastructure/kubernetes/base/configmaps/postgres-logging-config.yaml Normal file
View File

@@ -0,0 +1,60 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: postgres-logging-config
namespace: bakery-ia
labels:
app.kubernetes.io/name: bakery-ia
app.kubernetes.io/component: database-logging
data:
postgresql.conf: |
# PostgreSQL Configuration for Kubernetes
# Generated for security compliance and monitoring
# Network Configuration
listen_addresses = '*'
port = 5432
# Connection Logging
log_connections = on
log_disconnections = on
log_hostname = off
# Query Logging
log_statement = 'all'
log_duration = on
log_min_duration_statement = 1000
# Log Destination
log_destination = 'stderr'
logging_collector = off
# Log Output Format
log_line_prefix = '%t [%p]: user=%u,db=%d,app=%a,client=%h '
log_timezone = 'UTC'
# Error Logging
log_error_verbosity = default
log_min_messages = warning
log_min_error_statement = error
# Checkpoints
log_checkpoints = on
# Lock Waits
log_lock_waits = on
deadlock_timeout = 1s
# Temporary Files
log_temp_files = 0
# Autovacuum Logging
log_autovacuum_min_duration = 0
# SSL/TLS Configuration
ssl = on
ssl_cert_file = '/tls/server-cert.pem'
ssl_key_file = '/tls/server-key.pem'
ssl_ca_file = '/tls/ca-cert.pem'
ssl_prefer_server_ciphers = on
ssl_min_protocol_version = 'TLSv1.2'

3
infrastructure/kubernetes/base/configs/postgres-init-config.yaml
View File

@@ -9,4 +9,5 @@ metadata:
data:
init.sql: |
CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
CREATE EXTENSION IF NOT EXISTS "pg_stat_statements";
CREATE EXTENSION IF NOT EXISTS "pg_stat_statements";
CREATE EXTENSION IF NOT EXISTS "pgcrypto";

4
infrastructure/kubernetes/base/kustomization.yaml
View File

@@ -11,6 +11,10 @@ resources:
- secrets.yaml
- ingress-https.yaml
# TLS configuration
- configmaps/postgres-logging-config.yaml
- secrets/postgres-tls-secret.yaml
- secrets/redis-tls-secret.yaml
# Additional configs
- configs/postgres-init-config.yaml

58
infrastructure/kubernetes/base/secrets.yaml
View File

@@ -26,37 +26,37 @@ data:
DEMO_SESSION_DB_USER: ZGVtb19zZXNzaW9uX3VzZXI= # demo_session_user
# Database Passwords (base64 encoded from .env)
AUTH_DB_PASSWORD: YXV0aF9wYXNzMTIz # auth_pass123
TENANT_DB_PASSWORD: dGVuYW50X3Bhc3MxMjM= # tenant_pass123
TRAINING_DB_PASSWORD: dHJhaW5pbmdfcGFzczEyMw== # training_pass123
FORECASTING_DB_PASSWORD: Zm9yZWNhc3RpbmdfcGFzczEyMw== # forecasting_pass123
SALES_DB_PASSWORD: c2FsZXNfcGFzczEyMw== # sales_pass123
EXTERNAL_DB_PASSWORD: ZXh0ZXJuYWxfcGFzczEyMw== # external_pass123
NOTIFICATION_DB_PASSWORD: bm90aWZpY2F0aW9uX3Bhc3MxMjM= # notification_pass123
INVENTORY_DB_PASSWORD: aW52ZW50b3J5X3Bhc3MxMjM= # inventory_pass123
RECIPES_DB_PASSWORD: cmVjaXBlc19wYXNzMTIz # recipes_pass123
SUPPLIERS_DB_PASSWORD: c3VwcGxpZXJzX3Bhc3MxMjM= # suppliers_pass123
POS_DB_PASSWORD: cG9zX3Bhc3MxMjM= # pos_pass123
ORDERS_DB_PASSWORD: b3JkZXJzX3Bhc3MxMjM= # orders_pass123
PRODUCTION_DB_PASSWORD: cHJvZHVjdGlvbl9wYXNzMTIz # production_pass123
ALERT_PROCESSOR_DB_PASSWORD: YWxlcnRfcHJvY2Vzc29yX3Bhc3MxMjM= # alert_processor_pass123
AUTH_DB_PASSWORD: djJvOHBqVWRSUVprR1JsbDlOV2JXdGt4WUFGcVBmOWw= # v2o8pjUdRQZkGRll...
TENANT_DB_PASSWORD: bnNDVFpONkJsMDBjcWswZGNzcnVwUXRVWERFQ2dNVnY= # nsCTZN6Bl00cqk0d...
TRAINING_DB_PASSWORD: UGxwVklOZlpCaXNOcFBpekNWQndKMTM3Q2lwQTlKUDE= # PlpVINfZBisNpPiz...
FORECASTING_DB_PASSWORD: eElVNDVJdjFEWXVXajhiSWczdWprR05TdUZuMjhuVzc= # xIU45Iv1DYuWj8bI...
SALES_DB_PASSWORD: QUdkOTdZb3ZXc1c1ZURCMWtLeTEwQkg3YTZGYUpUSkQ= # AGd97YovWsW5eDB1...
EXTERNAL_DB_PASSWORD: OFJCSHR4a1dVYjFUTm1DeGV2d2Q1VzhnV3hQREpBcGU= # 8RBHtxkWUb1TNmCx...
NOTIFICATION_DB_PASSWORD: ZENDM21LMEVGSXZhRUV6Sm1naEFJTzJIbTg2Y2psRko= # dCC3mK0EFIvaEEzJ...
INVENTORY_DB_PASSWORD: VDB1Sm5YczByNFRVbXhTUWVRMkR1UUdQNkhVMExFYmE= # T0uJnXs0r4TUmxSQ...
RECIPES_DB_PASSWORD: MlFDRjlwc1R3WmpTaE9KNEE5d1dZOUlNMnVJc2pJc3Y= # 2QCF9psTwZjShOJ4...
SUPPLIERS_DB_PASSWORD: cG1LNjFMY2drVDBmY25OaFZZQ25heGdFZlRJV2tBVng= # pmK61LcgkT0fcnNh...
POS_DB_PASSWORD: OGxLZzN1RWlJTFBmVTJiRnlHTXdWTWhTc1RQOFRCeGg= # 8lKg3uEiILPfU2bF...
ORDERS_DB_PASSWORD: VFR1ZEJpbTdOVlJrcFlYejkzNEVUY0lFZGdlYTZ3VE4= # TTudBim7NVRkpYXz...
PRODUCTION_DB_PASSWORD: bFNZSDRacFBieHlIQXMweVRzelRWWWRSc3lBUjFKYUc= # lSYH4ZpPbxyHAs0y...
ALERT_PROCESSOR_DB_PASSWORD: T0NqMmtzaHdSNmNZNFFoT3U4SlpsR2RPZnF5Y0ZtV2Y= # OCj2kshwR6cY4QhO...
DEMO_SESSION_DB_PASSWORD: ZGVtb19zZXNzaW9uX3Bhc3MxMjM= # demo_session_pass123
# Database URLs (base64 encoded)
AUTH_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vYXV0aF91c2VyOmF1dGhfcGFzczEyM0BhdXRoLWRiLXNlcnZpY2U6NTQzMi9hdXRoX2Ri # postgresql+asyncpg://auth_user:auth_pass123@auth-db-service:5432/auth_db
TENANT_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vdGVuYW50X3VzZXI6dGVuYW50X3Bhc3MxMjNAdGVuYW50LWRiLXNlcnZpY2U6NTQzMi90ZW5hbnRfZGI= # postgresql+asyncpg://tenant_user:tenant_pass123@tenant-db-service:5432/tenant_db
TRAINING_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vdHJhaW5pbmdfdXNlcjp0cmFpbmluZ19wYXNzMTIzQHRyYWluaW5nLWRiLXNlcnZpY2U6NTQzMi90cmFpbmluZ19kYg== # postgresql+asyncpg://training_user:training_pass123@training-db-service:5432/training_db
FORECASTING_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vZm9yZWNhc3RpbmdfdXNlcjpmb3JlY2FzdGluZ19wYXNzMTIzQGZvcmVjYXN0aW5nLWRiLXNlcnZpY2U6NTQzMi9mb3JlY2FzdGluZ19kYg== # postgresql+asyncpg://forecasting_user:forecasting_pass123@forecasting-db-service:5432/forecasting_db
SALES_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vc2FsZXNfdXNlcjpzYWxlc19wYXNzMTIzQHNhbGVzLWRiLXNlcnZpY2U6NTQzMi9zYWxlc19kYg== # postgresql+asyncpg://sales_user:sales_pass123@sales-db-service:5432/sales_db
EXTERNAL_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vZXh0ZXJuYWxfdXNlcjpleHRlcm5hbF9wYXNzMTIzQGV4dGVybmFsLWRiLXNlcnZpY2U6NTQzMi9leHRlcm5hbF9kYg== # postgresql+asyncpg://external_user:external_pass123@external-db-service:5432/external_db
NOTIFICATION_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vbm90aWZpY2F0aW9uX3VzZXI6bm90aWZpY2F0aW9uX3Bhc3MxMjNAbm90aWZpY2F0aW9uLWRiLXNlcnZpY2U6NTQzMi9ub3RpZmljYXRpb25fZGI= # postgresql+asyncpg://notification_user:notification_pass123@notification-db-service:5432/notification_db
INVENTORY_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vaW52ZW50b3J5X3VzZXI6aW52ZW50b3J5X3Bhc3MxMjNAaW52ZW50b3J5LWRiLXNlcnZpY2U6NTQzMi9pbnZlbnRvcnlfZGI= # postgresql+asyncpg://inventory_user:inventory_pass123@inventory-db-service:5432/inventory_db
RECIPES_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vcmVjaXBlc191c2VyOnJlY2lwZXNfcGFzczEyM0ByZWNpcGVzLWRiLXNlcnZpY2U6NTQzMi9yZWNpcGVzX2Ri # postgresql+asyncpg://recipes_user:recipes_pass123@recipes-db-service:5432/recipes_db
SUPPLIERS_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vc3VwcGxpZXJzX3VzZXI6c3VwcGxpZXJzX3Bhc3MxMjNAc3VwcGxpZXJzLWRiLXNlcnZpY2U6NTQzMi9zdXBwbGllcnNfZGI= # postgresql+asyncpg://suppliers_user:suppliers_pass123@suppliers-db-service:5432/suppliers_db
POS_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vcG9zX3VzZXI6cG9zX3Bhc3MxMjNAcG9zLWRiLXNlcnZpY2U6NTQzMi9wb3NfZGI= # postgresql+asyncpg://pos_user:pos_pass123@pos-db-service:5432/pos_db
ORDERS_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vb3JkZXJzX3VzZXI6b3JkZXJzX3Bhc3MxMjNAb3JkZXJzLWRiLXNlcnZpY2U6NTQzMi9vcmRlcnNfZGI= # postgresql+asyncpg://orders_user:orders_pass123@orders-db-service:5432/orders_db
PRODUCTION_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vcHJvZHVjdGlvbl91c2VyOnByb2R1Y3Rpb25fcGFzczEyM0Bwcm9kdWN0aW9uLWRiLXNlcnZpY2U6NTQzMi9wcm9kdWN0aW9uX2Ri # postgresql+asyncpg://production_user:production_pass123@production-db-service:5432/production_db
ALERT_PROCESSOR_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vYWxlcnRfcHJvY2Vzc29yX3VzZXI6YWxlcnRfcHJvY2Vzc29yX3Bhc3MxMjNAYWxlcnQtcHJvY2Vzc29yLWRiLXNlcnZpY2U6NTQzMi9hbGVydF9wcm9jZXNzb3JfZGI= # postgresql+asyncpg://alert_processor_user:alert_processor_pass123@alert-processor-db-service:5432/alert_processor_db
AUTH_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vYXV0aF91c2VyOnYybzhwalVkUlFaa0dSbGw5TldiV3RreFlBRnFQZjlsQGF1dGgtZGItc2VydmljZTo1NDMyL2F1dGhfZGI= # Updated with new password
TENANT_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vdGVuYW50X3VzZXI6bnNDVFpONkJsMDBjcWswZGNzcnVwUXRVWERFQ2dNVnZAdGVuYW50LWRiLXNlcnZpY2U6NTQzMi90ZW5hbnRfZGI= # Updated with new password
TRAINING_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vdHJhaW5pbmdfdXNlcjpQbHBWSU5mWkJpc05wUGl6Q1ZCd0oxMzdDaXBBOUpQMUB0cmFpbmluZy1kYi1zZXJ2aWNlOjU0MzIvdHJhaW5pbmdfZGI= # Updated with new password
FORECASTING_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vZm9yZWNhc3RpbmdfdXNlcjp4SVU0NUl2MURZdVdqOGJJZzN1amtHTlN1Rm4yOG5XN0Bmb3JlY2FzdGluZy1kYi1zZXJ2aWNlOjU0MzIvZm9yZWNhc3RpbmdfZGI= # Updated with new password
SALES_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vc2FsZXNfdXNlcjpBR2Q5N1lvdldzVzVlREIxa0t5MTBCSDdhNkZhSlRKREBzYWxlcy1kYi1zZXJ2aWNlOjU0MzIvc2FsZXNfZGI= # Updated with new password
EXTERNAL_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vZXh0ZXJuYWxfdXNlcjo4UkJIdHhrV1ViMVRObUN4ZXZ3ZDVXOGdXeFBESkFwZUBleHRlcm5hbC1kYi1zZXJ2aWNlOjU0MzIvZXh0ZXJuYWxfZGI= # Updated with new password
NOTIFICATION_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vbm90aWZpY2F0aW9uX3VzZXI6ZENDM21LMEVGSXZhRUV6Sm1naEFJTzJIbTg2Y2psRkpAbm90aWZpY2F0aW9uLWRiLXNlcnZpY2U6NTQzMi9ub3RpZmljYXRpb25fZGI= # Updated with new password
INVENTORY_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vaW52ZW50b3J5X3VzZXI6VDB1Sm5YczByNFRVbXhTUWVRMkR1UUdQNkhVMExFYmFAaW52ZW50b3J5LWRiLXNlcnZpY2U6NTQzMi9pbnZlbnRvcnlfZGI= # Updated with new password
RECIPES_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vcmVjaXBlc191c2VyOjJRQ0Y5cHNUd1pqU2hPSjRBOXdXWTlJTTJ1SXNqSXN2QHJlY2lwZXMtZGItc2VydmljZTo1NDMyL3JlY2lwZXNfZGI= # Updated with new password
SUPPLIERS_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vc3VwcGxpZXJzX3VzZXI6cG1LNjFMY2drVDBmY25OaFZZQ25heGdFZlRJV2tBVnhAc3VwcGxpZXJzLWRiLXNlcnZpY2U6NTQzMi9zdXBwbGllcnNfZGI= # Updated with new password
POS_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vcG9zX3VzZXI6OGxLZzN1RWlJTFBmVTJiRnlHTXdWTWhTc1RQOFRCeGhAcG9zLWRiLXNlcnZpY2U6NTQzMi9wb3NfZGI= # Updated with new password
ORDERS_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vb3JkZXJzX3VzZXI6VFR1ZEJpbTdOVlJrcFlYejkzNEVUY0lFZGdlYTZ3VE5Ab3JkZXJzLWRiLXNlcnZpY2U6NTQzMi9vcmRlcnNfZGI= # Updated with new password
PRODUCTION_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vcHJvZHVjdGlvbl91c2VyOmxTWUg0WnBQYnh5SEFzMHlUc3pUVllkUnN5QVIxSmFHQHByb2R1Y3Rpb24tZGItc2VydmljZTo1NDMyL3Byb2R1Y3Rpb25fZGI= # Updated with new password
ALERT_PROCESSOR_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vYWxlcnRfcHJvY2Vzc29yX3VzZXI6T0NqMmtzaHdSNmNZNFFoT3U4SlpsR2RPZnF5Y0ZtV2ZAYWxlcnQtcHJvY2Vzc29yLWRiLXNlcnZpY2U6NTQzMi9hbGVydF9wcm9jZXNzb3JfZGI= # Updated with new password
DEMO_SESSION_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vZGVtb19zZXNzaW9uX3VzZXI6ZGVtb19zZXNzaW9uX3Bhc3MxMjNAZGVtby1zZXNzaW9uLWRiLXNlcnZpY2U6NTQzMi9kZW1vX3Nlc3Npb25fZGI= # postgresql+asyncpg://demo_session_user:demo_session_pass123@demo-session-db-service:5432/demo_session_db
---
@@ -70,7 +70,7 @@ metadata:
app.kubernetes.io/component: redis
type: Opaque
data:
REDIS_PASSWORD: cmVkaXNfcGFzczEyMw== # redis_pass123
REDIS_PASSWORD: T3hkbWRKamRWTlhwMzdNTkMySUZvTW5UcGZHR0Z2MWs= # OxdmdJjdVNXp37MN...
---
apiVersion: v1

25
infrastructure/kubernetes/base/secrets/postgres-tls-secret.yaml Normal file
View File

@@ -0,0 +1,25 @@
apiVersion: v1
kind: Secret
metadata:
name: postgres-tls
namespace: bakery-ia
labels:
app.kubernetes.io/name: bakery-ia
app.kubernetes.io/component: database-tls
type: Opaque
data:
# PostgreSQL TLS certificates (base64 encoded)
# Generated using infrastructure/tls/generate-certificates.sh
# Valid for 3 years from generation date
#
# Certificate details:
# Subject: CN=*.bakery-ia.svc.cluster.local, O=BakeryIA, OU=Database
# Issuer: CN=BakeryIA-CA, O=BakeryIA, OU=Security
#
# To regenerate:
# 1. Run: infrastructure/tls/generate-certificates.sh
# 2. Run: scripts/create-tls-secrets.sh
ca-cert.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZ5ekNDQTdPZ0F3SUJBZ0lVUGdPcU5ZK1pvS0J5UTFNZk84bGtpR2hPbXhJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2RURUxNQWtHQTFVRUJoTUNWVk14RXpBUkJnTlZCQWdNQ2tOaGJHbG1iM0p1YVdFeEZUQVRCZ05WQkFjTQpERk5oYmtaeVlXNWphWE5qYnpFUk1BOEdBMVVFQ2d3SVFtRnJaWEo1U1VFeEVUQVBCZ05WQkFzTUNGTmxZM1Z5CmFYUjVNUlF3RWdZRFZRUUREQXRDWVd0bGNubEpRUzFEUVRBZUZ3MHlOVEV3TVRneE5ESXlNVFJhRncwek5URXcKTVRZeE5ESXlNVFJhTUhVeEN6QUpCZ05WQkFZVEFsVlRNUk13RVFZRFZRUUlEQXBEWVd4cFptOXlibWxoTVJVdwpFd1lEVlFRSERBeFRZVzVHY21GdVkybHpZMjh4RVRBUEJnTlZCQW9NQ0VKaGEyVnllVWxCTVJFd0R3WURWUVFMCkRBaFRaV04xY21sMGVURVVNQklHQTFVRUF3d0xRbUZyWlhKNVNVRXRRMEV3Z2dJaU1BMEdDU3FHU0liM0RRRUIKQVFVQUE0SUNEd0F3Z2dJS0FvSUNBUURSRDVPMmVna1lnOUhOUlI1U1UwYkxuR0hqcHYvUmFnck03ZGh1c2FXbgpyZkRGNVZwVFo0czkvOXNPRUowTnlqdW9LWGFtb3VUd1IxbncxOUZkSDhmMWVvbWNRNGVLdzJIa3hveHFSMzR0ClJEYUFHejNiV08rcmFUUTRTeU1LN1hGTW92VVVpTGwrR08yM2wxQk5QZmh6a2NEa1o5N200MzRmMVFWbzk5dGIKaFY0YklMYW9GSXFmMDlNMEUxL2ZhQitKQ1I4WWtsN0xvWGd1ejNWUi9CVW5kMHZNc1RNV3VlRC8yblZ1VVpPMAowcFVtVFVCUTJRZDc2NTdrL0hXZC8xd2NFQUw5ZFhOUmJ4aEROZkdnYzNXdFFoZ2djcFlMUWFmTGE4MXRseHljCndEZ042UGRFbFVseGdYL091b1oxeWxNWkU3eHBzTXRwbjFBd2VvZFZibTNRcDVBMXlkeWJFNjF1MXVyWXoxTHQKV05aOWVPZkFxZXdpWVFIVlpXTUM0YTRTYSsyeU02cTVQWC80ZytUYklUaDhoWkp3WFBLNUVEaWc3dkYxNEpQbApsRVJOcHdpYTNuNmEwUDcwM0hQTjZya1FPNWtWVGRpVXNmaWJNdGNVSkhMeVdXUUFSQm15ZVZma0lDYWFlWUVsCkVMa3N3YTlOVkVTS3ZRYUhLU2lIWkZoRUkwYUF2Y3BBam0xRU9oRWEraFNSaE9vRnlVT3ZHK2NNT2ZjQlNtTDAKVW1sRC9sZmFuVFQwems1YXFzcEVrWEdlQnczMXJtWi8wQVpPalYycHBSeFdXZWt6bzlCZjdnNmVMVFk0VUNDNQpNeVB0em14OVRiWHJOQW5YaGlGNkxnNWgyOFI0MkdUZTVBZDZUSGtGOVMvS2hxOHUwZFk1U0EyR1VGMUViUU84Ckt3SURBUUFCbzFNd1VUQWRCZ05WSFE0RUZnUVVBKzZxL2tjOGZUUVUxRURxekdSZktRcHE2bTB3SHdZRFZSMGoKQkJnd0ZvQVVBKzZxL2tjOGZUUVUxRURxekdSZktRcHE2bTB3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFOQmdrcQpoa2lHOXcwQkFRc0ZBQU9DQWdFQVF1dkZoMitIUUZ5OFZUY1VnYWxFVmlheXQxelFHdjRySVNtaXEzRzZJZVhQClhTNGd3cUhrRnpUd1p2bW9oVHdtT0N3Vy94RjRLZ3htRmJ5V05yRUpKRXFjYmVkcVVXVi8wQkNhRm1KdlVkZEkKK2V4L2lEM0ZlYnU4QUZJK0o4bEJIL0NlbkRpU0xIaGd5c2VZOHV3Um5Yc3NoWDVSbkRpckYxdUtyMUo2MzVhbgpHbHlGSU5Vcm5RbGd1RXZ0cjBlbkdVbHpUNXJXajR5MEFXVWRiWGk4dlJzaldvUThKYTBCeFRyWVloL2tPL0ZJClB0cVg3d3N4b0pNREVRNzF6aHdhN1dMUWMyZGZiMnJBcjF1QmgzcU53aVZCSU5CK3QzSkZ2NzJ4cXNXZ3VySUIKSWYyc29SVEkybk1lNWdURzFEZmQrVjI0amZhL3lJZ0FzTWpDem1HUUsyMHZvYlg0c0FWbm1QVmJaZzlTTEZaaQpNaWRrbjlPOVU2OE1FT2UzSWFzY2xkN2ZwNUprK0hyYkpVNi9zMTZFRVIvQWdEM09vajN3UmdqVENTK0FERCtqCnhvMk84Vlgya1BvMDNBTitpWWEzbkptbE1GekNyelQrOFp4U25QNUZxR2cyRUNFYnFxQTBCLzVuYVZwbWRZYVYKNDFvRkxzd2NGbTJpcUdhd2JzTE45eDN0dklDdUU5M0hZazFqNzJQelhhaVNMdHB2YW1IMWRSWUMrSFVNMUwwTwo0OUNOTVlKZUwvTmx5UXVaSm0yWDBxRE5TWG1STUw4SFU5c093V1g2cFBQSk96dXF0Z2R4Lytsa0dBZDJ3WkpVCklWYm1MNlF2emRidGEvY1NWd3NMdEJ6RzQ4YTFiNEtCYzdXTEhUd2JyZEJSVGcwVGtMWTRrdkNaZTVuTmw0RT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
server-cert.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUhjakNDQlZxZ0F3SUJBZ0lVRytCME0ycnhucWpHZHRmbzBCaGV2S0N4MGY0d0RRWUpLb1pJaHZjTkFRRUwKQlFBd2RURUxNQWtHQTFVRUJoTUNWVk14RXpBUkJnTlZCQWdNQ2tOaGJHbG1iM0p1YVdFeEZUQVRCZ05WQkFjTQpERk5oYmtaeVlXNWphWE5qYnpFUk1BOEdBMVVFQ2d3SVFtRnJaWEo1U1VFeEVUQVBCZ05WQkFzTUNGTmxZM1Z5CmFYUjVNUlF3RWdZRFZRUUREQXRDWVd0bGNubEpRUzFEUVRBZUZ3MHlOVEV3TVRneE5ESXlNVFJhRncweU9ERXcKTVRjeE5ESXlNVFJhTUlHSE1Rc3dDUVlEVlFRR0V3SlZVekVUTUJFR0ExVUVDQXdLUTJGc2FXWnZjbTVwWVRFVgpNQk1HQTFVRUJ3d01VMkZ1Um5KaGJtTnBjMk52TVJFd0R3WURWUVFLREFoQ1lXdGxjbmxKUVRFUk1BOEdBMVVFCkN3d0lSR0YwWVdKaGMyVXhKakFrQmdOVkJBTU1IU291WW1GclpYSjVMV2xoTG5OMll5NWpiSFZ6ZEdWeUxteHYKWTJGc01JSUNJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBZzhBTUlJQ0NnS0NBZ0VBMWIvVlNmdS9QTXZZb3JiTAoyOTVWMlpBR1JSTld1cEhIM0s5eERBUG00NVR1ZGdQV0x4bnlBOUhWejVqbUtnV0hRS1ZyU0kwNDZ1THVFWUErClJtdGg3RkVWQ0x0OWk1aWZoYVhtQWZTb3VHOTFuQzJOQ3NobUVoWHRaQkpYMG9tYU5oaUREb3R4NzhrakthTFIKQTIybVFvQ2NQdmt6RXFPRUNwaVZGVTlVSEIzQzV1bm10SFNDNDhiQitBUnlpRTJ6N1JyYUcxWUVLa2lsamlsRgptSlRTNk4zNkJxYWJGNkF4cVNwSWFub0VnRmdXQzZhSVh0QStmbzNFejFtSkVGd2Z6UUJXY0t0L09OM254M3hECmJSTnNtb3J4SHBzUGluT0E0aEhWdzdUY1U0THFxVVJZZGROb2NtYmtLaVZYSlpFRmdMZW5nQjFsbS9sQVlXcVoKUWRQYlQxVWNDZlFMdlN0NmxWaytWQjA2ZVo0WktmaS9rb2ZsRlAwZisyU0IyaFE2YWo5N0cvUmJya0NHYUlGWApDeDVkNjlBb3FTd3VFeHRYL1FtMVVLME8yeHBMdjM1S2RTY3krWjFJRk9jWXpjWHEyOGZ4bXUrVERETnlTU2NLCmxzYmp3ZnU0RUdLR0xza3RHdlRBR0gxRXlLdktrc3F4MEV4OXMvOHZBaS8yVDQrRkMxQmwyNUI1ZnpERUQ1RHAKS0h0SmF0eHdqV2lpRGxheXJrOFdnMDNSeUZTZjVuNEY3UmJwMytvRm1zU1NuRUVaK1JDT25DZ3FDWlkxTXM5cgpGVDlmejdoQXMyK1hQZXB1MHZ3RktCVXdseGlXZER6SDZzRElRQ2VTM3hTMjQzdnlpYXRFdTZLOEM3eDBlV2xzCjU5SUJRcXY1eDJUYkZ0VHdEWGdiK1NKMGsyVUNBd0VBQWFPQ0FlVXdnZ0hoTUFzR0ExVWREd1FFQXdJRU1EQWQKQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd2dnRnhCZ05WSFJFRWdnRm9NSUlCWklJZApLaTVpWVd0bGNua3RhV0V1YzNaakxtTnNkWE4wWlhJdWJHOWpZV3lDQ3lvdVltRnJaWEo1TFdsaGdnOWhkWFJvCkxXUmlMWE5sY25acFkyV0NFWFJsYm1GdWRDMWtZaTF6WlhKMmFXTmxnaE4wY21GcGJtbHVaeTFrWWkxelpYSjIKYVdObGdoWm1iM0psWTJGemRHbHVaeTFrWWkxelpYSjJhV05sZ2hCellXeGxjeTFrWWkxelpYSjJhV05sZ2hObAplSFJsY201aGJDMWtZaTF6WlhKMmFXTmxnaGR1YjNScFptbGpZWFJwYjI0dFpHSXRjMlZ5ZG1salpZSVVhVzUyClpXNTBiM0o1TFdSaUxYTmxjblpwWTJXQ0VuSmxZMmx3WlhNdFpHSXRjMlZ5ZG1salpZSVVjM1Z3Y0d4cFpYSnoKTFdSaUxYTmxjblpwWTJXQ0RuQnZjeTFrWWkxelpYSjJhV05sZ2hGdmNtUmxjbk10WkdJdGMyVnlkbWxqWllJVgpjSEp2WkhWamRHbHZiaTFrWWkxelpYSjJhV05sZ2hwaGJHVnlkQzF3Y205alpYTnpiM0l0WkdJdGMyVnlkbWxqClpZSUpiRzlqWVd4b2IzTjBod1IvQUFBQk1CMEdBMVVkRGdRV0JCUitaeU1BTUNNeUN2NTBNSlRjSFN3MTNWVjkKM1RBZkJnTlZIU01FR0RBV2dCUUQ3cXIrUnp4OU5CVFVRT3JNWkY4cENtcnFiVEFOQmdrcWhraUc5dzBCQVFzRgpBQU9DQWdFQUM3V0NOM2FKdzR2VDNOcjVmV3Fqa3p4Y2wrc3BUUnlCREViSlpZcDNIZEszUU9peGhUZDBCM2JGCkZ6V1NJWDc5R3Z2cy9yajhTWkRYUDNCZHNTcG9JeFRKZitpbnpQbThoUFJvMmN1U05qTzl5aGYxdTFBQnliMmcKZVdtMkw1OGRMTElZbmdjc2wvQWFUaGlmT3VLZlZjN2tYNUY1K3BwSGxXRTRJTkdhT0tsMlpxQkxwT20rNG5YcAo3OGlCQXRmSEtWTG1NQmtJRHNZZ1g5RURVNGdZWWVyU0V1WTNUYWM5NGVhOW5FY0dwdkhEaEdSYk5SUzQ2RmwvCk8zVmoxOE9TK0tkZE1lckF1ZU5qdm9wNXZzSzBUNk1DZWxMT2hscnRvTWVOSEVjd3prQkx3anZEbzJHV2FIbU8KU3lKTndTRUFqbHlVMXJyYTBUWHRweU1nNi9jbldicjlnS2hybmYrTzBDTUdMdVYwOEZpUEN3YTYvcW1QYWlLQQppMCs2VGJ1c2JGTEdrZVdDUEszanlaRmFsU1puV1BINWRMSkV3dVNZZTlTRnhaVlpTSFNNV24weXR2NUh1Wk5qClpJbnh2YmpqNlMrYTVTZVJjNXB2ako1Vk1Ea2tRSjM0bUJsMjJub3lCaXA4Y3J1UWdBN3l6SG45c3ljYkF5VGsKWWdOWEpIbmI0UW11dHJiTTd6YnFrR1BORlhFQnl5VmFZL203WnJsRTNvRzRHUmxOc3NtS3lVZ3ZMUHhVbWdZSwpwNFg1eERoUlFsNE1WNDkvL0E1RjYrcVM2dXIrQitwOXhIb0xKZm9CUlRTVytTNlB1YmI0d1FINDl6cDNObW05Cjk0YVRoaktISzhUaU1iSkErYlEva0YyT25KWXVua3VjWWpZek52ald3ZjFTL3JlQmcyRT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
server-key.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUpRUUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQ1Nzd2dna25BZ0VBQW9JQ0FRRFZ2OVZKKzc4OHk5aWkKdHN2YjNsWFprQVpGRTFhNmtjZmNyM0VNQStiamxPNTJBOVl2R2ZJRDBkWFBtT1lxQllkQXBXdElqVGpxNHU0UgpnRDVHYTJIc1VSVUl1MzJMbUorRnBlWUI5S2k0YjNXY0xZMEt5R1lTRmUxa0VsZlNpWm8yR0lNT2kzSHZ5U01wCm90RURiYVpDZ0p3KytUTVNvNFFLbUpVVlQxUWNIY0xtNmVhMGRJTGp4c0g0QkhLSVRiUHRHdG9iVmdRcVNLV08KS1VXWWxOTG8zZm9HcHBzWG9ER3BLa2hxZWdTQVdCWUxwb2hlMEQ1K2pjVFBXWWtRWEIvTkFGWndxMzg0M2VmSApmRU50RTJ5YWl2RWVtdytLYzREaUVkWER0TnhUZ3VxcFJGaDEwMmh5WnVRcUpWY2xrUVdBdDZlQUhXV2IrVUJoCmFwbEIwOXRQVlJ3SjlBdTlLM3FWV1Q1VUhUcDVuaGtwK0wrU2grVVUvUi83WklIYUZEcHFQM3NiOUZ1dVFJWm8KZ1ZjTEhsM3IwQ2lwTEM0VEcxZjlDYlZRclE3YkdrdS9ma3AxSnpMNW5VZ1U1eGpOeGVyYngvR2E3NU1NTTNKSgpKd3FXeHVQQis3Z1FZb1l1eVMwYTlNQVlmVVRJcThxU3lySFFUSDJ6L3k4Q0wvWlBqNFVMVUdYYmtIbC9NTVFQCmtPa29lMGxxM0hDTmFLSU9Wckt1VHhhRFRkSElWSi9tZmdYdEZ1bmY2Z1dheEpLY1FSbjVFSTZjS0NvSmxqVXkKejJzVlAxL1B1RUN6YjVjOTZtN1MvQVVvRlRDWEdKWjBQTWZxd01oQUo1TGZGTGJqZS9LSnEwUzdvcndMdkhSNQphV3puMGdGQ3EvbkhaTnNXMVBBTmVCdjVJblNUWlFJREFRQUJBb0lDQUFYcG5nZnVDa2xhRVg2Q3Z2Q0YzY0JuCkR2MVhLUnJWRUg4UmJVenZTTEk2a0Q2OGRzUVdjWG1GNkR1clY1RTBWa2J3QWNxS2VZSVVlcEJmczBQMXZCK0gKZmZwS3NXWXNvbkVBZUo4aU9qazJnQkxYWWJqa0lvcXFoNXdHaVRPemh3d0FXK2tKbGhlK0ZtdSs2MkxadVhQSwplZktncUdIWGNHakRTcnNYQVgvR1JQb1NpMFZVN3cveVBnaFRHeXRHWWFLVDVSSkUxcTJvRlIyY2FsRkJBSi9jCnVyU2lEdFUxb3dTeVo0Njd4dnh1aUt3KzFEUGNpbllCWVpSNHZoQUdud0huMmZ4RGlpdmVXNGNnUlZTSVBvU24KTU9udlVSdm1lN0N2M0p3TmJkdHpoTWswMjV1UUdGU3pJRDd0aWRPL1hMUndTc0VDVHlsa0xpYzVCYzgvMXllZwpKcmxyRU1hNW8va3hvRGtSWjNQMHhZd29mS3gxMWVlRXA3SmNoaHRmajRzYUNWeEw3aHlmTzVQRTFSWTV2UHVmCjlqcEVGUTNJbDBsMjRRUTU4TWthN0gzZCtSdzNjbk1MYkpTSEE3MUdSOWFqZS9WUVVPcmF5MG1XZnRkVjYrVGEKWlAvdDBrL2pqcWxxUmlxek9ZMDhrMGY4dGptamhzdHgxQ1laaVJQQVhydWlFb1N3UzRGQVV2VHdSeW8wODdJMgprZ3NYbTlGd2NFWkRVbXpsMGxURy8xYk5sSEVsdWx5cVJMd1plUXdMcEF0ZTNFdmpNQzE3TnVCbkZUOFd4bHRjCjhzVGRUczNNSEZNdnZiM3IvaXJjelkwTncvdzd3czhOWkZ1VWxXMm4xTE9iWkNrTUNIaVc2RldPRUFhSmNzbXkKMXlQbEFaMXB0cGJ3b3IxdzAvMTdBb0lCQVFEOEFJMlpvNktMOTRRMGpPYmltcm5yQlRXUW5aSFp4U240L1ZQTQpTQ2hOZ245bHR0QlJxMkYyYXZlU0xHMlRhRjRCUWRjR0tSQTV1ODZPdnp3N2VFWUpkdEsvQnBQRjZFa0hERlR2Ci9EVXBTaGEvZ2JCa3FtUmFESmZGamc5cE1QWmR2Z0VWeHlMWW1zUlliLy9FOFI3dUxlbDA0aXlwQ1UwSVNsMmMKZlVOTGZXa0NBNGk0Y21kSE1xdEd0bm9LbnNXcVYzVWsybUVRSkpZSTY2UERtcjNLVndvUk1vcVpNUDRwcjE3NQpSSG5rQTZmOWxFVzh0a1VYbnV0Vmk0MW5zOEpoRlpmblFaREtmWGR1VDQxN0dDSGVHa2tXblhpenQ1ejZNdVdtCmhMbFErUDY5UzZpVlNRUU5uS3JaWnVFdUZOVE1ublRTZ1ZPdWZuUkxWWDFjZDRFTEFvSUJBUURaSSt6aWFxenAKRktqdmxaUnlCa3A3aUYrSmpkUDc5QmRmZUswU0pWT3QrRzROVU5RT1BMVXhjdUIxeWVYd3Z2NVhWaWtkOHR4SgpGbVZMcUNNNjlhODFSbkhHNnVOTlNVMW1vRTFWQVgwd2p3ajFoaStuQUdjZWdJcGRpdHpKckJpUDhsZGtWNStyClpIaUM1L1F2SDcrUVphQXVRNnMwZmdoUEk3cXNmWFNucU5TNVcxNEFzYWJNcVBZUHhHcjRQMEJPaEVjZ2R4dFIKRjY1SFB6OXY5clFkOUxtT2JJWTMxOENrTTdtY2ZzRys2Y2tBd3RRVWdGdmVmZ3RTOG4vMGR0Rm1Ca0RUZkF4cApBU2ZENWk2Nkw1Y3g2Qm5VTzFnc2dNUHBMamtzaDVEMXFaK2d5Tldrd2xRbERSTHM2SXVCRVc0dkVuSWMxYVNsCi9BUE95MnBNMWVOUEFvSUJBQkVIeElvR2lmeWxqSlMwbFFIcGJQa2FFQVdtOEcxa0tyTCtBOFRCZDUvTld1aTMKMHhwQjE4TlY5VWMybzIwYjE0YUVPWkRjQTVHelJJRlhJUzN2c2VQLzJMdzZLSkJ1WTBrTHAwM1VvSThheDdESApoZkUzcHJLRE9WcUxnRFVlcnZlazJKUHRNa2lySk92SkhlTGtYSy9DQUkzNm53UUpjZUJHams3K0ZDY3M0WVRXClVrNE14VGdGajVlbXkxYWVaa05keDdmbTNqcG1EcEdwd3haOEJhbC8rbGt4TGphdUhlOFpQL1Rla05JOUFRUmQKR2Qxb0FBRlpweFBQNjQxL2szcFdLRDdqcW5KVXlsWjFIOTJhd3Vjc3BaWFdySXFRdFJZZmpHK1ZkcVNuUHlmeAp6Z0hRdm1waEZSYStJaWVvRnIyQlUrbkovYXJFTnYzRVdFV0FlZ01DZ2dFQVQxVVl6d0E2ZkUzWUN2Q1RjN1ZvCnNRbDZIajk3RzZwcWY2OFBUSG5td01Eck5HSTdsNWdHZXpLRlg0T01SeEVBeTlmbTNkSkZPVTY5WTQ3aWtFQUMKNjJ2NVZidXJvQ2tQNWxiYTZodkpLVnlZNFZ0TlBhNmYvanpvVUpUVFpidENuaFRrYVB5NmtWdjd5NWdEVnRRNgpvUDhBTHViNlBndHQ3YndZRDcwbVNic2RQVHRzZE1Sek5JTG1vNHdYcU9zekMzeTRuOXZrVnhSWDBDQURoVnlWCklmeXZicUdueCs5RHFycGJMaG9CbjBhNjhWUTlOK0JOc0ZSTXZ0bHFkbDZTMHJ1bUk1NUd5blpwbU9FWVlWM1IKMTZIOURkVkF1Y0d4MGhmWk83T3IrcFVtaFEvYlBuN2hUMGdmaWY3TU9UT3RGZldmUzNtaTFpSGxJa0NmYmNNWApjUUtDQVFCY25sMFRDVU1JZFhiTW5JRzEwQ29MOW15SFdsMUpqSFYrTDdJOVRRL09rdnV4dUlvSlBSYnBQVURLCmRuQkNXM05ZODZ6c2dMKytJNWIyTFdoWHpTamxBZ1pTRDVySklCenY1Lzh5ekdoNUVaSzUxOXdnL2JDYkpMREUKTFFsUTcrai9CS1VsbG1ySUtENHZva2lyOXJvbkdKblROSjlhU09kdEQ1ZDd1M1ZCZkpkRGltS1J0M3VVcHdabQpCbkxyTFlaS21SVW5aK0k3SGdyd0NPNSs4MTVXNlh1dDlQaGR6NnBwOXJUK2Z5b1VoeTFWK3VpdTJhVDFQbHJTCkhTdUFvdFdBa0lZS2I1ZWlQd1NBeXRvbWdmYnA3R2JBRTRtY1A2d0l1eFhMbkJneVpIbzBhM3FCY3drRnlXYjYKMStBR3cyMFcyaHZnY3dKNDRjTEgySUUyOGR5NAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0tCg==

25
infrastructure/kubernetes/base/secrets/redis-tls-secret.yaml Normal file
View File

@@ -0,0 +1,25 @@
apiVersion: v1
kind: Secret
metadata:
name: redis-tls
namespace: bakery-ia
labels:
app.kubernetes.io/name: bakery-ia
app.kubernetes.io/component: redis-tls
type: Opaque
data:
# Redis TLS certificates (base64 encoded)
# Generated using infrastructure/tls/generate-certificates.sh
# Valid for 3 years from generation date
#
# Certificate details:
# Subject: CN=redis-service.bakery-ia.svc.cluster.local, O=BakeryIA, OU=Cache
# Issuer: CN=BakeryIA-CA, O=BakeryIA, OU=Security
#
# To regenerate:
# 1. Run: infrastructure/tls/generate-certificates.sh
# 2. Run: scripts/create-tls-secrets.sh
ca-cert.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZ5ekNDQTdPZ0F3SUJBZ0lVUGdPcU5ZK1pvS0J5UTFNZk84bGtpR2hPbXhJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2RURUxNQWtHQTFVRUJoTUNWVk14RXpBUkJnTlZCQWdNQ2tOaGJHbG1iM0p1YVdFeEZUQVRCZ05WQkFjTQpERk5oYmtaeVlXNWphWE5qYnpFUk1BOEdBMVVFQ2d3SVFtRnJaWEo1U1VFeEVUQVBCZ05WQkFzTUNGTmxZM1Z5CmFYUjVNUlF3RWdZRFZRUUREQXRDWVd0bGNubEpRUzFEUVRBZUZ3MHlOVEV3TVRneE5ESXlNVFJhRncwek5URXcKTVRZeE5ESXlNVFJhTUhVeEN6QUpCZ05WQkFZVEFsVlRNUk13RVFZRFZRUUlEQXBEWVd4cFptOXlibWxoTVJVdwpFd1lEVlFRSERBeFRZVzVHY21GdVkybHpZMjh4RVRBUEJnTlZCQW9NQ0VKaGEyVnllVWxCTVJFd0R3WURWUVFMCkRBaFRaV04xY21sMGVURVVNQklHQTFVRUF3d0xRbUZyWlhKNVNVRXRRMEV3Z2dJaU1BMEdDU3FHU0liM0RRRUIKQVFVQUE0SUNEd0F3Z2dJS0FvSUNBUURSRDVPMmVna1lnOUhOUlI1U1UwYkxuR0hqcHYvUmFnck03ZGh1c2FXbgpyZkRGNVZwVFo0czkvOXNPRUowTnlqdW9LWGFtb3VUd1IxbncxOUZkSDhmMWVvbWNRNGVLdzJIa3hveHFSMzR0ClJEYUFHejNiV08rcmFUUTRTeU1LN1hGTW92VVVpTGwrR08yM2wxQk5QZmh6a2NEa1o5N200MzRmMVFWbzk5dGIKaFY0YklMYW9GSXFmMDlNMEUxL2ZhQitKQ1I4WWtsN0xvWGd1ejNWUi9CVW5kMHZNc1RNV3VlRC8yblZ1VVpPMAowcFVtVFVCUTJRZDc2NTdrL0hXZC8xd2NFQUw5ZFhOUmJ4aEROZkdnYzNXdFFoZ2djcFlMUWFmTGE4MXRseHljCndEZ042UGRFbFVseGdYL091b1oxeWxNWkU3eHBzTXRwbjFBd2VvZFZibTNRcDVBMXlkeWJFNjF1MXVyWXoxTHQKV05aOWVPZkFxZXdpWVFIVlpXTUM0YTRTYSsyeU02cTVQWC80ZytUYklUaDhoWkp3WFBLNUVEaWc3dkYxNEpQbApsRVJOcHdpYTNuNmEwUDcwM0hQTjZya1FPNWtWVGRpVXNmaWJNdGNVSkhMeVdXUUFSQm15ZVZma0lDYWFlWUVsCkVMa3N3YTlOVkVTS3ZRYUhLU2lIWkZoRUkwYUF2Y3BBam0xRU9oRWEraFNSaE9vRnlVT3ZHK2NNT2ZjQlNtTDAKVW1sRC9sZmFuVFQwems1YXFzcEVrWEdlQnczMXJtWi8wQVpPalYycHBSeFdXZWt6bzlCZjdnNmVMVFk0VUNDNQpNeVB0em14OVRiWHJOQW5YaGlGNkxnNWgyOFI0MkdUZTVBZDZUSGtGOVMvS2hxOHUwZFk1U0EyR1VGMUViUU84Ckt3SURBUUFCbzFNd1VUQWRCZ05WSFE0RUZnUVVBKzZxL2tjOGZUUVUxRURxekdSZktRcHE2bTB3SHdZRFZSMGoKQkJnd0ZvQVVBKzZxL2tjOGZUUVUxRURxekdSZktRcHE2bTB3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFOQmdrcQpoa2lHOXcwQkFRc0ZBQU9DQWdFQVF1dkZoMitIUUZ5OFZUY1VnYWxFVmlheXQxelFHdjRySVNtaXEzRzZJZVhQClhTNGd3cUhrRnpUd1p2bW9oVHdtT0N3Vy94RjRLZ3htRmJ5V05yRUpKRXFjYmVkcVVXVi8wQkNhRm1KdlVkZEkKK2V4L2lEM0ZlYnU4QUZJK0o4bEJIL0NlbkRpU0xIaGd5c2VZOHV3Um5Yc3NoWDVSbkRpckYxdUtyMUo2MzVhbgpHbHlGSU5Vcm5RbGd1RXZ0cjBlbkdVbHpUNXJXajR5MEFXVWRiWGk4dlJzaldvUThKYTBCeFRyWVloL2tPL0ZJClB0cVg3d3N4b0pNREVRNzF6aHdhN1dMUWMyZGZiMnJBcjF1QmgzcU53aVZCSU5CK3QzSkZ2NzJ4cXNXZ3VySUIKSWYyc29SVEkybk1lNWdURzFEZmQrVjI0amZhL3lJZ0FzTWpDem1HUUsyMHZvYlg0c0FWbm1QVmJaZzlTTEZaaQpNaWRrbjlPOVU2OE1FT2UzSWFzY2xkN2ZwNUprK0hyYkpVNi9zMTZFRVIvQWdEM09vajN3UmdqVENTK0FERCtqCnhvMk84Vlgya1BvMDNBTitpWWEzbkptbE1GekNyelQrOFp4U25QNUZxR2cyRUNFYnFxQTBCLzVuYVZwbWRZYVYKNDFvRkxzd2NGbTJpcUdhd2JzTE45eDN0dklDdUU5M0hZazFqNzJQelhhaVNMdHB2YW1IMWRSWUMrSFVNMUwwTwo0OUNOTVlKZUwvTmx5UXVaSm0yWDBxRE5TWG1STUw4SFU5c093V1g2cFBQSk96dXF0Z2R4Lytsa0dBZDJ3WkpVCklWYm1MNlF2emRidGEvY1NWd3NMdEJ6RzQ4YTFiNEtCYzdXTEhUd2JyZEJSVGcwVGtMWTRrdkNaZTVuTmw0RT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
redis-cert.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUdjekNDQkZ1Z0F3SUJBZ0lVRytCME0ycnhucWpHZHRmbzBCaGV2S0N4MGY4d0RRWUpLb1pJaHZjTkFRRUwKQlFBd2RURUxNQWtHQTFVRUJoTUNWVk14RXpBUkJnTlZCQWdNQ2tOaGJHbG1iM0p1YVdFeEZUQVRCZ05WQkFjTQpERk5oYmtaeVlXNWphWE5qYnpFUk1BOEdBMVVFQ2d3SVFtRnJaWEo1U1VFeEVUQVBCZ05WQkFzTUNGTmxZM1Z5CmFYUjVNUlF3RWdZRFZRUUREQXRDWVd0bGNubEpRUzFEUVRBZUZ3MHlOVEV3TVRneE5ESXlNVFJhRncweU9ERXcKTVRjeE5ESXlNVFJhTUlHUU1Rc3dDUVlEVlFRR0V3SlZVekVUTUJFR0ExVUVDQXdLUTJGc2FXWnZjbTVwWVRFVgpNQk1HQTFVRUJ3d01VMkZ1Um5KaGJtTnBjMk52TVJFd0R3WURWUVFLREFoQ1lXdGxjbmxKUVRFT01Bd0dBMVVFCkN3d0ZRMkZqYUdVeE1qQXdCZ05WQkFNTUtYSmxaR2x6TFhObGNuWnBZMlV1WW1GclpYSjVMV2xoTG5OMll5NWoKYkhWemRHVnlMbXh2WTJGc01JSUNJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBZzhBTUlJQ0NnS0NBZ0VBdnNhMgo1MUdFR0VuaW81NHUxdGtNeFNCTGQ4Mm9ML3VsYWIxYXdxREJqcUJkVUFpZzJsMWpScFFyNUxHNVh3UzVoNzM5ClkrdnlQbFpWZW16dVRiNmszbjhPckxNcnUvUFBSRytpUWc3cXlUR1orYmF3YWY2YVhFZUNLOEExWW5xSy9ONEsKQTFIUkxXRXNXRzBKQ2VZakZPZnFzempWTEtydFJhSDd6S2lBREZxREJCbXhScWsvUDJvSjZmK1hXaWpwNE5KdQpPaVdoQmNoYmpjRi9mTTZ2MGVsQlMvOGs1cHVpOGtFdWRNZWExSVFLNXFTSll3TjZZNXRNT3BKcm1IdTFFN05vCkJRZWduakJvMWJaUkFkMWgrL2NxOHAwWWt3amE5dTJnSk5jczMxcWY4MUFtNitxNklXMExqTHFUMnlINVU1aW8KS2hTa0FuczNwcUFPNFZrSWRuM3l0Y2tkK00wQmNNcTRKQm5iYk0vZ1ZPV3I1RXorSERKOWsyckFSbzBWWFB5cQpnT1JxMnNXU2N0eVFiV0pPdExOUWVVbUN0dXZ4d0RyVVNoQWlYZGhhM3ptejdYOWJiNCtWUXA2elJaM3h2bXBnCnFFeG1Pc05zMDBMak9sMHBsalVmR0ZBR2Rmb21JSXpSWmxnVkN6TVVsWkQ0cGNQVnNhSGJuR1ovNi9ZbXhNZGUKOUxjbjRrYmlrNjVmZEFJbnhmVFAySU1NZER3TUZkYkZpcy9SbDIwZWo3QUJ0YTNLdVhvZFluMXkwbitYTFIyTAo3YWJUcW9xSXRnUW1BY2lITlBVYWNnREMvbFBRSk95ckRaVTloQ3NMdDJJVVZKTUN6U2QzR3JDQzA4d2dSb2U1CjZRNUh0NEUyWG5kV3NlWWZxVnRRM2c4WktDaVUrUU1JQmt4SzdHOENBd0VBQWFPQjNqQ0IyekFMQmdOVkhROEUKQkFNQ0JEQXdIUVlEVlIwbEJCWXdGQVlJS3dZQkJRVUhBd0VHQ0NzR0FRVUZCd01DTUcwR0ExVWRFUVJtTUdTQwpLWEpsWkdsekxYTmxjblpwWTJVdVltRnJaWEo1TFdsaExuTjJZeTVqYkhWemRHVnlMbXh2WTJGc2doZHlaV1JwCmN5MXpaWEoyYVdObExtSmhhMlZ5ZVMxcFlZSU5jbVZrYVhNdGMyVnlkbWxqWllJSmJHOWpZV3hvYjNOMGh3Ui8KQUFBQk1CMEdBMVVkRGdRV0JCU2RJV1V6Q2gvNE9SZmJLR2JYTVJ2eXhXTFdyekFmQmdOVkhTTUVHREFXZ0JRRAo3cXIrUnp4OU5CVFVRT3JNWkY4cENtcnFiVEFOQmdrcWhraUc5dzBCQVFzRkFBT0NBZ0VBaEd2cFBSSlpqQkZpCnBaNDNVaFVGTGFIeCtRMHZncy96eXlxVzVqSys3ZWZwY3Z0Sk9CbXVrRUtMaXUwWGFrZit5VDhWRlp4R2tzZkYKcVZyL1Vvb2x3bTVEamlHOE9FT29PYTJCZTlqb0dTdmI3c0JzZ24wYS9pdElGUnpEUXdadGJQZmdpMGFndkJmTQpxczFCNm9IempBMkdSNmlMUDFXYzg4VXRNWFJwV1c0VnZSclZIallzWHVuM2ZHdGYxR1J3ZndBWFFJNys5YldpClNPQ2hEOWVJNk1xdUNYQmRCQVgvQ3FueGs4aHVia3dXY3NIeVNGQkRMcVFoUHM1dU04bGkzK01QZ3BMWENmYVkKWDYvWnpIM05nSjNEK1BJSDU5WllwaEczenZsRnBHRDRvRzNRMkFvbHhxd01SMytQNmM5SWYxRGZNTW9TZ1YzKwptZnZnUmpONXRuZ0IrL29CaXVtYk00K0VGOGFNUmsxR095V3BmM2VSZkc1NStPVEpsTHNEWE9TQlcrSzFOQ3o0CnlOWVR5c2h3eGpWU1BYcWZhdGVBWnpDNVNqRk1SZHJkSEQxME0wZ2w1L2RYY3AreDVocFFTWTNNK2dNMndXZEkKem83SkJPdDlRMUZRRGdUM2pJVldRNVB0TmhkOW9UOVdkYzBFZEppenlObDN2aTltMi9iSktWcEhPMnltZG5IWQpoUG12UVlWdGZzTWxOdmtzdkRMcFhlbUc3czR2akhmMTJZRVA4VFQ1REpnRDQ2TlZvZTM5S2E0N0lmYVRXdWdOCkZXb1YvUGFqUkl4L0lPL2tPcDROQnBlQjY5TytudVlVVU5jQ3cwZmlsQSttRmdXUWpxRkdQK2ZxV05hSmorcFAKNTByelBOc3hwK3FpdzZGVm9aNTVjY3hFMjdrbnZlWT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
redis-key.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUpRUUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQ1Nzd2dna25BZ0VBQW9JQ0FRQyt4cmJuVVlRWVNlS2oKbmk3VzJRekZJRXQzemFndis2VnB2VnJDb01HT29GMVFDS0RhWFdOR2xDdmtzYmxmQkxtSHZmMWo2L0krVmxWNgpiTzVOdnFUZWZ3NnNzeXU3ODg5RWI2SkNEdXJKTVpuNXRyQnAvcHBjUjRJcndEVmllb3I4M2dvRFVkRXRZU3hZCmJRa0o1aU1VNStxek9OVXNxdTFGb2Z2TXFJQU1Xb01FR2JGR3FUOC9hZ25wLzVkYUtPbmcwbTQ2SmFFRnlGdU4Kd1g5OHpxL1I2VUZML3lUbW02THlRUzUweDVyVWhBcm1wSWxqQTNwam0wdzZrbXVZZTdVVHMyZ0ZCNkNlTUdqVgp0bEVCM1dINzl5cnluUmlUQ05yMjdhQWsxeXpmV3AvelVDYnI2cm9oYlF1TXVwUGJJZmxUbUtncUZLUUNlemVtCm9BN2hXUWgyZmZLMXlSMzR6UUZ3eXJna0dkdHN6K0JVNWF2a1RQNGNNbjJUYXNCR2pSVmMvS3FBNUdyYXhaSnkKM0pCdFlrNjBzMUI1U1lLMjYvSEFPdFJLRUNKZDJGcmZPYlB0ZjF0dmo1VkNuck5GbmZHK2FtQ29UR1k2dzJ6VApRdU02WFNtV05SOFlVQVoxK2lZZ2pORm1XQlVMTXhTVmtQaWx3OVd4b2R1Y1puL3I5aWJFeDE3MHR5ZmlSdUtUCnJsOTBBaWZGOU0vWWd3eDBQQXdWMXNXS3o5R1hiUjZQc0FHMXJjcTVlaDFpZlhMU2Y1Y3RIWXZ0cHRPcWlvaTIKQkNZQnlJYzA5UnB5QU1MK1U5QWs3S3NObFQyRUt3dTNZaFJVa3dMTkozY2FzSUxUekNCR2g3bnBEa2UzZ1RaZQpkMWF4NWgrcFcxRGVEeGtvS0pUNUF3Z0dURXJzYndJREFRQUJBb0lDQUFGdjRtMTlwTFFXSW1TVWRYVXkyZ1liCmNkWVdNTlVqc25iekc5MlVIbXZNODNHb2p2cjJISFdwK2hGVlJyaUdMWlpETFJ4MVBqUTZyRUYrMCtZTUJldm8KZUhEVDdLNit3eFNZanExV3RXMWg0cG9KOFVHVnp3M2JrQW5LVklkSVlGeFA3b2dMTkJDQkhJeThvdHZMT3YvQQorM2ljSTFHY2ZBQm1uRXlmWEUrUTJFOGpRNzJYaFhMSExBbnlNMFAvbU9ZVHBRdy92NlhEMWtTMndoZHJsZEYyCm8xZWM0Qkh6VEMxQ1VScEV3cVY2ZjlFd1NNU21nR1BZVzB1a1VndlZBQTZFN3h5bjY3Z2xWSW9xUHhQM2hKeHUKOFRPTFVXVzh6d0Z3Z0NDbTZrbnpGeVN3WkRWVXV2cmVKUlIxOTFVb1BWdU8yU2dhcUYyZHdLazYvV3hmSWxHQgpoRndkbmN1Q1UwdVV5QXp3VUh2bGlEWndWUFFxaVBMbXFYWEp3WjY5RjUzMEZlVHM4L2hUU0Y1UTAwaUFqTmhlClhRbzhJQjA0U1N2VDdMQno1OVg4Y3M0Mkh5VG80YWZ6bWhLK051OEsvQ0ZxOERMT1orRTFtYnhYRE9DM1ZWVHAKaDFFaXd1a0Z0ekpxRzVRSEJjTTlNNVlTK3EzaUw4YXY2N052M29wTm0vUG5YWkdYenFtVjRzK1FwMDdtSUhiVQpsamFCcWVzNGN4RTZZRUtkS1NOSnJ6Y09EVFNFT2hOYUJXN2RNSFRmay8zbXBpODIyNENBdEVJcmVlZy9Ua2VBCjJLWVBmTzJEd3hYZHZJd1NvajBSM0JDbkdVOWVRKzl2L2c5WVU3SXRyS2UxQjlFZTAxNjNUOC9tbnFlZy9QenEKOFNDSFA3Yk1Zb1gxaUlmbjk3MXhBb0lCQVFEZWE2YlY5blQ1dVJHL21FK2FLd0pFTHdkTzFCQTdwc2RIcnV4UApjSW5Hcjdqa3g1S21KV3gvU3c4RXdRZjR1dThEcjYxcC9QUDZLSTZoSzVtQlJhOUpWeVdVbUhTaFFDb0g5TGhPCk5mMkxtMEVOalZVZkdOb2JHMzhsbmhLd082QnNKS3JxTzc2SW5rc3hrN0htaGZ6emlBbFVtTDF5dFhFb0s2Qm4KM3BHZHNRZzEzYjlnWCt6NXZVcGlEOHI5R0U1Rm56cDhNa1BsTWhqcWsvVmp3VXNKcGluSDhMY1B3aEMyZlM5Zwpac2dYdmt6MVR5R2FZVHU5LytBazBMZzJqMU5kNFY0SmIyR0Fvc1NDRUtGQnJrZVNVMTVLK2YrOEtIdFFtMVVBCjBqaExWQWpUTkx1U3d4elB1VUpEaGF4K3kvRFpRRmJPRG1kQmtRWXFBWFpDL0pKNUFvSUJBUURibEFwTGg3c1QKcjhtbjdFcUxEU0ZyVDlQSitsQnhqL210bWd0QVE0MjhBNXVhMFVzbGJ4NGNid0pzcktlejVldkhjWGdmL1Y4cwpBaTFtNnJLcmFBOWlMaFFXSk1wRkFoOEZvRnlIK0pFN1l6N0F3elY2WXRha1h0ZVlrNVIzSlg0UmRZQ0xSeHpDCkpBY25ZMUZDSWRrRzhWcFZPSkZFVnBnWkNFMGRQTldEdHM5cTRyaUR3NXNodWVHd2RldXdoSytwenhQNmlDUmsKNEdER3hzT0hnUERkNy9vVUxzYm9EaEJCT3lOb0VyL2kvWjVQOHpzc1psR20rY2FnTTJETG1oNkxONUlVaTUzWgptNEdHTi81NEN5Zk5pMUFFUitWazlMOTNzOWNkODJuZnlEMkZ3QXNZdkZRcEFRL2c1ekROZ3NsUHZYeUR6OGo1CnNLQmRzcXdnVG53bkFvSUJBQXkxdUIzbjdIMU1ydy8wd3krN0gzRUlBdkhsT2x3K1JvcjVHdlhiSjNSY0hFT3UKaDluSXI2K0NlWVE3QjVxV0RBeDQ0SDc2L25JZ0dTNXFrR1lMdGwySmhsTThkd1d6NWZMNGNBUEFJQkgzT0R0dgpCUnMyejFmWE5XZlA1WjkrZU1kVlBSTVBnTzdMcE41YlkwSWFDLzlhbWJYazJJYVNpYm5TN0dLakhFMFhqYkdPClQxNVJmUGcwY2VpeW9GWGdLckRkelhqRllvM1pWQVVybVUwdkFYdTJyQktKMWR3bnFjN1R6bjVDd1ZKaUJJSE0KR001Nm1mQmNpOUZ1ditnV1BweFJ3WTdtZDNyalVqbGdlK2FGNy84VGxvTFFVR1hQSm1UUHk0YTFmSlFKWkV1MQphcmFUUWJVNUQrbE4zVEtOc3VDblJZNlcwaDIwRE5jZnFFTmhyWGtDZ2dFQVdIN1FxMkkzdnBaeGNwRWo5ZWpECjJFa2k5VnRDQXBMaE1OdE52NGU2WHRVaGFJTURnMEhHWS9WRmgrRUo4ZEl2ZFlGQXhidkxHS1NFQWQrRFJOdTYKbjNvc3RFUDlsVlJtaGxEOEdmelBJNTA3RkZ0WWVVdk9jQTZkVzZ2WEFUSUdIaWs2Tm1maHFrajA3U1gxQU84OQpWYlArRVN5c04xdWpEeXV1VUtOTTlqbStYTGlsWHMxOS8xaTRJZk5VbXg3TzRXUkpEQWJFakRkMktZYkFGU09kCmNBVWd4L09XVEw0bVJQUDlzQnNtWk9pTVhuS01IYmZiSHEyNkpLU3dWVDUzSXVxeG9FQW96U1FFVHNEUWVUY2QKd3BSc0dsMlRrVjJtc1NxMC95ZzBPbkdzZ2ZSRlJLSGFWWEJOSXZwcVM5bHpJd1VlWXMxaWxXZGZLb1F4SlJBYwpyd0tDQVFCemdWeFZxYTV0T0ZudzhRbWZVWU1lN0RIQ1U0cjNSUzFPTndtR29YSTFSTHp6M0k4U1JHSWJOcFYxCnlJczRnRldXd0l1WG40ekxvMCtZZExwT2prRmg1S2FrMEVya2g3QjUvWm01OWZkR013dWpBMnZpUUdZalJyek8Ka1RTQ1hQZ3JHd0s5QmxqWWZlbFM5cVd1aTl2RHVSaEFXUVpPT0NDeVB0eEVjT3ZyOXFmOUtoT2MweEVFTnRVagp6L01CSDc4NnJwckJFQVhuT0FGRkpibWZ0TFhZeTlSaEFhdTJTTURYMGc5dWRIRE1RTk9Cb1dPN2RoLzVBNXZhCkxMa3BWZ3ZvWWtjU1NjRGFKSUtzb2RQTGNManFYWGQ1MVhOV3BDOWNPWkJaUVM4RXVOMVZmR3JqT0RZOW1SOGIKakNvbUgxUDBGenlQVm1MU2JvV21qRGJzMFNGZQotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0tCg==

11
infrastructure/kubernetes/encryption/encryption-config.yaml Normal file
View File

@@ -0,0 +1,11 @@
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources:
- secrets
providers:
- aescbc:
keys:
- name: key1
secret: 2eAEevJmGb+y0bPzYhc4qCpqUa3r5M5Kduch1b4olHE=
- identity: {}

33
infrastructure/tls/ca/ca-cert.pem Normal file
View File

@@ -0,0 +1,33 @@
-----BEGIN CERTIFICATE-----
MIIFyzCCA7OgAwIBAgIUPgOqNY+ZoKByQ1MfO8lkiGhOmxIwDQYJKoZIhvcNAQEL
BQAwdTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFTATBgNVBAcM
DFNhbkZyYW5jaXNjbzERMA8GA1UECgwIQmFrZXJ5SUExETAPBgNVBAsMCFNlY3Vy
aXR5MRQwEgYDVQQDDAtCYWtlcnlJQS1DQTAeFw0yNTEwMTgxNDIyMTRaFw0zNTEw
MTYxNDIyMTRaMHUxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRUw
EwYDVQQHDAxTYW5GcmFuY2lzY28xETAPBgNVBAoMCEJha2VyeUlBMREwDwYDVQQL
DAhTZWN1cml0eTEUMBIGA1UEAwwLQmFrZXJ5SUEtQ0EwggIiMA0GCSqGSIb3DQEB
AQUAA4ICDwAwggIKAoICAQDRD5O2egkYg9HNRR5SU0bLnGHjpv/RagrM7dhusaWn
rfDF5VpTZ4s9/9sOEJ0NyjuoKXamouTwR1nw19FdH8f1eomcQ4eKw2HkxoxqR34t
RDaAGz3bWO+raTQ4SyMK7XFMovUUiLl+GO23l1BNPfhzkcDkZ97m434f1QVo99tb
hV4bILaoFIqf09M0E1/faB+JCR8Ykl7LoXguz3VR/BUnd0vMsTMWueD/2nVuUZO0
0pUmTUBQ2Qd7657k/HWd/1wcEAL9dXNRbxhDNfGgc3WtQhggcpYLQafLa81tlxyc
wDgN6PdElUlxgX/OuoZ1ylMZE7xpsMtpn1AweodVbm3Qp5A1ydybE61u1urYz1Lt
WNZ9eOfAqewiYQHVZWMC4a4Sa+2yM6q5PX/4g+TbITh8hZJwXPK5EDig7vF14JPl
lERNpwia3n6a0P703HPN6rkQO5kVTdiUsfibMtcUJHLyWWQARBmyeVfkICaaeYEl
ELkswa9NVESKvQaHKSiHZFhEI0aAvcpAjm1EOhEa+hSRhOoFyUOvG+cMOfcBSmL0
UmlD/lfanTT0zk5aqspEkXGeBw31rmZ/0AZOjV2ppRxWWekzo9Bf7g6eLTY4UCC5
MyPtzmx9TbXrNAnXhiF6Lg5h28R42GTe5Ad6THkF9S/Khq8u0dY5SA2GUF1EbQO8
KwIDAQABo1MwUTAdBgNVHQ4EFgQUA+6q/kc8fTQU1EDqzGRfKQpq6m0wHwYDVR0j
BBgwFoAUA+6q/kc8fTQU1EDqzGRfKQpq6m0wDwYDVR0TAQH/BAUwAwEB/zANBgkq
hkiG9w0BAQsFAAOCAgEAQuvFh2+HQFy8VTcUgalEViayt1zQGv4rISmiq3G6IeXP
XS4gwqHkFzTwZvmohTwmOCwW/xF4KgxmFbyWNrEJJEqcbedqUWV/0BCaFmJvUddI
+ex/iD3Febu8AFI+J8lBH/CenDiSLHhgyseY8uwRnXsshX5RnDirF1uKr1J635an
GlyFINUrnQlguEvtr0enGUlzT5rWj4y0AWUdbXi8vRsjWoQ8Ja0BxTrYYh/kO/FI
PtqX7wsxoJMDEQ71zhwa7WLQc2dfb2rAr1uBh3qNwiVBINB+t3JFv72xqsWgurIB
If2soRTI2nMe5gTG1Dfd+V24jfa/yIgAsMjCzmGQK20vobX4sAVnmPVbZg9SLFZi
Midkn9O9U68MEOe3Iascld7fp5Jk+HrbJU6/s16EER/AgD3Ooj3wRgjTCS+ADD+j
xo2O8VX2kPo03AN+iYa3nJmlMFzCrzT+8ZxSnP5FqGg2ECEbqqA0B/5naVpmdYaV
41oFLswcFm2iqGawbsLN9x3tvICuE93HYk1j72PzXaiSLtpvamH1dRYC+HUM1L0O
49CNMYJeL/NlyQuZJm2X0qDNSXmRML8HU9sOwWX6pPPJOzuqtgdx/+lkGAd2wZJU
IVbmL6Qvzdbta/cSVwsLtBzG48a1b4KBc7WLHTwbrdBRTg0TkLY4kvCZe5nNl4E=
-----END CERTIFICATE-----

1
infrastructure/tls/ca/ca-cert.srl Normal file
View File

@@ -0,0 +1 @@
1BE074336AF19EA8C676D7E8D0185EBCA0B1D1FF

52
infrastructure/tls/ca/ca-key.pem Normal file
View File

@@ -0,0 +1,52 @@
-----BEGIN PRIVATE KEY-----
MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDRD5O2egkYg9HN
RR5SU0bLnGHjpv/RagrM7dhusaWnrfDF5VpTZ4s9/9sOEJ0NyjuoKXamouTwR1nw
19FdH8f1eomcQ4eKw2HkxoxqR34tRDaAGz3bWO+raTQ4SyMK7XFMovUUiLl+GO23
l1BNPfhzkcDkZ97m434f1QVo99tbhV4bILaoFIqf09M0E1/faB+JCR8Ykl7LoXgu
z3VR/BUnd0vMsTMWueD/2nVuUZO00pUmTUBQ2Qd7657k/HWd/1wcEAL9dXNRbxhD
NfGgc3WtQhggcpYLQafLa81tlxycwDgN6PdElUlxgX/OuoZ1ylMZE7xpsMtpn1Aw
eodVbm3Qp5A1ydybE61u1urYz1LtWNZ9eOfAqewiYQHVZWMC4a4Sa+2yM6q5PX/4
g+TbITh8hZJwXPK5EDig7vF14JPllERNpwia3n6a0P703HPN6rkQO5kVTdiUsfib
MtcUJHLyWWQARBmyeVfkICaaeYElELkswa9NVESKvQaHKSiHZFhEI0aAvcpAjm1E
OhEa+hSRhOoFyUOvG+cMOfcBSmL0UmlD/lfanTT0zk5aqspEkXGeBw31rmZ/0AZO
jV2ppRxWWekzo9Bf7g6eLTY4UCC5MyPtzmx9TbXrNAnXhiF6Lg5h28R42GTe5Ad6
THkF9S/Khq8u0dY5SA2GUF1EbQO8KwIDAQABAoICABaHUt1U1KAYrHDYuZtuL/CH
H0wKAK1Pe8R4/lwctq5AIfR2x79kfBkn9jIo0NPd7tnV8LGlAijGd5xq6rvZ+JFX
2CEdFyvOluuxXbZM5/2hc9dlmB/dZfkXHYfSHlTyIMXSaw4AbITN05LM3TFwXn1j
FTdH3jm2sC5mpUOaL2rzD0tlwL6SIBzNwIfEbWNvdAkvZh4ev9UPxxoRmcybmVKn
GhBVKXKR1fucTg/0/dwm3pMXELmQTwHSnU0ty3rwPBEmGecNqL9QynuLrPMjyL2X
+W5IYCpBs/70KgSyRmS57hB0V25uQVDYVK6GuTCo/JV05AE7tQqNHstqmM+Nq+BL
ZufWkjBYI2dYH0/3e+Bm9yRypQljiDsmzuvfFgXWTXG8H1erITOZCv+9leT5OwHE
qIWRmWtgDJ5bggUC/nUVHsIxIx6chCJ8Shuxv/X+Oj5qhmL3QvXZvykDUvhiRJ33
goS127MfYjJoPbXeGEHMACS5z0qRuRKR474DsDljQW6QGlKDPNJjm5lh0FwV0d7P
Kg+J9HqX1p0blCULOZMQWddCRSIqD7W9BpDW9aUsjF4XftH9DonM8lXbV0h0edkQ
HDYL/Cf+TaCBHjw/PLtnGdLpx4Em8WTaYM9KohTNCr6DUDQ0Lwjhr0pUrDRs4urD
786SDeXL5G3b3PVYFj8xAoIBAQDzafuco8i2J1DZtr9M1denb3YtLgpAPKIPDyux
0sjJ7KJI8nkq1anZLWH8Bb+gtk9sFpLxD8mGgHemjjsbrhlmIOeIRnwWyqYXCNQV
sr6P/h5Jg7F/fK2fwV3z0QyFT88Pl/WxaYEk1tExiibAN2hg0ad5CRVKpvJLy11U
uX5iO8wSSigHyNH7i6wvNISDUjrRzLta5dyLmTup4wVtcWIeksswixWIICgnosZi
xQ15SiVwnYNl3Or3GkTLVZ6xPRyf/nrsiwsAvbkpv56VUq3DKP+ZotI+TfpZ5n9v
R/iLrYRdGqvCvQJdZRyUkASWqkbs44MIeERHVKO6WfznptMZAoIBAQDb3t5/poBJ
WshTmLLQB7c8GBzAKaWrZNpDfn9jDAG5+F2OilPzO5ffCfQdmo2Vgl6aaOYOaeob
m7pCuzLB9/rDUbzOd+RieD4Hq0mJfo2T00r+JkB59nZ4JYW51aX+0lGre0umWz0Y
hnhy2qBp0H1BNxvA6/KSk3KD+PDLi05uYV9G7Yjmv3X6IT80yVr/XqsY6tsAkZcB
+/qzb301gDYMj05HvPlPQLdDCS2YE3faAR72OTKyEwqdG1mHXSyQWKzXY6EWNfN2
QMJCpFtzEc5y9/INBRs7x1rKfancusON1G4QekjY+ppGCG37uVvnJ4ixZZnDkw38
WiPiJD79IZXjAoIBAD/rovFdaUW8SVUC0nWg6kLD2GrA3lxED+KYf0bxLV0pUOyL
EBqZhULM0iBWeh4AAhdGTkwTcz5o2gLY8tiv/Wd+WI7Gw6tQiBEgdmFEURqLBvUT
KjdqTEXZh4yRZxJTBPL5WsG+DPXZm5HAz7BGXJigNbRpGDhEYvhYbSfkljXBsjNT
WfPBXrMJ2KuExQ+fNmcFtmWGW0YldS+FuFUnIzcYIVecDolyuFjAPAyP5pvlRrOu
CWVkgCdntI0Y7NVqUOwK7cjUMo19RPSbp09bKNpJF+YGheNqosWc6/YTFkfHxyyT
5mr7K3XPKZQxxaKzEHEAxdYhjvyUU3KKUwmaG3ECggEBAJPcYFMF/NXX6EpXsUC3
P6F5MbSFDXWiwCmNo0tPosWW4gveuLAlTm/e+L0D191IrCg5DSV6Usa4Rl1kGLFa
+9doW4maFQung0eTCEQfyEQ2XwNlZAzhEzCfQzwDEru4YtXod6prRz38CHpszl36
qJE350EpK5so72US/5RSna8baoB/c4aCEWvh+eic1MZRusxp/Fd4kU3zT9hlzJUz
IKX3pZQW4K5MfjHltTTFOt9vy4uYUaBxr7yRzPZ8UWDNUYcT6BvQsma/DCTW9O0A
d47XcX8SBQuBeGwecCIRszrpNg98vQq2FROtzZDwSX69Fm7+PZbJiSlA0UreR0Hh
2TMCggEAREXvWcBV0NR1hRigoh3WAokM34XskBfrEv+U3/VmJF63CN/YPSgXu+Fc
qRWhPS1tv4cD2X2ePWm4UCiArI25tlNpHacFmLYbhg4Dvug8stoIEyssGzXSparO
cRpis0xtStBN4vJ9zIIHyRvbCqbOPlZ39EjKuLunvmvVOvr7ytg7GlwFwQr2/i6x
DEyP+1VwRkpiJIsEblEwZhJSboObp0OCCND/Zr8tvO/y0oenN7DVWJQ9ZpBMxCqG
B9wtdGt6LGZXKobZXrFKHty7BeaqcdbS9DCs7pM2Lraoqg73PFfqjqZ9FrVpLO22
bIhGuCSGodEUpQSPEziZ2cyPSczDrw==
-----END PRIVATE KEY-----

204
infrastructure/tls/generate-certificates.sh Executable file
View File

@@ -0,0 +1,204 @@
#!/usr/bin/env bash
# Generate TLS certificates for PostgreSQL and Redis
# Self-signed certificates for internal cluster use
set -e
TLS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
CA_DIR="$TLS_DIR/ca"
POSTGRES_DIR="$TLS_DIR/postgres"
REDIS_DIR="$TLS_DIR/redis"
echo "Generating TLS certificates for Bakery IA..."
echo "Directory: $TLS_DIR"
echo ""
# Clean up old certificates
echo "Cleaning up old certificates..."
rm -rf "$CA_DIR"/* "$POSTGRES_DIR"/* "$REDIS_DIR"/* 2>/dev/null || true
# =====================================
# 1. Generate Certificate Authority (CA)
# =====================================
echo "Step 1: Generating Certificate Authority (CA)..."
# Generate CA private key
openssl genrsa -out "$CA_DIR/ca-key.pem" 4096
# Generate CA certificate (valid for 10 years)
openssl req -new -x509 -days 3650 -key "$CA_DIR/ca-key.pem" -out "$CA_DIR/ca-cert.pem" \
-subj "/C=US/ST=California/L=SanFrancisco/O=BakeryIA/OU=Security/CN=BakeryIA-CA"
echo "✓ CA certificate generated"
echo ""
# =====================================
# 2. Generate PostgreSQL Server Certificates
# =====================================
echo "Step 2: Generating PostgreSQL server certificates..."
# Generate PostgreSQL server private key
openssl genrsa -out "$POSTGRES_DIR/server-key.pem" 4096
# Create certificate signing request (CSR)
openssl req -new -key "$POSTGRES_DIR/server-key.pem" -out "$POSTGRES_DIR/server.csr" \
-subj "/C=US/ST=California/L=SanFrancisco/O=BakeryIA/OU=Database/CN=*.bakery-ia.svc.cluster.local"
# Create SAN (Subject Alternative Names) configuration
cat > "$POSTGRES_DIR/san.cnf" <<EOF
[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no
[req_distinguished_name]
C = US
ST = California
L = SanFrancisco
O = BakeryIA
OU = Database
CN = *.bakery-ia.svc.cluster.local
[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = *.bakery-ia.svc.cluster.local
DNS.2 = *.bakery-ia
DNS.3 = auth-db-service
DNS.4 = tenant-db-service
DNS.5 = training-db-service
DNS.6 = forecasting-db-service
DNS.7 = sales-db-service
DNS.8 = external-db-service
DNS.9 = notification-db-service
DNS.10 = inventory-db-service
DNS.11 = recipes-db-service
DNS.12 = suppliers-db-service
DNS.13 = pos-db-service
DNS.14 = orders-db-service
DNS.15 = production-db-service
DNS.16 = alert-processor-db-service
DNS.17 = localhost
IP.1 = 127.0.0.1
EOF
# Sign the certificate with CA (valid for 3 years)
openssl x509 -req -in "$POSTGRES_DIR/server.csr" \
-CA "$CA_DIR/ca-cert.pem" -CAkey "$CA_DIR/ca-key.pem" -CAcreateserial \
-out "$POSTGRES_DIR/server-cert.pem" -days 1095 \
-extensions v3_req -extfile "$POSTGRES_DIR/san.cnf"
# PostgreSQL requires specific permissions on key file
chmod 600 "$POSTGRES_DIR/server-key.pem"
chmod 644 "$POSTGRES_DIR/server-cert.pem"
# Copy CA cert for PostgreSQL clients
cp "$CA_DIR/ca-cert.pem" "$POSTGRES_DIR/ca-cert.pem"
echo "✓ PostgreSQL certificates generated"
echo ""
# =====================================
# 3. Generate Redis Server Certificates
# =====================================
echo "Step 3: Generating Redis server certificates..."
# Generate Redis server private key
openssl genrsa -out "$REDIS_DIR/redis-key.pem" 4096
# Create certificate signing request (CSR)
openssl req -new -key "$REDIS_DIR/redis-key.pem" -out "$REDIS_DIR/redis.csr" \
-subj "/C=US/ST=California/L=SanFrancisco/O=BakeryIA/OU=Cache/CN=redis-service.bakery-ia.svc.cluster.local"
# Create SAN configuration for Redis
cat > "$REDIS_DIR/san.cnf" <<EOF
[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no
[req_distinguished_name]
C = US
ST = California
L = SanFrancisco
O = BakeryIA
OU = Cache
CN = redis-service.bakery-ia.svc.cluster.local
[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = redis-service.bakery-ia.svc.cluster.local
DNS.2 = redis-service.bakery-ia
DNS.3 = redis-service
DNS.4 = localhost
IP.1 = 127.0.0.1
EOF
# Sign the certificate with CA (valid for 3 years)
openssl x509 -req -in "$REDIS_DIR/redis.csr" \
-CA "$CA_DIR/ca-cert.pem" -CAkey "$CA_DIR/ca-key.pem" -CAcreateserial \
-out "$REDIS_DIR/redis-cert.pem" -days 1095 \
-extensions v3_req -extfile "$REDIS_DIR/san.cnf"
# Redis requires specific permissions
chmod 600 "$REDIS_DIR/redis-key.pem"
chmod 644 "$REDIS_DIR/redis-cert.pem"
# Copy CA cert for Redis clients
cp "$CA_DIR/ca-cert.pem" "$REDIS_DIR/ca-cert.pem"
echo "✓ Redis certificates generated"
echo ""
# =====================================
# 4. Verify Certificates
# =====================================
echo "Step 4: Verifying certificates..."
# Verify PostgreSQL certificate
echo "PostgreSQL certificate details:"
openssl x509 -in "$POSTGRES_DIR/server-cert.pem" -noout -subject -issuer -dates
openssl verify -CAfile "$CA_DIR/ca-cert.pem" "$POSTGRES_DIR/server-cert.pem"
echo ""
echo "Redis certificate details:"
openssl x509 -in "$REDIS_DIR/redis-cert.pem" -noout -subject -issuer -dates
openssl verify -CAfile "$CA_DIR/ca-cert.pem" "$REDIS_DIR/redis-cert.pem"
echo ""
echo "===================="
echo "✓ All certificates generated successfully!"
echo ""
echo "Generated files:"
echo " CA:"
echo " - $CA_DIR/ca-cert.pem (Certificate Authority certificate)"
echo " - $CA_DIR/ca-key.pem (CA private key - keep secure!)"
echo ""
echo " PostgreSQL:"
echo " - $POSTGRES_DIR/server-cert.pem (Server certificate)"
echo " - $POSTGRES_DIR/server-key.pem (Server private key)"
echo " - $POSTGRES_DIR/ca-cert.pem (CA certificate for clients)"
echo ""
echo " Redis:"
echo " - $REDIS_DIR/redis-cert.pem (Server certificate)"
echo " - $REDIS_DIR/redis-key.pem (Server private key)"
echo " - $REDIS_DIR/ca-cert.pem (CA certificate for clients)"
echo ""
echo "Certificate validity: 3 years"
echo "Next steps:"
echo " 1. Create Kubernetes secrets from these certificates"
echo " 2. Mount secrets in database pods"
echo " 3. Configure PostgreSQL and Redis to use TLS"
echo " 4. Update client connection strings to require SSL"

33
infrastructure/tls/postgres/ca-cert.pem Normal file
View File

@@ -0,0 +1,33 @@
-----BEGIN CERTIFICATE-----
MIIFyzCCA7OgAwIBAgIUPgOqNY+ZoKByQ1MfO8lkiGhOmxIwDQYJKoZIhvcNAQEL
BQAwdTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFTATBgNVBAcM
DFNhbkZyYW5jaXNjbzERMA8GA1UECgwIQmFrZXJ5SUExETAPBgNVBAsMCFNlY3Vy
aXR5MRQwEgYDVQQDDAtCYWtlcnlJQS1DQTAeFw0yNTEwMTgxNDIyMTRaFw0zNTEw
MTYxNDIyMTRaMHUxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRUw
EwYDVQQHDAxTYW5GcmFuY2lzY28xETAPBgNVBAoMCEJha2VyeUlBMREwDwYDVQQL
DAhTZWN1cml0eTEUMBIGA1UEAwwLQmFrZXJ5SUEtQ0EwggIiMA0GCSqGSIb3DQEB
AQUAA4ICDwAwggIKAoICAQDRD5O2egkYg9HNRR5SU0bLnGHjpv/RagrM7dhusaWn
rfDF5VpTZ4s9/9sOEJ0NyjuoKXamouTwR1nw19FdH8f1eomcQ4eKw2HkxoxqR34t
RDaAGz3bWO+raTQ4SyMK7XFMovUUiLl+GO23l1BNPfhzkcDkZ97m434f1QVo99tb
hV4bILaoFIqf09M0E1/faB+JCR8Ykl7LoXguz3VR/BUnd0vMsTMWueD/2nVuUZO0
0pUmTUBQ2Qd7657k/HWd/1wcEAL9dXNRbxhDNfGgc3WtQhggcpYLQafLa81tlxyc
wDgN6PdElUlxgX/OuoZ1ylMZE7xpsMtpn1AweodVbm3Qp5A1ydybE61u1urYz1Lt
WNZ9eOfAqewiYQHVZWMC4a4Sa+2yM6q5PX/4g+TbITh8hZJwXPK5EDig7vF14JPl
lERNpwia3n6a0P703HPN6rkQO5kVTdiUsfibMtcUJHLyWWQARBmyeVfkICaaeYEl
ELkswa9NVESKvQaHKSiHZFhEI0aAvcpAjm1EOhEa+hSRhOoFyUOvG+cMOfcBSmL0
UmlD/lfanTT0zk5aqspEkXGeBw31rmZ/0AZOjV2ppRxWWekzo9Bf7g6eLTY4UCC5
MyPtzmx9TbXrNAnXhiF6Lg5h28R42GTe5Ad6THkF9S/Khq8u0dY5SA2GUF1EbQO8
KwIDAQABo1MwUTAdBgNVHQ4EFgQUA+6q/kc8fTQU1EDqzGRfKQpq6m0wHwYDVR0j
BBgwFoAUA+6q/kc8fTQU1EDqzGRfKQpq6m0wDwYDVR0TAQH/BAUwAwEB/zANBgkq
hkiG9w0BAQsFAAOCAgEAQuvFh2+HQFy8VTcUgalEViayt1zQGv4rISmiq3G6IeXP
XS4gwqHkFzTwZvmohTwmOCwW/xF4KgxmFbyWNrEJJEqcbedqUWV/0BCaFmJvUddI
+ex/iD3Febu8AFI+J8lBH/CenDiSLHhgyseY8uwRnXsshX5RnDirF1uKr1J635an
GlyFINUrnQlguEvtr0enGUlzT5rWj4y0AWUdbXi8vRsjWoQ8Ja0BxTrYYh/kO/FI
PtqX7wsxoJMDEQ71zhwa7WLQc2dfb2rAr1uBh3qNwiVBINB+t3JFv72xqsWgurIB
If2soRTI2nMe5gTG1Dfd+V24jfa/yIgAsMjCzmGQK20vobX4sAVnmPVbZg9SLFZi
Midkn9O9U68MEOe3Iascld7fp5Jk+HrbJU6/s16EER/AgD3Ooj3wRgjTCS+ADD+j
xo2O8VX2kPo03AN+iYa3nJmlMFzCrzT+8ZxSnP5FqGg2ECEbqqA0B/5naVpmdYaV
41oFLswcFm2iqGawbsLN9x3tvICuE93HYk1j72PzXaiSLtpvamH1dRYC+HUM1L0O
49CNMYJeL/NlyQuZJm2X0qDNSXmRML8HU9sOwWX6pPPJOzuqtgdx/+lkGAd2wZJU
IVbmL6Qvzdbta/cSVwsLtBzG48a1b4KBc7WLHTwbrdBRTg0TkLY4kvCZe5nNl4E=
-----END CERTIFICATE-----

37
infrastructure/tls/postgres/san.cnf Normal file
View File

@@ -0,0 +1,37 @@
[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no
[req_distinguished_name]
C = US
ST = California
L = SanFrancisco
O = BakeryIA
OU = Database
CN = *.bakery-ia.svc.cluster.local
[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = *.bakery-ia.svc.cluster.local
DNS.2 = *.bakery-ia
DNS.3 = auth-db-service
DNS.4 = tenant-db-service
DNS.5 = training-db-service
DNS.6 = forecasting-db-service
DNS.7 = sales-db-service
DNS.8 = external-db-service
DNS.9 = notification-db-service
DNS.10 = inventory-db-service
DNS.11 = recipes-db-service
DNS.12 = suppliers-db-service
DNS.13 = pos-db-service
DNS.14 = orders-db-service
DNS.15 = production-db-service
DNS.16 = alert-processor-db-service
DNS.17 = localhost
IP.1 = 127.0.0.1

42
infrastructure/tls/postgres/server-cert.pem Normal file
View File

@@ -0,0 +1,42 @@
-----BEGIN CERTIFICATE-----
MIIHcjCCBVqgAwIBAgIUG+B0M2rxnqjGdtfo0BhevKCx0f4wDQYJKoZIhvcNAQEL
BQAwdTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFTATBgNVBAcM
DFNhbkZyYW5jaXNjbzERMA8GA1UECgwIQmFrZXJ5SUExETAPBgNVBAsMCFNlY3Vy
aXR5MRQwEgYDVQQDDAtCYWtlcnlJQS1DQTAeFw0yNTEwMTgxNDIyMTRaFw0yODEw
MTcxNDIyMTRaMIGHMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEV
MBMGA1UEBwwMU2FuRnJhbmNpc2NvMREwDwYDVQQKDAhCYWtlcnlJQTERMA8GA1UE
CwwIRGF0YWJhc2UxJjAkBgNVBAMMHSouYmFrZXJ5LWlhLnN2Yy5jbHVzdGVyLmxv
Y2FsMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA1b/VSfu/PMvYorbL
295V2ZAGRRNWupHH3K9xDAPm45TudgPWLxnyA9HVz5jmKgWHQKVrSI046uLuEYA+
Rmth7FEVCLt9i5ifhaXmAfSouG91nC2NCshmEhXtZBJX0omaNhiDDotx78kjKaLR
A22mQoCcPvkzEqOECpiVFU9UHB3C5unmtHSC48bB+ARyiE2z7RraG1YEKkiljilF
mJTS6N36BqabF6AxqSpIanoEgFgWC6aIXtA+fo3Ez1mJEFwfzQBWcKt/ON3nx3xD
bRNsmorxHpsPinOA4hHVw7TcU4LqqURYddNocmbkKiVXJZEFgLengB1lm/lAYWqZ
QdPbT1UcCfQLvSt6lVk+VB06eZ4ZKfi/koflFP0f+2SB2hQ6aj97G/RbrkCGaIFX
Cx5d69AoqSwuExtX/Qm1UK0O2xpLv35KdScy+Z1IFOcYzcXq28fxmu+TDDNySScK
lsbjwfu4EGKGLsktGvTAGH1EyKvKksqx0Ex9s/8vAi/2T4+FC1Bl25B5fzDED5Dp
KHtJatxwjWiiDlayrk8Wg03RyFSf5n4F7Rbp3+oFmsSSnEEZ+RCOnCgqCZY1Ms9r
FT9fz7hAs2+XPepu0vwFKBUwlxiWdDzH6sDIQCeS3xS243vyiatEu6K8C7x0eWls
59IBQqv5x2TbFtTwDXgb+SJ0k2UCAwEAAaOCAeUwggHhMAsGA1UdDwQEAwIEMDAd
BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwggFxBgNVHREEggFoMIIBZIId
Ki5iYWtlcnktaWEuc3ZjLmNsdXN0ZXIubG9jYWyCCyouYmFrZXJ5LWlhgg9hdXRo
LWRiLXNlcnZpY2WCEXRlbmFudC1kYi1zZXJ2aWNlghN0cmFpbmluZy1kYi1zZXJ2
aWNlghZmb3JlY2FzdGluZy1kYi1zZXJ2aWNlghBzYWxlcy1kYi1zZXJ2aWNlghNl
eHRlcm5hbC1kYi1zZXJ2aWNlghdub3RpZmljYXRpb24tZGItc2VydmljZYIUaW52
ZW50b3J5LWRiLXNlcnZpY2WCEnJlY2lwZXMtZGItc2VydmljZYIUc3VwcGxpZXJz
LWRiLXNlcnZpY2WCDnBvcy1kYi1zZXJ2aWNlghFvcmRlcnMtZGItc2VydmljZYIV
cHJvZHVjdGlvbi1kYi1zZXJ2aWNlghphbGVydC1wcm9jZXNzb3ItZGItc2Vydmlj
ZYIJbG9jYWxob3N0hwR/AAABMB0GA1UdDgQWBBR+ZyMAMCMyCv50MJTcHSw13VV9
3TAfBgNVHSMEGDAWgBQD7qr+Rzx9NBTUQOrMZF8pCmrqbTANBgkqhkiG9w0BAQsF
AAOCAgEAC7WCN3aJw4vT3Nr5fWqjkzxcl+spTRyBDEbJZYp3HdK3QOixhTd0B3bF
FzWSIX79Gvvs/rj8SZDXP3BdsSpoIxTJf+inzPm8hPRo2cuSNjO9yhf1u1AByb2g
eWm2L58dLLIYngcsl/AaThifOuKfVc7kX5F5+ppHlWE4INGaOKl2ZqBLpOm+4nXp
78iBAtfHKVLmMBkIDsYgX9EDU4gYYerSEuY3Tac94ea9nEcGpvHDhGRbNRS46Fl/
O3Vj18OS+KddMerAueNjvop5vsK0T6MCelLOhlrtoMeNHEcwzkBLwjvDo2GWaHmO
SyJNwSEAjlyU1rra0TXtpyMg6/cnWbr9gKhrnf+O0CMGLuV08FiPCwa6/qmPaiKA
i0+6TbusbFLGkeWCPK3jyZFalSZnWPH5dLJEwuSYe9SFxZVZSHSMWn0ytv5HuZNj
ZInxvbjj6S+a5SeRc5pvjJ5VMDkkQJ34mBl22noyBip8cruQgA7yzHn9sycbAyTk
YgNXJHnb4QmutrbM7zbqkGPNFXEByyVaY/m7ZrlE3oG4GRlNssmKyUgvLPxUmgYK
p4X5xDhRQl4MV49//A5F6+qS6ur+B+p9xHoLJfoBRTSW+S6Pubb4wQH49zp3Nmm9
94aThjKHK8TiMbJA+bQ/kF2OnJYunkucYjYzNvjWwf1S/reBg2E=
-----END CERTIFICATE-----

52
infrastructure/tls/postgres/server-key.pem Normal file
View File

@@ -0,0 +1,52 @@
-----BEGIN PRIVATE KEY-----
MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQDVv9VJ+788y9ii
tsvb3lXZkAZFE1a6kcfcr3EMA+bjlO52A9YvGfID0dXPmOYqBYdApWtIjTjq4u4R
gD5Ga2HsURUIu32LmJ+FpeYB9Ki4b3WcLY0KyGYSFe1kElfSiZo2GIMOi3HvySMp
otEDbaZCgJw++TMSo4QKmJUVT1QcHcLm6ea0dILjxsH4BHKITbPtGtobVgQqSKWO
KUWYlNLo3foGppsXoDGpKkhqegSAWBYLpohe0D5+jcTPWYkQXB/NAFZwq3843efH
fENtE2yaivEemw+Kc4DiEdXDtNxTguqpRFh102hyZuQqJVclkQWAt6eAHWWb+UBh
aplB09tPVRwJ9Au9K3qVWT5UHTp5nhkp+L+Sh+UU/R/7ZIHaFDpqP3sb9FuuQIZo
gVcLHl3r0CipLC4TG1f9CbVQrQ7bGku/fkp1JzL5nUgU5xjNxerbx/Ga75MMM3JJ
JwqWxuPB+7gQYoYuyS0a9MAYfUTIq8qSyrHQTH2z/y8CL/ZPj4ULUGXbkHl/MMQP
kOkoe0lq3HCNaKIOVrKuTxaDTdHIVJ/mfgXtFunf6gWaxJKcQRn5EI6cKCoJljUy
z2sVP1/PuECzb5c96m7S/AUoFTCXGJZ0PMfqwMhAJ5LfFLbje/KJq0S7orwLvHR5
aWzn0gFCq/nHZNsW1PANeBv5InSTZQIDAQABAoICAAXpngfuCklaEX6CvvCF3cBn
Dv1XKRrVEH8RbUzvSLI6kD68dsQWcXmF6DurV5E0VkbwAcqKeYIUepBfs0P1vB+H
ffpKsWYsonEAeJ8iOjk2gBLXYbjkIoqqh5wGiTOzhwwAW+kJlhe+Fmu+62LZuXPK
efKgqGHXcGjDSrsXAX/GRPoSi0VU7w/yPghTGytGYaKT5RJE1q2oFR2calFBAJ/c
urSiDtU1owSyZ467xvxuiKw+1DPcinYBYZR4vhAGnwHn2fxDiiveW4cgRVSIPoSn
MOnvURvme7Cv3JwNbdtzhMk025uQGFSzID7tidO/XLRwSsECTylkLic5Bc8/1yeg
JrlrEMa5o/kxoDkRZ3P0xYwofKx11eeEp7Jchhtfj4saCVxL7hyfO5PE1RY5vPuf
9jpEFQ3Il0l24QQ58Mka7H3d+Rw3cnMLbJSHA71GR9aje/VQUOray0mWftdV6+Ta
ZP/t0k/jjqlqRiqzOY08k0f8tjmjhstx1CYZiRPAXruiEoSwS4FAUvTwRyo087I2
kgsXm9FwcEZDUmzl0lTG/1bNlHElulyqRLwZeQwLpAte3EvjMC17NuBnFT8Wxltc
8sTdTs3MHFMvvb3r/irczY0Nw/w7ws8NZFuUlW2n1LObZCkMCHiW6FWOEAaJcsmy
1yPlAZ1ptpbwor1w0/17AoIBAQD8AI2Zo6KL94Q0jObimrnrBTWQnZHZxSn4/VPM
SChNgn9lttBRq2F2aveSLG2TaF4BQdcGKRA5u86Ovzw7eEYJdtK/BpPF6EkHDFTv
/DUpSha/gbBkqmRaDJfFjg9pMPZdvgEVxyLYmsRYb//E8R7uLel04iypCU0ISl2c
fUNLfWkCA4i4cmdHMqtGtnoKnsWqV3Uk2mEQJJYI66PDmr3KVwoRMoqZMP4pr175
RHnkA6f9lEW8tkUXnutVi41ns8JhFZfnQZDKfXduT417GCHeGkkWnXizt5z6MuWm
hLlQ+P69S6iVSQQNnKrZZuEuFNTMnnTSgVOufnRLVX1cd4ELAoIBAQDZI+ziaqzp
FKjvlZRyBkp7iF+JjdP79BdfeK0SJVOt+G4NUNQOPLUxcuB1yeXwvv5XVikd8txJ
FmVLqCM69a81RnHG6uNNSU1moE1VAX0wjwj1hi+nAGcegIpditzJrBiP8ldkV5+r
ZHiC5/QvH7+QZaAuQ6s0fghPI7qsfXSnqNS5W14AsabMqPYPxGr4P0BOhEcgdxtR
F65HPz9v9rQd9LmObIY318CkM7mcfsG+6ckAwtQUgFvefgtS8n/0dtFmBkDTfAxp
ASfD5i66L5cx6BnUO1gsgMPpLjksh5D1qZ+gyNWkwlQlDRLs6IuBEW4vEnIc1aSl
/APOy2pM1eNPAoIBABEHxIoGifyljJS0lQHpbPkaEAWm8G1kKrL+A8TBd5/NWui3
0xpB18NV9Uc2o20b14aEOZDcA5GzRIFXIS3vseP/2Lw6KJBuY0kLp03UoI8ax7DH
hfE3prKDOVqLgDUervek2JPtMkirJOvJHeLkXK/CAI36nwQJceBGjk7+FCcs4YTW
Uk4MxTgFj5emy1aeZkNdx7fm3jpmDpGpwxZ8Bal/+lkxLjauHe8ZP/TekNI9AQRd
Gd1oAAFZpxPP641/k3pWKD7jqnJUylZ1H92awucspZXWrIqQtRYfjG+VdqSnPyfx
zgHQvmphFRa+IieoFr2BU+nJ/arENv3EWEWAegMCggEAT1UYzwA6fE3YCvCTc7Vo
sQl6Hj97G6pqf68PTHnmwMDrNGI7l5gGezKFX4OMRxEAy9fm3dJFOU69Y47ikEAC
62v5VburoCkP5lba6hvJKVyY4VtNPa6f/jzoUJTTZbtCnhTkaPy6kVv7y5gDVtQ6
oP8ALub6Pgtt7bwYD70mSbsdPTtsdMRzNILmo4wXqOszC3y4n9vkVxRX0CADhVyV
IfyvbqGnx+9DqrpbLhoBn0a68VQ9N+BNsFRMvtlqdl6S0rumI55GynZpmOEYYV3R
16H9DdVAucGx0hfZO7Or+pUmhQ/bPn7hT0gfif7MOTOtFfWfS3mi1iHlIkCfbcMX
cQKCAQBcnl0TCUMIdXbMnIG10CoL9myHWl1JjHV+L7I9TQ/OkvuxuIoJPRbpPUDK
dnBCW3NY86zsgL++I5b2LWhXzSjlAgZSD5rJIBzv5/8yzGh5EZK519wg/bCbJLDE
LQlQ7+j/BKUllmrIKD4vokir9ronGJnTNJ9aSOdtD5d7u3VBfJdDimKRt3uUpwZm
BnLrLYZKmRUnZ+I7HgrwCO5+815W6Xut9Phdz6pp9rT+fyoUhy1V+uiu2aT1PlrS
HSuAotWAkIYKb5eiPwSAytomgfbp7GbAE4mcP6wIuxXLnBgyZHo0a3qBcwkFyWb6
1+AGw20W2hvgcwJ44cLH2IE28dy4
-----END PRIVATE KEY-----

28
infrastructure/tls/postgres/server.csr Normal file
View File

@@ -0,0 +1,28 @@
-----BEGIN CERTIFICATE REQUEST-----
MIIEzTCCArUCAQAwgYcxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlh
MRUwEwYDVQQHDAxTYW5GcmFuY2lzY28xETAPBgNVBAoMCEJha2VyeUlBMREwDwYD
VQQLDAhEYXRhYmFzZTEmMCQGA1UEAwwdKi5iYWtlcnktaWEuc3ZjLmNsdXN0ZXIu
bG9jYWwwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDVv9VJ+788y9ii
tsvb3lXZkAZFE1a6kcfcr3EMA+bjlO52A9YvGfID0dXPmOYqBYdApWtIjTjq4u4R
gD5Ga2HsURUIu32LmJ+FpeYB9Ki4b3WcLY0KyGYSFe1kElfSiZo2GIMOi3HvySMp
otEDbaZCgJw++TMSo4QKmJUVT1QcHcLm6ea0dILjxsH4BHKITbPtGtobVgQqSKWO
KUWYlNLo3foGppsXoDGpKkhqegSAWBYLpohe0D5+jcTPWYkQXB/NAFZwq3843efH
fENtE2yaivEemw+Kc4DiEdXDtNxTguqpRFh102hyZuQqJVclkQWAt6eAHWWb+UBh
aplB09tPVRwJ9Au9K3qVWT5UHTp5nhkp+L+Sh+UU/R/7ZIHaFDpqP3sb9FuuQIZo
gVcLHl3r0CipLC4TG1f9CbVQrQ7bGku/fkp1JzL5nUgU5xjNxerbx/Ga75MMM3JJ
JwqWxuPB+7gQYoYuyS0a9MAYfUTIq8qSyrHQTH2z/y8CL/ZPj4ULUGXbkHl/MMQP
kOkoe0lq3HCNaKIOVrKuTxaDTdHIVJ/mfgXtFunf6gWaxJKcQRn5EI6cKCoJljUy
z2sVP1/PuECzb5c96m7S/AUoFTCXGJZ0PMfqwMhAJ5LfFLbje/KJq0S7orwLvHR5
aWzn0gFCq/nHZNsW1PANeBv5InSTZQIDAQABoAAwDQYJKoZIhvcNAQELBQADggIB
AE4N38FRrzeIodjCM3ymJAkGI7cnm1vB/1aHwbq5OlCUQ0EGFzzeGIEZi1ve2tsW
1exPvGZRBUosl+12vwq2oJURlPPKAieKAkrvXo/vR1Fb1QnZY5hDEdJuG5Uwd0rE
QacjuFaQ/yv1TVKkvnjKhYXCmZ7w/mB36mWEOk3nBqK12xdwydRwFfgZtsVK6mq9
OiDRskecaSshMyuprFAsS3eWAbRtP6alz66g7ZdaKpReaNCc3ARWjT9Lv19dA2JS
PV7CFF0M/Ta6mE/1wct4h+GDbykwfAkzIeT4CcbXDjA0O2GaWuusZBwZrcttRycY
akxUTlXq8kQt/dK1/hcqL8EqwHrknwA0kYcFZZ4q/VhVcbZKKH974FH8hjeCo2P+
2gpK0iumg0EpTZQnViJ1cn4me8k/4U72ek6ToVUfA9i8179gvef5V/45aBqjI2CN
S0fDtWyqqJv20dRQ2omqXUsLOyCjBSuoWlmBkVe2clnixkbCPDojxm5ngHF0TI9/
4h47V26LHS1wXiqmpHFXjtVKRCtE3YxVI5sAK+KWE966m3JGngeqpjJebfHCR6dB
0FSi4kaq3t8/eRWPmY209xJzKvG0ppbKUsxOZvVnZEP8DFmDpTecS+7pehzpWvvk
rD1ROkG4d53Rj4cGwTWF+k39fIrr7ohFlDdY3LKNdNsD
-----END CERTIFICATE REQUEST-----

33
infrastructure/tls/redis/ca-cert.pem Normal file
View File

@@ -0,0 +1,33 @@
-----BEGIN CERTIFICATE-----
MIIFyzCCA7OgAwIBAgIUPgOqNY+ZoKByQ1MfO8lkiGhOmxIwDQYJKoZIhvcNAQEL
BQAwdTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFTATBgNVBAcM
DFNhbkZyYW5jaXNjbzERMA8GA1UECgwIQmFrZXJ5SUExETAPBgNVBAsMCFNlY3Vy
aXR5MRQwEgYDVQQDDAtCYWtlcnlJQS1DQTAeFw0yNTEwMTgxNDIyMTRaFw0zNTEw
MTYxNDIyMTRaMHUxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRUw
EwYDVQQHDAxTYW5GcmFuY2lzY28xETAPBgNVBAoMCEJha2VyeUlBMREwDwYDVQQL
DAhTZWN1cml0eTEUMBIGA1UEAwwLQmFrZXJ5SUEtQ0EwggIiMA0GCSqGSIb3DQEB
AQUAA4ICDwAwggIKAoICAQDRD5O2egkYg9HNRR5SU0bLnGHjpv/RagrM7dhusaWn
rfDF5VpTZ4s9/9sOEJ0NyjuoKXamouTwR1nw19FdH8f1eomcQ4eKw2HkxoxqR34t
RDaAGz3bWO+raTQ4SyMK7XFMovUUiLl+GO23l1BNPfhzkcDkZ97m434f1QVo99tb
hV4bILaoFIqf09M0E1/faB+JCR8Ykl7LoXguz3VR/BUnd0vMsTMWueD/2nVuUZO0
0pUmTUBQ2Qd7657k/HWd/1wcEAL9dXNRbxhDNfGgc3WtQhggcpYLQafLa81tlxyc
wDgN6PdElUlxgX/OuoZ1ylMZE7xpsMtpn1AweodVbm3Qp5A1ydybE61u1urYz1Lt
WNZ9eOfAqewiYQHVZWMC4a4Sa+2yM6q5PX/4g+TbITh8hZJwXPK5EDig7vF14JPl
lERNpwia3n6a0P703HPN6rkQO5kVTdiUsfibMtcUJHLyWWQARBmyeVfkICaaeYEl
ELkswa9NVESKvQaHKSiHZFhEI0aAvcpAjm1EOhEa+hSRhOoFyUOvG+cMOfcBSmL0
UmlD/lfanTT0zk5aqspEkXGeBw31rmZ/0AZOjV2ppRxWWekzo9Bf7g6eLTY4UCC5
MyPtzmx9TbXrNAnXhiF6Lg5h28R42GTe5Ad6THkF9S/Khq8u0dY5SA2GUF1EbQO8
KwIDAQABo1MwUTAdBgNVHQ4EFgQUA+6q/kc8fTQU1EDqzGRfKQpq6m0wHwYDVR0j
BBgwFoAUA+6q/kc8fTQU1EDqzGRfKQpq6m0wDwYDVR0TAQH/BAUwAwEB/zANBgkq
hkiG9w0BAQsFAAOCAgEAQuvFh2+HQFy8VTcUgalEViayt1zQGv4rISmiq3G6IeXP
XS4gwqHkFzTwZvmohTwmOCwW/xF4KgxmFbyWNrEJJEqcbedqUWV/0BCaFmJvUddI
+ex/iD3Febu8AFI+J8lBH/CenDiSLHhgyseY8uwRnXsshX5RnDirF1uKr1J635an
GlyFINUrnQlguEvtr0enGUlzT5rWj4y0AWUdbXi8vRsjWoQ8Ja0BxTrYYh/kO/FI
PtqX7wsxoJMDEQ71zhwa7WLQc2dfb2rAr1uBh3qNwiVBINB+t3JFv72xqsWgurIB
If2soRTI2nMe5gTG1Dfd+V24jfa/yIgAsMjCzmGQK20vobX4sAVnmPVbZg9SLFZi
Midkn9O9U68MEOe3Iascld7fp5Jk+HrbJU6/s16EER/AgD3Ooj3wRgjTCS+ADD+j
xo2O8VX2kPo03AN+iYa3nJmlMFzCrzT+8ZxSnP5FqGg2ECEbqqA0B/5naVpmdYaV
41oFLswcFm2iqGawbsLN9x3tvICuE93HYk1j72PzXaiSLtpvamH1dRYC+HUM1L0O
49CNMYJeL/NlyQuZJm2X0qDNSXmRML8HU9sOwWX6pPPJOzuqtgdx/+lkGAd2wZJU
IVbmL6Qvzdbta/cSVwsLtBzG48a1b4KBc7WLHTwbrdBRTg0TkLY4kvCZe5nNl4E=
-----END CERTIFICATE-----

37
infrastructure/tls/redis/redis-cert.pem Normal file
View File

@@ -0,0 +1,37 @@
-----BEGIN CERTIFICATE-----
MIIGczCCBFugAwIBAgIUG+B0M2rxnqjGdtfo0BhevKCx0f8wDQYJKoZIhvcNAQEL
BQAwdTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFTATBgNVBAcM
DFNhbkZyYW5jaXNjbzERMA8GA1UECgwIQmFrZXJ5SUExETAPBgNVBAsMCFNlY3Vy
aXR5MRQwEgYDVQQDDAtCYWtlcnlJQS1DQTAeFw0yNTEwMTgxNDIyMTRaFw0yODEw
MTcxNDIyMTRaMIGQMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEV
MBMGA1UEBwwMU2FuRnJhbmNpc2NvMREwDwYDVQQKDAhCYWtlcnlJQTEOMAwGA1UE
CwwFQ2FjaGUxMjAwBgNVBAMMKXJlZGlzLXNlcnZpY2UuYmFrZXJ5LWlhLnN2Yy5j
bHVzdGVyLmxvY2FsMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAvsa2
51GEGEnio54u1tkMxSBLd82oL/ulab1awqDBjqBdUAig2l1jRpQr5LG5XwS5h739
Y+vyPlZVemzuTb6k3n8OrLMru/PPRG+iQg7qyTGZ+bawaf6aXEeCK8A1YnqK/N4K
A1HRLWEsWG0JCeYjFOfqszjVLKrtRaH7zKiADFqDBBmxRqk/P2oJ6f+XWijp4NJu
OiWhBchbjcF/fM6v0elBS/8k5pui8kEudMea1IQK5qSJYwN6Y5tMOpJrmHu1E7No
BQegnjBo1bZRAd1h+/cq8p0Ykwja9u2gJNcs31qf81Am6+q6IW0LjLqT2yH5U5io
KhSkAns3pqAO4VkIdn3ytckd+M0BcMq4JBnbbM/gVOWr5Ez+HDJ9k2rARo0VXPyq
gORq2sWSctyQbWJOtLNQeUmCtuvxwDrUShAiXdha3zmz7X9bb4+VQp6zRZ3xvmpg
qExmOsNs00LjOl0pljUfGFAGdfomIIzRZlgVCzMUlZD4pcPVsaHbnGZ/6/YmxMde
9Lcn4kbik65fdAInxfTP2IMMdDwMFdbFis/Rl20ej7ABta3KuXodYn1y0n+XLR2L
7abTqoqItgQmAciHNPUacgDC/lPQJOyrDZU9hCsLt2IUVJMCzSd3GrCC08wgRoe5
6Q5Ht4E2XndWseYfqVtQ3g8ZKCiU+QMIBkxK7G8CAwEAAaOB3jCB2zALBgNVHQ8E
BAMCBDAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMG0GA1UdEQRmMGSC
KXJlZGlzLXNlcnZpY2UuYmFrZXJ5LWlhLnN2Yy5jbHVzdGVyLmxvY2FsghdyZWRp
cy1zZXJ2aWNlLmJha2VyeS1pYYINcmVkaXMtc2VydmljZYIJbG9jYWxob3N0hwR/
AAABMB0GA1UdDgQWBBSdIWUzCh/4ORfbKGbXMRvyxWLWrzAfBgNVHSMEGDAWgBQD
7qr+Rzx9NBTUQOrMZF8pCmrqbTANBgkqhkiG9w0BAQsFAAOCAgEAhGvpPRJZjBFi
pZ43UhUFLaHx+Q0vgs/zyyqW5jK+7efpcvtJOBmukEKLiu0Xakf+yT8VFZxGksfF
qVr/Uoolwm5DjiG8OEOoOa2Be9joGSvb7sBsgn0a/itIFRzDQwZtbPfgi0agvBfM
qs1B6oHzjA2GR6iLP1Wc88UtMXRpWW4VvRrVHjYsXun3fGtf1GRwfwAXQI7+9bWi
SOChD9eI6MquCXBdBAX/Cqnxk8hubkwWcsHySFBDLqQhPs5uM8li3+MPgpLXCfaY
X6/ZzH3NgJ3D+PIH59ZYphG3zvlFpGD4oG3Q2AolxqwMR3+P6c9If1DfMMoSgV3+
mfvgRjN5tngB+/oBiumbM4+EF8aMRk1GOyWpf3eRfG55+OTJlLsDXOSBW+K1NCz4
yNYTyshwxjVSPXqfateAZzC5SjFMRdrdHD10M0gl5/dXcp+x5hpQSY3M+gM2wWdI
zo7JBOt9Q1FQDgT3jIVWQ5PtNhd9oT9Wdc0EdJizyNl3vi9m2/bJKVpHO2ymdnHY
hPmvQYVtfsMlNvksvDLpXemG7s4vjHf12YEP8TT5DJgD46NVoe39Ka47IfaTWugN
FWoV/PajRIx/IO/kOp4NBpeB69O+nuYUUNcCw0filA+mFgWQjqFGP+fqWNaJj+pP
50rzPNsxp+qiw6FVoZ55ccxE27knveY=
-----END CERTIFICATE-----

52
infrastructure/tls/redis/redis-key.pem Normal file
View File

@@ -0,0 +1,52 @@
-----BEGIN PRIVATE KEY-----
MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQC+xrbnUYQYSeKj
ni7W2QzFIEt3zagv+6VpvVrCoMGOoF1QCKDaXWNGlCvksblfBLmHvf1j6/I+VlV6
bO5NvqTefw6ssyu7889Eb6JCDurJMZn5trBp/ppcR4IrwDVieor83goDUdEtYSxY
bQkJ5iMU5+qzONUsqu1FofvMqIAMWoMEGbFGqT8/agnp/5daKOng0m46JaEFyFuN
wX98zq/R6UFL/yTmm6LyQS50x5rUhArmpIljA3pjm0w6kmuYe7UTs2gFB6CeMGjV
tlEB3WH79yrynRiTCNr27aAk1yzfWp/zUCbr6rohbQuMupPbIflTmKgqFKQCezem
oA7hWQh2ffK1yR34zQFwyrgkGdtsz+BU5avkTP4cMn2TasBGjRVc/KqA5GraxZJy
3JBtYk60s1B5SYK26/HAOtRKECJd2FrfObPtf1tvj5VCnrNFnfG+amCoTGY6w2zT
QuM6XSmWNR8YUAZ1+iYgjNFmWBULMxSVkPilw9WxoducZn/r9ibEx170tyfiRuKT
rl90AifF9M/Ygwx0PAwV1sWKz9GXbR6PsAG1rcq5eh1ifXLSf5ctHYvtptOqioi2
BCYByIc09RpyAML+U9Ak7KsNlT2EKwu3YhRUkwLNJ3casILTzCBGh7npDke3gTZe
d1ax5h+pW1DeDxkoKJT5AwgGTErsbwIDAQABAoICAAFv4m19pLQWImSUdXUy2gYb
cdYWMNUjsnbzG92UHmvM83Gojvr2HHWp+hFVRriGLZZDLRx1PjQ6rEF+0+YMBevo
eHDT7K6+wxSYjq1WtW1h4poJ8UGVzw3bkAnKVIdIYFxP7ogLNBCBHIy8otvLOv/A
+3icI1GcfABmnEyfXE+Q2E8jQ72XhXLHLAnyM0P/mOYTpQw/v6XD1kS2whdrldF2
o1ec4BHzTC1CURpEwqV6f9EwSMSmgGPYW0ukUgvVAA6E7xyn67glVIoqPxP3hJxu
8TOLUWW8zwFwgCCm6knzFySwZDVUuvreJRR191UoPVuO2SgaqF2dwKk6/WxfIlGB
hFwdncuCU0uUyAzwUHvliDZwVPQqiPLmqXXJwZ69F530FeTs8/hTSF5Q00iAjNhe
XQo8IB04SSvT7LBz59X8cs42HyTo4afzmhK+Nu8K/CFq8DLOZ+E1mbxXDOC3VVTp
h1EiwukFtzJqG5QHBcM9M5YS+q3iL8av67Nv3opNm/PnXZGXzqmV4s+Qp07mIHbU
ljaBqes4cxE6YEKdKSNJrzcODTSEOhNaBW7dMHTfk/3mpi8224CAtEIreeg/TkeA
2KYPfO2DwxXdvIwSoj0R3BCnGU9eQ+9v/g9YU7ItrKe1B9Ee0163T8/mnqeg/Pzq
8SCHP7bMYoX1iIfn971xAoIBAQDea6bV9nT5uRG/mE+aKwJELwdO1BA7psdHruxP
cInGr7jkx5KmJWx/Sw8EwQf4uu8Dr61p/PP6KI6hK5mBRa9JVyWUmHShQCoH9LhO
Nf2Lm0ENjVUfGNobG38lnhKwO6BsJKrqO76Inksxk7HmhfzziAlUmL1ytXEoK6Bn
3pGdsQg13b9gX+z5vUpiD8r9GE5Fnzp8MkPlMhjqk/VjwUsJpinH8LcPwhC2fS9g
ZsgXvkz1TyGaYTu9/+Ak0Lg2j1Nd4V4Jb2GAosSCEKFBrkeSU15K+f+8KHtQm1UA
0jhLVAjTNLuSwxzPuUJDhax+y/DZQFbODmdBkQYqAXZC/JJ5AoIBAQDblApLh7sT
r8mn7EqLDSFrT9PJ+lBxj/mtmgtAQ428A5ua0Uslbx4cbwJsrKez5evHcXgf/V8s
Ai1m6rKraA9iLhQWJMpFAh8FoFyH+JE7Yz7AwzV6YtakXteYk5R3JX4RdYCLRxzC
JAcnY1FCIdkG8VpVOJFEVpgZCE0dPNWDts9q4riDw5shueGwdeuwhK+pzxP6iCRk
4GDGxsOHgPDd7/oULsboDhBBOyNoEr/i/Z5P8zssZlGm+cagM2DLmh6LN5IUi53Z
m4GGN/54CyfNi1AER+Vk9L93s9cd82nfyD2FwAsYvFQpAQ/g5zDNgslPvXyDz8j5
sKBdsqwgTnwnAoIBAAy1uB3n7H1Mrw/0wy+7H3EIAvHlOlw+Ror5GvXbJ3RcHEOu
h9nIr6+CeYQ7B5qWDAx44H76/nIgGS5qkGYLtl2JhlM8dwWz5fL4cAPAIBH3ODtv
BRs2z1fXNWfP5Z9+eMdVPRMPgO7LpN5bY0IaC/9ambXk2IaSibnS7GKjHE0XjbGO
T15RfPg0ceiyoFXgKrDdzXjFYo3ZVAUrmU0vAXu2rBKJ1dwnqc7Tzn5CwVJiBIHM
GM56mfBci9Fuv+gWPpxRwY7md3rjUjlge+aF7/8TloLQUGXPJmTPy4a1fJQJZEu1
araTQbU5D+lN3TKNsuCnRY6W0h20DNcfqENhrXkCggEAWH7Qq2I3vpZxcpEj9ejD
2Eki9VtCApLhMNtNv4e6XtUhaIMDg0HGY/VFh+EJ8dIvdYFAxbvLGKSEAd+DRNu6
n3ostEP9lVRmhlD8GfzPI507FFtYeUvOcA6dW6vXATIGHik6Nmfhqkj07SX1AO89
VbP+ESysN1ujDyuuUKNM9jm+XLilXs19/1i4IfNUmx7O4WRJDAbEjDd2KYbAFSOd
cAUgx/OWTL4mRPP9sBsmZOiMXnKMHbfbHq26JKSwVT53IuqxoEAozSQETsDQeTcd
wpRsGl2TkV2msSq0/yg0OnGsgfRFRKHaVXBNIvpqS9lzIwUeYs1ilWdfKoQxJRAc
rwKCAQBzgVxVqa5tOFnw8QmfUYMe7DHCU4r3RS1ONwmGoXI1RLzz3I8SRGIbNpV1
yIs4gFWWwIuXn4zLo0+YdLpOjkFh5Kak0Erkh7B5/Zm59fdGMwujA2viQGYjRrzO
kTSCXPgrGwK9BljYfelS9qWui9vDuRhAWQZOOCCyPtxEcOvr9qf9KhOc0xEENtUj
z/MBH786rprBEAXnOAFFJbmftLXYy9RhAau2SMDX0g9udHDMQNOBoWO7dh/5A5va
LLkpVgvoYkcSScDaJIKsodPLcLjqXXd51XNWpC9cOZBZQS8EuN1VfGrjODY9mR8b
jComH1P0FzyPVmLSboWmjDbs0SFe
-----END PRIVATE KEY-----

28
infrastructure/tls/redis/redis.csr Normal file
View File

@@ -0,0 +1,28 @@
-----BEGIN CERTIFICATE REQUEST-----
MIIE1jCCAr4CAQAwgZAxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlh
MRUwEwYDVQQHDAxTYW5GcmFuY2lzY28xETAPBgNVBAoMCEJha2VyeUlBMQ4wDAYD
VQQLDAVDYWNoZTEyMDAGA1UEAwwpcmVkaXMtc2VydmljZS5iYWtlcnktaWEuc3Zj
LmNsdXN0ZXIubG9jYWwwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC+
xrbnUYQYSeKjni7W2QzFIEt3zagv+6VpvVrCoMGOoF1QCKDaXWNGlCvksblfBLmH
vf1j6/I+VlV6bO5NvqTefw6ssyu7889Eb6JCDurJMZn5trBp/ppcR4IrwDVieor8
3goDUdEtYSxYbQkJ5iMU5+qzONUsqu1FofvMqIAMWoMEGbFGqT8/agnp/5daKOng
0m46JaEFyFuNwX98zq/R6UFL/yTmm6LyQS50x5rUhArmpIljA3pjm0w6kmuYe7UT
s2gFB6CeMGjVtlEB3WH79yrynRiTCNr27aAk1yzfWp/zUCbr6rohbQuMupPbIflT
mKgqFKQCezemoA7hWQh2ffK1yR34zQFwyrgkGdtsz+BU5avkTP4cMn2TasBGjRVc
/KqA5GraxZJy3JBtYk60s1B5SYK26/HAOtRKECJd2FrfObPtf1tvj5VCnrNFnfG+
amCoTGY6w2zTQuM6XSmWNR8YUAZ1+iYgjNFmWBULMxSVkPilw9WxoducZn/r9ibE
x170tyfiRuKTrl90AifF9M/Ygwx0PAwV1sWKz9GXbR6PsAG1rcq5eh1ifXLSf5ct
HYvtptOqioi2BCYByIc09RpyAML+U9Ak7KsNlT2EKwu3YhRUkwLNJ3casILTzCBG
h7npDke3gTZed1ax5h+pW1DeDxkoKJT5AwgGTErsbwIDAQABoAAwDQYJKoZIhvcN
AQELBQADggIBABkUVJDRfMxYDqzkZGNjytWblvZXFQK8aZDN4aR9YqYQfBwliH3d
ZcEFqI5HVjbypeLMfF6hs/5njOJ31hhH1gK4f3qNsKH2cjf0xSzRDeSCDGF/Fx5E
uuwdMTAm8NnsXv15AA5ceqJmQ//E8Whu9R+ar3qfOdzw75US5IMamoRRJMlFjyHZ
BwZHzOwctYhXq+A26HGLhQoWUs7ogdlxBqJq1Bpkls9o2RwJwQ6o1Pe5ytuK99U9
vbQ75oBinJ+vX2hUR1dn9ym0CS+7HUhZ8jcF5VKMEZXcBw/RDvAsAG9GLjTnjdDf
LMK1Eqi91rCeWK7RYd7ABolxr5Av9iGCYCSYC6EpwcbGKJc8laJouKEnG9jkzr27
NB3c+yHagGJplBcxXuednVibBzNSHQNYoVJlDOv7LtFQy8yYCPptXqUaz/U9oB2i
fdGMkwPNOQV58c1SzRis2kpHVZvD6fxxFWX9BLA1rD6Pk/a7gaU64WOPdlWZqYeV
l5JZ1Dpd+W0hYfueGIWyyq5dF85XDW/gtyz8Tb8qktxhiNNdoTJaIC17cjB3qAd2
w6X1RhUKIEO2hpQNhpYtWUvtxeOMzSYd2JykxuvWbcdZYPL1dlhIyWa5yyDph0cH
/99xxUWKZ5vP5vkxzsyLbtddBuFGURmgE3JasGbq3ic6X00lSmrglnMy
-----END CERTIFICATE REQUEST-----

24
infrastructure/tls/redis/san.cnf Normal file
View File

@@ -0,0 +1,24 @@
[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no
[req_distinguished_name]
C = US
ST = California
L = SanFrancisco
O = BakeryIA
OU = Cache
CN = redis-service.bakery-ia.svc.cluster.local
[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = redis-service.bakery-ia.svc.cluster.local
DNS.2 = redis-service.bakery-ia
DNS.3 = redis-service
DNS.4 = localhost
IP.1 = 127.0.0.1