Further auth and authz configuration

k8s/configmap.yaml

@@ -95,3 +95,23 @@ data:
         - "Authorization"
       allow_credentials: false
       max_age: 3600
+
+    # Authentication and authorization configuration
+    # Uncomment and configure to enable API key authentication
+    # auth:
+    #   enabled: true
+    #   default_rate_limit: 100  # requests per minute
+    #   bootstrap:
+    #     enabled: true
+    #     kubernetes_secret_name: "notifier-admin-key"  # Secret name for storing admin key
+    #     kubernetes_secret_key: "admin-key"             # Key within the secret
+    #     # Optionally save to file as backup
+    #     admin_key_file: "/tmp/notifier-admin-key"
+    #     print_to_stdout: false
+
+    # Notification retention and automatic cleanup configuration
+    retention:
+      enabled: true                  # Enable automatic cleanup of old/expired notifications
+      ttl: "168h"                     # Time-to-live: how long to keep notifications (7 days)
+      check_frequency: "1h"           # How often to run cleanup check
+      max_size: 100000                # Maximum number of notifications to store

k8s/deployment.yaml

@@ -95,3 +95,108 @@ metadata:
   name: notifier
   labels:
     app: notifier
+---
+# Example deployment with API key authentication and Kubernetes bootstrap enabled
+# Uncomment and apply this deployment instead of the one above to enable auth
+#
+# apiVersion: apps/v1
+# kind: Deployment
+# metadata:
+#   name: notifier-with-auth
+#   labels:
+#     app: notifier
+#     version: v1
+# spec:
+#   replicas: 3
+#   selector:
+#     matchLabels:
+#       app: notifier
+#   template:
+#     metadata:
+#       labels:
+#         app: notifier
+#         version: v1
+#     spec:
+#       serviceAccountName: notifier
+#       containers:
+#       - name: notifier
+#         image: notifier:latest
+#         imagePullPolicy: Always
+#         ports:
+#         - name: rest
+#           containerPort: 8080
+#           protocol: TCP
+#         - name: grpc
+#           containerPort: 50051
+#           protocol: TCP
+#         - name: metrics
+#           containerPort: 9090
+#           protocol: TCP
+#         - name: health
+#           containerPort: 8081
+#           protocol: TCP
+#         env:
+#         - name: NOTIFIER_SERVER_MODE
+#           value: "both"
+#         - name: NOTIFIER_LOGGING_LEVEL
+#           value: "info"
+#         - name: NOTIFIER_LOGGING_FORMAT
+#           value: "json"
+#         - name: NOTIFIER_QUEUE_TYPE
+#           value: "local"
+#         # Optional: set auth config via environment variables instead of config.yaml
+#         # - name: NOTIFIER_AUTH_ENABLED
+#         #   value: "true"
+#         # - name: NOTIFIER_AUTH_DEFAULT_RATE_LIMIT
+#         #   value: "100"
+#         # - name: NOTIFIER_AUTH_BOOTSTRAP_ENABLED
+#         #   value: "true"
+#         # - name: NOTIFIER_AUTH_BOOTSTRAP_KUBERNETES_SECRET_NAME
+#         #   value: "notifier-admin-key"
+#         # - name: NOTIFIER_AUTH_BOOTSTRAP_KUBERNETES_SECRET_KEY
+#         #   value: "admin-key"
+#         volumeMounts:
+#         - name: config
+#           mountPath: /app/config.yaml
+#           subPath: config.yaml
+#           readOnly: true
+#         - name: queue-storage
+#           mountPath: /var/lib/notifier
+#         resources:
+#           requests:
+#             cpu: 100m
+#             memory: 128Mi
+#           limits:
+#             cpu: 500m
+#             memory: 512Mi
+#         livenessProbe:
+#           httpGet:
+#             path: /health
+#             port: health
+#           initialDelaySeconds: 30
+#           periodSeconds: 10
+#           timeoutSeconds: 5
+#           failureThreshold: 3
+#         readinessProbe:
+#           httpGet:
+#             path: /health
+#             port: health
+#           initialDelaySeconds: 10
+#           periodSeconds: 5
+#           timeoutSeconds: 3
+#           failureThreshold: 3
+#         securityContext:
+#           runAsNonRoot: true
+#           runAsUser: 1000
+#           allowPrivilegeEscalation: false
+#           readOnlyRootFilesystem: false
+#           capabilities:
+#             drop:
+#             - ALL
+#       volumes:
+#       - name: config
+#         configMap:
+#           name: notifier-config
+#       - name: queue-storage
+#         emptyDir: {}
+#       restartPolicy: Always

k8s/rbac.yaml

@@ -0,0 +1,31 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: notifier
+  labels:
+    app: notifier
+rules:
+# Permissions for bootstrap admin key creation in Kubernetes secret
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["create", "update", "get", "list"]
+  resourceNames: ["notifier-admin-key"]
+# Allow listing secrets to check if secret exists
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: notifier
+  labels:
+    app: notifier
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: notifier
+subjects:
+- kind: ServiceAccount
+  name: notifier
+  namespace: default