values-secret.yaml.template

# A more formal description of this format can be found here:
# https://github.com/validatedpatterns/common/tree/main/ansible/roles/vault_utils#values-secret-file-format

version: "2.0"
# Ideally you NEVER COMMIT THESE VALUES TO GIT (although if all passwords are
# automatically generated inside the vault this should not really matter)

secrets:

  # ===================================================================
  # Core KBS Secrets (Always Required)
  # ===================================================================

  # Auto-generated test secrets provided by KBS
  - name: kbsres1
    vaultPrefixes:
    - hub
    fields:
    - name: key1
      value: ''
      onMissingValue: generate
      vaultPolicy: validatedPatternDefaultPolicy
    - name: key2
      value: ''
      onMissingValue: generate
      vaultPolicy: validatedPatternDefaultPolicy
    - name: key3
      value: ''
      onMissingValue: generate
      vaultPolicy: validatedPatternDefaultPolicy

  # Auto-generated passphrase (example secret)
  - name: passphrase
    vaultPrefixes:
    - hub
    fields:
    - name: passphrase
      value: ''
      onMissingValue: generate
      vaultPolicy: validatedPatternDefaultPolicy

  # Attestation status tracking
  - name: attestationStatus
    vaultPrefixes:
    - hub
    fields:
    - name: status
      value: 'attested'
    - name: random
      value: ''
      onMissingValue: generate
      vaultPolicy: validatedPatternDefaultPolicy

  # ===================================================================
  # Security Policies & Attestation
  # ===================================================================

  # Image security policies (insecure, reject, signed)
  # Controls which container images are allowed to run in confidential pods
  - name: securityPolicyConfig
    vaultPrefixes:
    - hub
    fields:
    # Accept all images without verification (INSECURE - dev/testing only)
    - name: insecure
      value: |
        {
          "default": [{"type": "insecureAcceptAnything"}],
          "transports": {}
        }
    # Reject all images (useful for testing policy enforcement)
    - name: reject
      value: |
        {
          "default": [{"type": "reject"}],
          "transports": {}
        }
    # Only accept signed images (production)
    # Edit the transports section to add your signed images.
    # Each image needs a corresponding cosign public key in cosign-keys secret.
    # The keys much line up with the keys below
    - name: signed
      value: |
        {
          "default": [{"type": "reject"}],
          "transports": {
            "docker": {
              "registry.example.com/my-image": [
                {
                  "type": "sigstoreSigned",
                  "keyPath": "kbs:///default/cosign-keys/key-0"
                }
              ]
            }
          }
        }
    # Red Hat secure policy (sigstore-based - RECOMMENDED)
    # Uses modern sigstore signature verification for Red Hat images.
    # Signatures are stored as OCI artifacts in the registry (no HTTP lookaside needed).
    # The sigstore public key is embedded directly in the policy (base64-encoded).
    # VERIFIED WORKING: Tested with podman on RHEL 10.2 (2026-07-03).
    - name: redhat-secure-sigstore
      value: |
        {
          "default": [{"type": "insecureAcceptAnything"}],
          "transports": {
            "docker": {
              "registry.redhat.io": [
                {
                  "type": "sigstoreSigned",
                  "keyData": "YXJ0aWZhY3RzIHRoYXQgYXJlIHNpZ3N0b3JlLWVuYWJsZWQuCi0tLS0tQkVHSU4gUFVCTElDIEtFWS0tLS0tCk1JSUNJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBZzhBTUlJQ0NnS0NBZ0VBMEFTeXVIMlRMV3ZCVXFQSFo0SXAKNzVnN0VuY0JrZ1FIZEpuanp4QVc1S1FUTWgvc2lCb0IvQm9TcnRpUE13bkNoYlRDblFPSVFlWnVEaUZuaHVKNwpNL0QzYjdKb1gwbTEyM05jQ1NuNjdtQWRqQmE2Qmc2a3VrWmdDUDRaVVplRVNhaldYL0VqeWxGY1JGT1hXNTdwClJEQ0VONDJKL2pZbFZxdCtnOStHcmtlcjhTejg2SDNsMHRicU9kamJ6L1Z4SFlod0YwY3RVTUhzeVZSRHEyUVAKdHF6TlhsbWxNaFMvUG9GcjZSNHUvN0hDbi9LK0xlZ2NPMmZBRk9iNDBLdktTS0tWRDZsZXdVWkVyaG9wMUNnSgpYakR0R21tTzlkR01GNzFtZjZIRWZhS1NkeStFRTZpU0YyQTJWdjlRaEJhd01pcTJrT3pFaUxnNG5BZEpUOHdnClpyTUFtUENxR0lzWE5HWjQvUStZVHd3bGNlM2dscWI1TDl0Zk5vekVkU1I5Tjg1REVTZlFMUUVkWTNDYWx3S00KQlQxT0VoRVgxd0hSQ1U0ZHJNT2VqNkJOVzBWdHNjR3RIbUNyczc0alBlemh3TlQ4eXBreVMrVDB6VDRUc3k2ZgpWWGtKOFlTSHllblN6TUIyT3AyYnZzRTNnclkrczc0V2hHOVVJQTZEQnhjVGllMTVOU3pLd2Z6YW9OV09EY0xGCnA3Qlk4YWFIRTJNcUZ4WUZYK0lianBrUVJmYWVRUXNvdURGZENrWEVGVmZQcGJEMmRrNkZsZWFNVFB1eXh0SVQKZ2pWRXRHUUsycUdDRkdpUUhGZDRoZlYrZUNBNjNKcm8xejB6b0JNNUJiSUlRMytlVkZ3dDNBbFpwNVVWd3I2ZApzZWNxa2kveXJtdjNZMGRxWjlWT24zVUNBd0VBQVE9PQotLS0tLUVORCBQVUJMSUMgS0VZLS0tLS0K",
                  "signedIdentity": {"type": "matchRepository"}
                }
              ],
              "registry.access.redhat.com": [
                {
                  "type": "sigstoreSigned",
                  "keyData": "YXJ0aWZhY3RzIHRoYXQgYXJlIHNpZ3N0b3JlLWVuYWJsZWQuCi0tLS0tQkVHSU4gUFVCTElDIEtFWS0tLS0tCk1JSUNJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBZzhBTUlJQ0NnS0NBZ0VBMEFTeXVIMlRMV3ZCVXFQSFo0SXAKNzVnN0VuY0JrZ1FIZEpuanp4QVc1S1FUTWgvc2lCb0IvQm9TcnRpUE13bkNoYlRDblFPSVFlWnVEaUZuaHVKNwpNL0QzYjdKb1gwbTEyM05jQ1NuNjdtQWRqQmE2Qmc2a3VrWmdDUDRaVVplRVNhaldYL0VqeWxGY1JGT1hXNTdwClJEQ0VONDJKL2pZbFZxdCtnOStHcmtlcjhTejg2SDNsMHRicU9kamJ6L1Z4SFlod0YwY3RVTUhzeVZSRHEyUVAKdHF6TlhsbWxNaFMvUG9GcjZSNHUvN0hDbi9LK0xlZ2NPMmZBRk9iNDBLdktTS0tWRDZsZXdVWkVyaG9wMUNnSgpYakR0R21tTzlkR01GNzFtZjZIRWZhS1NkeStFRTZpU0YyQTJWdjlRaEJhd01pcTJrT3pFaUxnNG5BZEpUOHdnClpyTUFtUENxR0lzWE5HWjQvUStZVHd3bGNlM2dscWI1TDl0Zk5vekVkU1I5Tjg1REVTZlFMUUVkWTNDYWx3S00KQlQxT0VoRVgxd0hSQ1U0ZHJNT2VqNkJOVzBWdHNjR3RIbUNyczc0alBlemh3TlQ4eXBreVMrVDB6VDRUc3k2ZgpWWGtKOFlTSHllblN6TUIyT3AyYnZzRTNnclkrczc0V2hHOVVJQTZEQnhjVGllMTVOU3pLd2Z6YW9OV09EY0xGCnA3Qlk4YWFIRTJNcUZ4WUZYK0lianBrUVJmYWVRUXNvdURGZENrWEVGVmZQcGJEMmRrNkZsZWFNVFB1eXh0SVQKZ2pWRXRHUUsycUdDRkdpUUhGZDRoZlYrZUNBNjNKcm8xejB6b0JNNUJiSUlRMytlVkZ3dDNBbFpwNVVWd3I2ZApzZWNxa2kveXJtdjNZMGRxWjlWT24zVUNBd0VBQVE9PQotLS0tLUVORCBQVUJMSUMgS0VZLS0tLS0K",
                  "signedIdentity": {"type": "matchRepository"}
                }
              ]
            }
          }
        }
    # Red Hat secure policy (GPG-based - LEGACY, BLOCKED)
    # Uses GPG signature verification for Red Hat images via KBS.
    # BLOCKED: Requires HTTP lookaside support in image-rs (issue #9).
    # Signatures are at https://registry.redhat.io/containers/sigstore but image-rs
    # cannot fetch from HTTPS yet. Kept as reference for when HTTP support lands.
    - name: redhat-secure-gpg
      value: |
        {
          "default": [{"type": "insecureAcceptAnything"}],
          "transports": {
            "docker": {
              "registry.redhat.io": [
                {
                  "type": "signedBy",
                  "keyType": "GPGKeys",
                  "keyPath": "kbs:///default/redhat-gpg-key/redhat-release"
                }
              ],
              "registry.access.redhat.com": [
                {
                  "type": "signedBy",
                  "keyType": "GPGKeys",
                  "keyPath": "kbs:///default/redhat-gpg-key/redhat-release"
                }
              ]
            }
          }
        }

  # JWK signing key for sealed secrets
  # The public key is provisioned to KBS for signature verification.
  # The private key stays local and is used to create sealed secrets.
  # Generated by: ./scripts/gen-secrets.sh (requires jose CLI)
  - name: sealedSecretsSigningKey
    vaultPrefixes:
    - hub
    fields:
    - name: public
      path: ~/.coco-pattern/sealed-secrets-signing-pub.jwk

  # Sigstore public keys for Red Hat container signature verification
  # Red Hat release key 3 (used for sigstore signatures as of Oct 2024)
  - name: sigstore-keys
    vaultPrefixes:
    - hub
    fields:
    - name: redhat-release3
      path: ~/.coco-pattern/SIGSTORE-redhat-release3

  # Cosign public keys for custom image signature verification
  # Required when using the "signed" policy above.
  # Add your cosign public key files here.
  # Generate a cosign key pair: cosign generate-key-pair
  #- name: cosign-keys
  #  vaultPrefixes:
  #  - hub
  #  fields:
  #  - name: key-0
  #    path: ~/.coco-pattern/cosign-key-0.pub


  # PCR measurements for attestation (Azure) and firmware reference values
  # (bare metal / Intel TDX / AMD SEV-SNP) are both enabled by default so the
  # SAME values-secret file works unmodified on either topology.
  #   Azure:      make collect-azure-refvals      -> ~/.coco-pattern/measurements.json
  #   Bare metal: make collect-firmware-refvals   -> ~/.coco-pattern/firmware-reference-values.json
  #   See docs/firmware-reference-values.md and docs/pcr-reference-values-bare-metal.md
  # collect_firmware_refvals.py (and gen-secrets.sh as a first-run safety net)
  # automatically create an empty '{}' placeholder for whichever of these two
  # files you are NOT using, so 'make load-secrets' never fails with a
  # missing-file error regardless of platform. Real collected data always
  # overwrites the placeholder for the platform you actually run.
  - name: pcrStash
    vaultPrefixes:
    - hub
    fields:
    - name: json
      path: ~/.coco-pattern/measurements.json

  - name: firmwareReferenceValues
    vaultPrefixes:
    - hub
    fields:
    - name: json
      path: ~/.coco-pattern/firmware-reference-values.json


  # ===================================================================
  # Optional - Disconnected/Airgap Mirror Registry Configuration
  # ===================================================================
  # Everything between the AIRGAP-MIRROR-SECRETS markers below (this block
  # plus the bootstrap_secrets block near the end of this file) only applies
  # to airgap (disconnected mirror) deployments and is commented out by
  # default so connected deployments (Azure, connected bare metal) don't hit
  # 'make load-secrets' failures for files that don't exist.
  #
  # For airgap deployments, run 'make cache-registry-ca' and
  # 'make gen-mirror-helm-secret' first, then run:
  #   make enable-airgap-secrets
  # which uncomments both blocks automatically (see airgap/DEPLOY-RUNBOOK.md).

  # Private registry CA certificate chain (PEM format).
  # Copy your registry CA chain to the path above before running 'make load-secrets'.
  # Use 'make cache-registry-ca' for APAC lab Quay.
  # AIRGAP-MIRROR-SECRETS-START
  #- name: registryCaCert
  #  vaultPrefixes:
  #  - hub
  #  fields:
  #  - name: pem
  #    path: ~/.coco-pattern/mirror-registry-ca-cert.pem
  # AIRGAP-MIRROR-SECRETS-END

  # ===================================================================
  # Optional - SSH Debug Access
  # ===================================================================

  # SSH keys for podvm debug access (optional).
  # To enable: set global.coco.enableSSHDebug=true in values-global.yaml,
  # run COCO_ENABLE_SSH_DEBUG=true ./scripts/gen-secrets.sh,
  # then uncomment the block below.
  #- name: sshKey
  #  vaultPrefixes:
  #  - global
  #  fields:
  #  - name: id_rsa.pub
  #    path: ~/.coco-pattern/id_rsa.pub
  #  - name: id_rsa
  #    path: ~/.coco-pattern/id_rsa

  # ===================================================================
  # Optional - Bare Metal Intel TDX (DCAP Collateral)
  # ===================================================================

  # TDX DCAP verification collateral (TCB info, QE identity, PCK CRL)
  # Collected on a connected low-side host via: make collect-dcap-collateral
  # Loaded into Vault, delivered to KBS via ESO + kbsLocalCertCacheSpec
  # Refresh when collateral expires (~30-90 days)
  # Uncomment after running 'make collect-dcap-collateral':
  #- name: tdxCollateral
  #  vaultPrefixes:
  #  - hub
  #  fields:
  #  - name: platform_collaterals.json
  #    path: ~/.coco-pattern/dcap-offline/platform_collaterals.json

  # ===================================================================
  # Optional - Intel TDX DCAP connected mode (zero-touch platform
  # registration). Required when the intel-dcap chart runs connected
  # (the default; NOT needed in airgap mode where PCK certificates
  # are managed manually via scripts/dcap-pck.py).
  # Stage the key WITHOUT a trailing newline (printf, not echo — a newline
  # makes the Ocp-Apim-Subscription-Key header invalid and the registrar
  # fails instantly with no diagnostic):
  #   printf '%s' "$INTEL_PCS_API_KEY" > ~/.coco-pattern/intel-pcs-api-key
  - name: intelPcsApiKey
    vaultPrefixes:
    - hub
    fields:
    - name: api-key
      path: ~/.coco-pattern/intel-pcs-api-key

  # ===================================================================
  # Optional - Bare Metal AMD SEV-SNP (VCEK Certificates)
  # ===================================================================

  # VCEK certificates for offline AMD SEV-SNP attestation.
  # One secret per SNP-capable node, keyed by hardware ID.
  # Collected via: make snp-collect-vcek-urls  (cluster-connected)
  #                make snp-download-vcek      (internet-connected)
  # Generated by:  make snp-gen-overrides
  # Paste the output from snp-gen-overrides below:
  #
  # - name: snpVcek-<hwid>
  #   vaultPrefixes:
  #   - hub
  #   fields:
  #   - name: vcek.der
  #     path: ~/.coco-pattern/snp-vcek/<hwid>/vcek.der

# ===================================================================
# Bootstrap Secrets (Phase 23 DEL-2) — ArgoCD OCI Helm registry auth
# ===================================================================
# Airgap (disconnected mirror) deployments only. Commented out by default —
# see the "Disconnected/Airgap Mirror Registry Configuration" note above.
# Pre-seeds ArgoCD with credentials to pull OCI Helm charts from mirror-registry
# before Vault is initialized. Loaded via: make load-bootstrap
# Secret name: mirror-registry-helm-oci
# Registry: MIRROR_REGISTRY_HOST:PORT (mirror-registry — sole airgap chart target)
# Credentials: mirror-registry init user; password in ~/.coco-pattern/mirror-registry-password
#
# Uncommented automatically by 'make enable-airgap-secrets' (see
# airgap/DEPLOY-RUNBOOK.md), which uncomments this block together with
# registryCaCert above.
# AIRGAP-MIRROR-SECRETS-START
#bootstrap_secrets:
#  - name: mirror-registry-helm-oci
#    targetNamespaces:
#      - vp-gitops
#    labels:
#      argocd.argoproj.io/secret-type: repository
#    fields:
#      - name: type
#        value: helm
#      - name: enableOCI
#        value: "true"
#      - name: url
#        value: MIRROR_REGISTRY_HOST:PORT/validatedpatterns
#      - name: name
#        value: mirror-registry-charts
#      - name: username
#        value: init
#      - name: password
#        path: ~/.coco-pattern/mirror-registry-password
#        onMissingValue: error
# AIRGAP-MIRROR-SECRETS-END