pdp-interface-deployment.yaml

# PHASE 1 LOCAL / KIND DEV TOPOLOGY
#
# This manifest uses node-local images (`localhost/...:local` +
# `imagePullPolicy: Never`), so it only runs on a cluster where every target
# node has been preloaded with those images (e.g. `kind load` / `podman save`).
# A production deployment must publish immutable, versioned images to the
# deployment registry and use `imagePullPolicy: IfNotPresent` — layer that in
# via a separate production overlay rather than editing this dev manifest.
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: aiac-pdp-config
  namespace: aiac-system
data:
  KEYCLOAK_URL: "http://keycloak-service.keycloak.svc:8080"
  KEYCLOAK_REALM: "rossoctl"
  KEYCLOAK_ADMIN_REALM: "master"
  AIAC_PDP_CONFIG_URL: "http://aiac-pdp-config-service:7071"
  AIAC_PDP_POLICY_URL: "http://aiac-pdp-policy-service:7072"
  AIAC_POLICY_MODEL_STORE_URL: "http://aiac-policy-model-store-service:7074"
  # PLATFORM_SOURCE_CLIENTS is the comma-separated list of platform bypass
  # clients the inbound Rego admits without a user role.
  PLATFORM_SOURCE_CLIENTS: "rossoctl"
  # NATS_URL points the PDP services at the Event Broker (Phase 2, issue 4.19).
  NATS_URL: "nats://aiac-event-broker-service:4222"
  # AIAC_RAG_INGEST_URL and AIAC_CHROMADB_URL are added in Phase 3 (RAG Pod, issue 4.20).

---
# RBAC for the PDP Policy Writer (aiac-pdp-policy-opa container). The writer
# server-side-applies per-agent AuthorizationPolicy CRs, so its pod needs a
# dedicated ServiceAccount bound to a ClusterRole granting CR write access.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: aiac-pdp-policy-writer
  namespace: aiac-system

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: aiac-pdp-policy-writer
rules:
  # No "watch": the writer only creates/patches CRs; bundle-service polls.
  - apiGroups: ["agent.rossoctl.dev"]
    resources: ["authorizationpolicies"]
    verbs: ["get", "list", "create", "update", "patch", "delete"]

---
# Cluster-scoped binding (not a namespaced RoleBinding): the writer creates CRs
# in arbitrary workload namespaces (team1, etc.), derived from each agent's
# identity_ref namespace — not just aiac-system.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: aiac-pdp-policy-writer
subjects:
  - kind: ServiceAccount
    name: aiac-pdp-policy-writer
    namespace: aiac-system
roleRef:
  kind: ClusterRole
  name: aiac-pdp-policy-writer
  apiGroup: rbac.authorization.k8s.io

---
# Preconditions (NOT created by this manifest):
#
#   * The target namespace `aiac-system` must already exist
#     (`kubectl create namespace aiac-system`).
#   * The `keycloak-admin-secret` Secret must be pre-provisioned out-of-band —
#     credentials must NEVER be committed to git. The Deployment below references
#     it via secretRef. Create it once per cluster:
#
#       kubectl create secret generic keycloak-admin-secret \
#         -n aiac-system \
#         --from-literal=KEYCLOAK_ADMIN_USERNAME=<admin-user> \
#         --from-literal=KEYCLOAK_ADMIN_PASSWORD=<admin-password>
apiVersion: apps/v1
kind: Deployment
metadata:
  name: aiac-interface
  namespace: aiac-system
spec:
  replicas: 1
  selector:
    matchLabels:
      app: aiac-interface
  template:
    metadata:
      labels:
        app: aiac-interface
    spec:
      # Dedicated SA so the aiac-pdp-policy-opa container can server-side-apply
      # AuthorizationPolicy CRs (RBAC above); the default namespace SA cannot.
      serviceAccountName: aiac-pdp-policy-writer
      # Both images run as non-root UID 10001. fsGroup makes the /tmp emptyDirs
      # group-writable by that user; without it the kubelet leaves an emptyDir
      # root-owned and temp writes on the read-only root filesystem fail.
      securityContext:
        runAsNonRoot: true
        runAsUser: 10001
        runAsGroup: 10001
        fsGroup: 10001
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: aiac-pdp-config
          image: localhost/aiac-pdp-config:local
          imagePullPolicy: Never
          ports:
            - containerPort: 7071
          # readOnlyRootFilesystem is on, so anything that writes to the
          # container filesystem (temp files, etc.) must land on a writable
          # mount — the emptyDir at /tmp below.
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 250m
              memory: 128Mi
          readinessProbe:
            httpGet:
              path: /health
              port: 7071
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /health
              port: 7071
            initialDelaySeconds: 10
            periodSeconds: 20
          envFrom:
            - configMapRef:
                name: aiac-pdp-config
            - secretRef:
                name: keycloak-admin-secret
          volumeMounts:
            - name: tmp
              mountPath: /tmp
        # PDP Policy Writer (OPA): CR-backed writer. It server-side-applies
        # per-agent AuthorizationPolicy CRs (agent.rossoctl.dev) to the
        # Kubernetes API, authorized via the aiac-pdp-policy-writer
        # ServiceAccount/RBAC (above). The .rego file dump is an optional debug
        # aid (POLICY_WRITER_DUMP_REGO) and is off here in production.
        - name: aiac-pdp-policy-opa
          image: localhost/aiac-pdp-policy-opa:local
          imagePullPolicy: Never
          ports:
            - containerPort: 7072
          # The root filesystem is read-only; the Kubernetes client and FastAPI
          # still need somewhere to write, so temp writes go to the /tmp emptyDir.
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 250m
              memory: 128Mi
          readinessProbe:
            httpGet:
              path: /health
              port: 7072
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /health
              port: 7072
            initialDelaySeconds: 10
            periodSeconds: 20
          envFrom:
            - configMapRef:
                name: aiac-pdp-config
          volumeMounts:
            - name: tmp-opa
              mountPath: /tmp
      volumes:
        - name: tmp
          emptyDir: {}
        - name: tmp-opa
          emptyDir: {}

---
apiVersion: v1
kind: Service
metadata:
  name: aiac-pdp-config-service
  namespace: aiac-system
spec:
  selector:
    app: aiac-interface
  ports:
    - name: idp-config
      port: 7071
      targetPort: 7071

---
apiVersion: v1
kind: Service
metadata:
  name: aiac-pdp-policy-service
  namespace: aiac-system
spec:
  selector:
    app: aiac-interface
  ports:
    - name: pdp-policy
      port: 7072
      targetPort: 7072