bascule-oss/charts/bascule/Chart.yaml at 72fa8cee9211d20c68d84942c1135406a647fc8d21f56cf4fb563e227a3eb3f4 - tking/bascule-oss - Forgejo: Beyond coding. We Forge.

tking/bascule-oss

SHA256

Tyler King 9dc5cb9eee feat: Kubernetes native integration — Helm chart + K8s/SPIFFE config

Helm chart (charts/bascule/):
  Deployment with shell sidecar container (shared jumphost model)
  Service (LoadBalancer/NodePort/ClusterIP)
  ConfigMap with auto-generated config.toml
  RBAC (Role + RoleBinding for pods/exec)
  NetworkPolicy (restrict shell egress, allow DNS + K8s API)
  ServiceAccount with create flag
  Configurable shell image (k8s-ops, net-ops, dev, minimal)
  Helm lint passes clean

K8s backend config (bascule-core):
  [k8s] section: enabled, namespace, pod_name, shell_container, shell
  Auto-detection via POD_NAME/POD_NAMESPACE env vars (downward API)
  Backend priority: K8s > proxy > container > local PTY
  K8s exec implementation deferred to --features k8s (kube crate)

SPIFFE/SPIRE auth config:
  [auth.spiffe] section: trust_domain, trust_bundle_path, workload_api_socket
  JWT-SVID token-as-password authentication pattern
  Implementation deferred to bascule-auth-spiffe crate

Zero substrate dependencies. Default build unchanged.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-05 10:23:09 -04:00

12 lines

201 B

YAML

Raw Blame History

 apiVersion: v2
 name: bascule
 description: Identity-aware SSH proxy for Kubernetes
 version: 0.1.0
 appVersion: "0.1.0"
 type: application
 keywords:
   - ssh
   - proxy
   - identity
   - jumphost
   - bastion