onboarding-server.yml

---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: fdo
    fdo-service: owner-onboarding
  name: onboarding-server-svc
spec:
  ports:
    - protocol: TCP
      port: 9003
      targetPort: 9003
  selector:
    app: fdo
    fdo-service: owner-onboarding
  type: NodePort
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: onboarding-server-ingress
  labels:
    app: fdo
    fdo-service: owner-onboarding
spec:
  ingressClassName: nginx
  rules:
    - host: onboarding-192.168.122.70.sslip.io
      http:
        paths:
          - backend:
              service:
                name: onboarding-server-svc
                port:
                  number: 9003
            path: /
            pathType: Prefix
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: onboarding-server
  labels:
    app: fdo
    fdo-service: owner-onboarding
spec:
  replicas: 1
  selector:
    matchLabels:
      app: fdo
      fdo-service: owner-onboarding
  template:
    metadata:
      annotations:
      labels:
        app: fdo
        fdo-service: owner-onboarding
      name: onboarding-server
    spec:
      containers:
        - image: quay.io/fido-fdo/owner-onboarding-server:latest
          name: owner-onboarding-server
          ports:
            - containerPort: 9003
          volumeMounts:
            - name: owner-onboarding-config
              mountPath: /etc/fdo/owner-onboarding-server.conf.d/
              readOnly: true
            - name: ownership-vouchers
              mountPath: /etc/fdo/ownership_vouchers
            - name: owner-cert
              mountPath: /etc/fdo/keys/owner_cert.pem
              subPath: owner_cert.pem
              readOnly: true
            - name: owner-key
              mountPath: /etc/fdo/keys/owner_key.der
              subPath: owner_key.der
              readOnly: true
            - name: device-ca-cert-chain
              mountPath: /etc/fdo/keys/device_ca_cert.pem
              subPath: device_ca_cert.pem
              readOnly: true
            - name: sessions
              mountPath: /etc/fdo/sessions
          # securityContext:
          #   allowPrivilegeEscalation: false
          #   capabilities:
          #     drop: ["ALL"]
        - image: quay.io/fido-fdo/serviceinfo-api-server:latest
          name: serviceinfo-api-server
          ports:
            - containerPort: 9004
          volumeMounts:
            - name: serviceinfo-api-config
              mountPath: /etc/fdo/serviceinfo-api-server.conf.d/
              readOnly: true
            - name: device-specific-serviceinfo
              mountPath: /etc/fdo/device_specific_serviceinfo
            # ServiceInfoFiles:
            # - name: service-info-file-1
            #   mountPath: /etc/fdo/files/service-info-file-1
            #   readOnly: true
          # securityContext:
          #   allowPrivilegeEscalation: false
          #   capabilities:
          #     drop: ["ALL"]
      volumes:
        - name: owner-onboarding-config
          configMap:
            name: owner-onboarding-config
        - name: owner-cert
          secret:
            secretName: owner-cert-pem
        - name: owner-key
          secret:
            secretName: owner-key-der
        - name: device-ca-cert-chain
          secret:
            secretName: device-ca-cert-pem
        - name: ownership-vouchers
          emptyDir: {}
          # persistentVolumeClaim:
          #   claimName: fdo-ownership-vouchers-pvc
        - name: sessions
          emptyDir: {}
        - name: serviceinfo-api-config
          configMap:
            name: serviceinfo-api-config
        - name: device-specific-serviceinfo
          emptyDir: {}
        # ServiceInfoFiles:
        # - name: service-info-file-1
        #   configMap:
        #     name: fdo-service-info-file-1
      # securityContext:
      #   runAsNonRoot: true
      #   seccompProfile:
      #     type: RuntimeDefault
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: owner-onboarding-config
  labels:
    app: fdo
    fdo-service: owner-onboarding
data:
  owner-onboarding-server.yml: |+
    ---
    session_store_driver:
      Directory:
        path: /etc/fdo/sessions
    ownership_voucher_store_driver:
      Directory:
        path: /etc/fdo/ownership_vouchers/
    trusted_device_keys_path: /etc/fdo/keys/device_ca_cert.pem
    owner_private_key_path: /etc/fdo/keys/owner_key.der
    owner_public_key_path: /etc/fdo/keys/owner_cert.pem
    owner_addresses:
    - transport: HTTP
      port: 80
      addresses:
        - dns_name: onboarding-192.168.122.70.sslip.io
        # - ip_address: 192.168.122.1
    report_to_rendezvous_endpoint_enabled: false
    ov_registration_period: 600
    ov_re_registration_window: 61
    bind: 0.0.0.0:9003
    service_info_api_url: "http://localhost:9004/device_info"
    service_info_api_authentication:
      BearerToken:
        token: TestAuthToken
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: serviceinfo-api-config
  labels:
    app: fdo
    fdo-service: owner-onboarding
data:
  serviceinfo-api-server.yml: |+
    ---
    bind: 0.0.0.0:9004
    device_specific_store_driver:
      Directory:
        path: /etc/fdo/device_specific_serviceinfo
    service_info_auth_token: TestAuthToken
    # admin_auth_token: TestAdminToken
    service_info:
      commands:
      - command: ls
        args:
        - /etc/hosts
        return_stdout: true
        return_stderr: true
      after_onboarding_reboot: true