@emilia-protocol/gate 0.9.5 → 0.10.0

package/deploy/helm/emilia-gate-service/templates/migration-job.yaml

@@ -0,0 +1,73 @@
+{{- if .Values.migrations.enabled }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "emilia-gate-service.fullname" . }}-migrate
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "emilia-gate-service.labels" . | nindent 4 }}
+    app.kubernetes.io/component: migration
+  annotations:
+    helm.sh/hook: pre-install,pre-upgrade
+    helm.sh/hook-weight: "-5"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  activeDeadlineSeconds: {{ .Values.migrations.activeDeadlineSeconds }}
+  backoffLimit: {{ .Values.migrations.backoffLimit }}
+  ttlSecondsAfterFinished: {{ .Values.migrations.ttlSecondsAfterFinished }}
+  template:
+    metadata:
+      labels:
+        {{- include "emilia-gate-service.baseSelectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: migration
+    spec:
+      automountServiceAccountToken: false
+      restartPolicy: Never
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: migrate
+          image: {{ include "emilia-gate-service.image" . | quote }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command:
+            {{- toYaml .Values.migrations.command | nindent 12 }}
+          env:
+            - name: NODE_ENV
+              value: production
+            - name: EMILIA_GATE_CONFIG
+              value: {{ printf "%s/%s" .Values.configuration.mountPath .Values.configuration.configKey | quote }}
+            - name: {{ .Values.secrets.postgres.envName }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "emilia-gate-service.migrationPostgresSecret" . }}
+                  key: {{ include "emilia-gate-service.migrationPostgresKey" . }}
+                  optional: false
+          securityContext:
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
+          resources:
+            {{- toYaml .Values.migrations.resources | nindent 12 }}
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+            - name: configuration
+              mountPath: {{ .Values.configuration.mountPath }}
+              readOnly: true
+      volumes:
+        - name: tmp
+          emptyDir:
+            sizeLimit: 32Mi
+        - name: configuration
+          secret:
+            secretName: {{ include "emilia-gate-service.configurationSecret" . }}
+            optional: false
+            defaultMode: 0440
+            items:
+              - key: {{ .Values.configuration.configKey }}
+                path: {{ .Values.configuration.configKey }}
+              - key: {{ .Values.configuration.migrationKey }}
+                path: {{ .Values.configuration.migrationKey }}
+{{- end }}

package/deploy/helm/emilia-gate-service/templates/networkpolicy.yaml

@@ -0,0 +1,113 @@
+{{- if .Values.networkPolicy.enabled }}
+{{- $ingressPeers := default (list) .Values.networkPolicy.ingress.additionalPeers }}
+{{- $postgresSelector := default (dict) .Values.networkPolicy.egress.postgres.podSelector }}
+{{- $postgresCidrs := default (list) .Values.networkPolicy.egress.postgres.cidrs }}
+{{- $kmsCidrs := default (list) .Values.networkPolicy.egress.kmsCidrs }}
+{{- $githubCidrs := default (list) .Values.networkPolicy.egress.githubCidrs }}
+{{- $siemCidrs := default (list) .Values.networkPolicy.egress.siemCidrs }}
+{{- $httpsCidrs := concat $kmsCidrs $githubCidrs $siemCidrs }}
+{{- $additionalEgress := default (list) .Values.networkPolicy.egress.additionalRules }}
+{{- $hasIngress := or .Values.networkPolicy.ingress.allowSameNamespace (gt (len $ingressPeers) 0) }}
+{{- $hasBaseEgress := or .Values.networkPolicy.egress.dns.enabled (gt (len $postgresSelector) 0) (gt (len $postgresCidrs) 0) }}
+{{- $hasServiceEgress := or (gt (len $httpsCidrs) 0) (gt (len $additionalEgress) 0) }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "emilia-gate-service.fullname" . }}-base
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "emilia-gate-service.labels" . | nindent 4 }}
+spec:
+  # Selects the long-lived service and the migration hook. The migration pod
+  # receives DNS/Postgres only, never service-only GitHub/KMS/SIEM egress.
+  podSelector:
+    matchLabels:
+      {{- include "emilia-gate-service.baseSelectorLabels" . | nindent 6 }}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress: []
+  egress:
+    {{- if $hasBaseEgress }}
+    {{- if .Values.networkPolicy.egress.dns.enabled }}
+    - to:
+        - namespaceSelector:
+            {{- toYaml .Values.networkPolicy.egress.dns.namespaceSelector | nindent 12 }}
+          podSelector:
+            {{- toYaml .Values.networkPolicy.egress.dns.podSelector | nindent 12 }}
+      ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    {{- end }}
+    {{- with $postgresSelector }}
+    - to:
+        - podSelector:
+            {{- toYaml . | nindent 12 }}
+          {{- with $.Values.networkPolicy.egress.postgres.namespaceSelector }}
+          namespaceSelector:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      ports:
+        - port: {{ $.Values.networkPolicy.egress.postgres.port }}
+          protocol: TCP
+    {{- end }}
+    {{- range $postgresCidrs }}
+    - to:
+        - ipBlock:
+            cidr: {{ . | quote }}
+      ports:
+        - port: {{ $.Values.networkPolicy.egress.postgres.port }}
+          protocol: TCP
+    {{- end }}
+    {{- else }}
+    []
+    {{- end }}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "emilia-gate-service.fullname" . }}-service-access
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "emilia-gate-service.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "emilia-gate-service.serviceSelectorLabels" . | nindent 6 }}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    {{- if $hasIngress }}
+    - from:
+        {{- if .Values.networkPolicy.ingress.allowSameNamespace }}
+        - podSelector: {}
+        {{- end }}
+        {{- with $ingressPeers }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      ports:
+        - port: {{ .Values.runtime.port }}
+          protocol: TCP
+    {{- else }}
+    []
+    {{- end }}
+  egress:
+    {{- if $hasServiceEgress }}
+    {{- range $httpsCidrs }}
+    - to:
+        - ipBlock:
+            cidr: {{ . | quote }}
+      ports:
+        - port: 443
+          protocol: TCP
+    {{- end }}
+    {{- with $additionalEgress }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- else }}
+    []
+    {{- end }}
+{{- end }}

package/deploy/helm/emilia-gate-service/templates/pdb.yaml

@@ -0,0 +1,14 @@
+{{- if .Values.podDisruptionBudget.enabled }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ include "emilia-gate-service.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "emilia-gate-service.labels" . | nindent 4 }}
+spec:
+  minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
+  selector:
+    matchLabels:
+      {{- include "emilia-gate-service.serviceSelectorLabels" . | nindent 6 }}
+{{- end }}

package/deploy/helm/emilia-gate-service/templates/service.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "emilia-gate-service.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "emilia-gate-service.labels" . | nindent 4 }}
+  {{- with .Values.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.service.type }}
+  selector:
+    {{- include "emilia-gate-service.serviceSelectorLabels" . | nindent 4 }}
+  ports:
+    - name: http
+      port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP

package/deploy/helm/emilia-gate-service/templates/serviceaccount.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "emilia-gate-service.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "emilia-gate-service.labels" . | nindent 4 }}
+automountServiceAccountToken: false

package/deploy/helm/emilia-gate-service/tests/fixtures/001_gate.sql

@@ -0,0 +1,26 @@
+BEGIN;
+
+CREATE TABLE IF NOT EXISTS ep_gate_schema_migrations (
+  version TEXT PRIMARY KEY,
+  applied_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS ep_gate_consumption (
+  consumption_key TEXT PRIMARY KEY,
+  state TEXT NOT NULL,
+  consumed_at BIGINT NOT NULL,
+  expires_at BIGINT
+);
+CREATE INDEX IF NOT EXISTS ep_gate_consumption_expires_idx
+  ON ep_gate_consumption (expires_at) WHERE expires_at IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS ep_gate_actions (
+  id TEXT PRIMARY KEY,
+  record JSONB NOT NULL,
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+INSERT INTO ep_gate_schema_migrations (version)
+  VALUES ('gate-e2e-v1') ON CONFLICT (version) DO NOTHING;
+
+COMMIT;

package/deploy/helm/emilia-gate-service/tests/fixtures/002_runtime_access.sql

@@ -0,0 +1,32 @@
+-- Local E2E role split: migrations run as gate_owner; the service connects as
+-- gate_runtime. The runtime can mutate replay/action state and can append
+-- evidence only through the SECURITY DEFINER function installed by
+-- packages/gate/deploy/sql/001-runtime.sql.
+
+\set ON_ERROR_STOP on
+
+SELECT format(
+  'CREATE ROLE gate_runtime LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE INHERIT NOREPLICATION PASSWORD %L',
+  :'runtime_password'
+)
+WHERE NOT EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'gate_runtime')
+\gexec
+
+ALTER ROLE gate_runtime
+  LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE INHERIT NOREPLICATION;
+SELECT format('ALTER ROLE gate_runtime PASSWORD %L', :'runtime_password')
+\gexec
+
+GRANT CONNECT ON DATABASE gate_e2e TO gate_runtime;
+GRANT USAGE ON SCHEMA public TO gate_runtime;
+GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE ep_gate_consumption TO gate_runtime;
+GRANT SELECT, INSERT, UPDATE ON TABLE ep_gate_actions TO gate_runtime;
+REVOKE DELETE, TRUNCATE, REFERENCES, TRIGGER ON TABLE ep_gate_actions FROM gate_runtime;
+
+GRANT emilia_gate_evidence_runtime TO gate_runtime;
+SELECT emilia_gate_evidence.grant_runtime_scope(
+  'gate_runtime',
+  'gate-e2e-tenant',
+  'gate-e2e-service',
+  'gate-e2e'
+);

package/deploy/helm/emilia-gate-service/tests/fixtures/gate.config.mjs

@@ -0,0 +1,29 @@
+import fs from 'node:fs';
+import { createProductionGateConfig } from '/app/apps/gate-service/src/production-config.js';
+
+function readSecret(variable) {
+  const file = process.env[variable];
+  if (!file) throw new Error(`${variable}_required`);
+  const value = fs.readFileSync(file, 'utf8').trim();
+  if (!value) throw new Error(`${variable}_empty`);
+  return value;
+}
+
+const password = readSecret('EMILIA_GATE_RUNTIME_POSTGRES_PASSWORD_FILE');
+const githubToken = readSecret('GITHUB_TOKEN_FILE');
+const apiToken = readSecret('EMILIA_GATE_API_TOKEN_FILE');
+const trust = readSecret('EP_GATE_ISSUER_ROOTS_FILE');
+
+export default await createProductionGateConfig({
+  environment: {
+    EMILIA_GATE_DATABASE_URL: `postgresql://gate_runtime:${encodeURIComponent(password)}@postgres:5432/gate_e2e`,
+    EMILIA_GATE_API_TOKEN: apiToken,
+    EMILIA_GATE_PRINCIPAL_ID: 'operator:e2e',
+    EMILIA_GATE_TENANT_ID: 'gate-e2e-tenant',
+    EMILIA_GATE_ID: 'gate-e2e-service',
+    EMILIA_GATE_EVIDENCE_STREAM_ID: 'gate-e2e',
+    EMILIA_GATE_TRUST_JSON: trust,
+    EMILIA_GATE_ALLOWED_REPOSITORIES: 'emilia-e2e/disposable-repository',
+    GITHUB_TOKEN: githubToken,
+  },
+});

package/deploy/helm/emilia-gate-service/tests/render-check.sh

@@ -0,0 +1,145 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+chart_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+helm_bin="${HELM_BIN:-helm}"
+
+if ! command -v "$helm_bin" >/dev/null 2>&1; then
+  echo "helm is required (or set HELM_BIN)" >&2
+  exit 127
+fi
+if ! command -v node >/dev/null 2>&1; then
+  echo "node is required to syntax-check the E2E operator config fixture" >&2
+  exit 127
+fi
+
+digest="sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+values=(
+  --set-string image.repository=registry.example.test/security/emilia-gate-service
+  --set-string image.digest="$digest"
+  --set-string configuration.existingSecret=gate-configuration
+  --set-string secrets.postgres.existingSecret=gate-postgres
+  --set-string migrations.postgres.existingSecret=gate-postgres-migrate
+  --set-string migrations.postgres.key=database-url
+  --set-string secrets.apiToken.existingSecret=gate-api-token
+  --set-string secrets.kms.existingSecret=gate-kms
+  --set-string secrets.issuerRoots.existingSecret=gate-issuer-roots
+  --set-string networkPolicy.egress.githubCidrs[0]=192.0.2.10/32
+  --set-string networkPolicy.egress.siemCidrs[0]=198.51.100.20/32
+)
+
+"$helm_bin" lint --strict "$chart_dir" "${values[@]}"
+rendered="$("$helm_bin" template render-check "$chart_dir" --namespace gate-system "${values[@]}")"
+
+assert_rendered() {
+  local expected="$1"
+  if ! grep -Fq -- "$expected" <<<"$rendered"; then
+    echo "render assertion failed: missing '$expected'" >&2
+    exit 1
+  fi
+}
+
+assert_rendered "kind: Deployment"
+assert_rendered "kind: Job"
+assert_rendered "kind: PodDisruptionBudget"
+assert_rendered "kind: NetworkPolicy"
+assert_rendered "replicas: 2"
+assert_rendered "runAsNonRoot: true"
+assert_rendered "readOnlyRootFilesystem: true"
+assert_rendered "allowPrivilegeEscalation: false"
+assert_rendered "automountServiceAccountToken: false"
+assert_rendered "registry.example.test/security/emilia-gate-service@$digest"
+assert_rendered "name: gate-postgres"
+assert_rendered "name: gate-postgres-migrate"
+assert_rendered "name: gate-api-token"
+assert_rendered "name: gate-kms"
+assert_rendered "name: gate-issuer-roots"
+assert_rendered "secretName: gate-configuration"
+assert_rendered "value: \"/app/config/gate.config.mjs\""
+assert_rendered "path: /v1/live"
+assert_rendered "path: /v1/ready"
+assert_rendered "cidr: \"192.0.2.10/32\""
+assert_rendered "cidr: \"198.51.100.20/32\""
+
+if grep -Eq '^kind: Secret$' <<<"$rendered"; then
+  echo "chart must reference existing Secrets, never render one" >&2
+  exit 1
+fi
+
+if [[ "$(grep -Fc 'kind: NetworkPolicy' <<<"$rendered")" -ne 2 ]]; then
+  echo "chart must render separate base and service-only NetworkPolicies" >&2
+  exit 1
+fi
+
+if "$helm_bin" template missing-required "$chart_dir" >/dev/null 2>&1; then
+  echo "chart unexpectedly rendered without BYOC image and Secret references" >&2
+  exit 1
+fi
+
+if "$helm_bin" template mutable-image "$chart_dir" --namespace gate-system \
+  --set-string image.repository=registry.example.test/security/emilia-gate-service \
+  --set-string image.tag=latest \
+  --set-string configuration.existingSecret=gate-configuration \
+  --set-string secrets.postgres.existingSecret=gate-postgres \
+  --set-string migrations.postgres.existingSecret=gate-postgres-migrate \
+  --set-string migrations.postgres.key=database-url \
+  --set-string secrets.apiToken.existingSecret=gate-api-token \
+  --set-string secrets.issuerRoots.existingSecret=gate-issuer-roots >/dev/null 2>&1; then
+  echo "chart unexpectedly accepted image.tag=latest" >&2
+  exit 1
+fi
+
+if "$helm_bin" template missing-migration-secret "$chart_dir" --namespace gate-system \
+  --set-string image.repository=registry.example.test/security/emilia-gate-service \
+  --set-string image.digest="$digest" \
+  --set-string configuration.existingSecret=gate-configuration \
+  --set-string secrets.postgres.existingSecret=gate-postgres \
+  --set-string secrets.apiToken.existingSecret=gate-api-token \
+  --set-string secrets.issuerRoots.existingSecret=gate-issuer-roots >/dev/null 2>&1; then
+  echo "chart unexpectedly reused the runtime Postgres Secret for migrations" >&2
+  exit 1
+fi
+
+if "$helm_bin" template equal-migration-secret "$chart_dir" --namespace gate-system \
+  --set-string image.repository=registry.example.test/security/emilia-gate-service \
+  --set-string image.digest="$digest" \
+  --set-string configuration.existingSecret=gate-configuration \
+  --set-string secrets.postgres.existingSecret=gate-postgres \
+  --set-string migrations.postgres.existingSecret=gate-postgres \
+  --set-string migrations.postgres.key=database-url \
+  --set-string secrets.apiToken.existingSecret=gate-api-token \
+  --set-string secrets.issuerRoots.existingSecret=gate-issuer-roots >/dev/null 2>&1; then
+  echo "chart unexpectedly accepted the runtime Postgres Secret for migrations" >&2
+  exit 1
+fi
+
+migrations_disabled="$($helm_bin template migrations-disabled "$chart_dir" --namespace gate-system \
+  --set-string image.repository=registry.example.test/security/emilia-gate-service \
+  --set-string image.digest="$digest" \
+  --set-string configuration.existingSecret=gate-configuration \
+  --set-string secrets.postgres.existingSecret=gate-postgres \
+  --set-string secrets.apiToken.existingSecret=gate-api-token \
+  --set-string secrets.issuerRoots.existingSecret=gate-issuer-roots \
+  --set migrations.enabled=false)"
+if grep -Fq 'kind: Job' <<<"$migrations_disabled"; then
+  echo "chart rendered a migration Job while migrations were disabled" >&2
+  exit 1
+fi
+
+without_kms="$($helm_bin template no-kms "$chart_dir" --namespace gate-system \
+  --set-string image.repository=registry.example.test/security/emilia-gate-service \
+  --set-string image.digest="$digest" \
+  --set-string configuration.existingSecret=gate-configuration \
+  --set-string secrets.postgres.existingSecret=gate-postgres \
+  --set-string migrations.postgres.existingSecret=gate-postgres-migrate \
+  --set-string migrations.postgres.key=database-url \
+  --set-string secrets.apiToken.existingSecret=gate-api-token \
+  --set-string secrets.issuerRoots.existingSecret=gate-issuer-roots)"
+if grep -Fq -- "EP_KMS_KEY_ID" <<<"$without_kms"; then
+  echo "chart rendered a KMS dependency even though no KMS extension was configured" >&2
+  exit 1
+fi
+
+node --check "$chart_dir/tests/fixtures/gate.config.mjs"
+
+echo "Helm lint and render assertions passed"

package/deploy/helm/emilia-gate-service/values.schema.json

@@ -0,0 +1,145 @@
+{
+  "$schema": "https://json-schema.org/draft-07/schema#",
+  "title": "EMILIA Gate service Helm values",
+  "type": "object",
+  "required": ["image", "configuration", "secrets"],
+  "properties": {
+    "replicaCount": { "type": "integer", "minimum": 1 },
+    "image": {
+      "type": "object",
+      "required": ["repository", "tag", "digest", "pullPolicy"],
+      "properties": {
+        "repository": { "type": "string" },
+        "tag": {
+          "type": "string",
+          "pattern": "^(?:$|[A-Za-z0-9_][A-Za-z0-9._-]{0,127})$",
+          "not": { "pattern": "^[Ll][Aa][Tt][Ee][Ss][Tt]$" }
+        },
+        "digest": { "type": "string" },
+        "pullPolicy": { "type": "string", "enum": ["Always", "IfNotPresent", "Never"] }
+      },
+      "additionalProperties": false
+    },
+    "imagePullSecrets": { "type": "array" },
+    "nameOverride": { "type": "string" },
+    "fullnameOverride": { "type": "string" },
+    "service": {
+      "type": "object",
+      "required": ["type", "port"],
+      "properties": {
+        "type": { "type": "string", "enum": ["ClusterIP", "NodePort", "LoadBalancer"] },
+        "port": { "type": "integer", "minimum": 1, "maximum": 65535 },
+        "annotations": { "type": "object" }
+      },
+      "additionalProperties": false
+    },
+    "runtime": {
+      "type": "object",
+      "required": ["port", "logLevel", "terminationGracePeriodSeconds", "extraEnv"],
+      "properties": {
+        "port": { "type": "integer", "minimum": 1, "maximum": 65535 },
+        "logLevel": { "type": "string", "enum": ["debug", "info", "warn", "error"] },
+        "terminationGracePeriodSeconds": { "type": "integer", "minimum": 1 },
+        "extraEnv": { "type": "array" }
+      },
+      "additionalProperties": false
+    },
+    "configuration": {
+      "type": "object",
+      "required": ["existingSecret", "configKey", "migrationKey", "mountPath"],
+      "properties": {
+        "existingSecret": { "type": "string" },
+        "configKey": { "type": "string", "minLength": 1 },
+        "migrationKey": { "type": "string", "minLength": 1 },
+        "mountPath": { "type": "string", "pattern": "^/" }
+      },
+      "additionalProperties": false
+    },
+    "secrets": {
+      "type": "object",
+      "required": ["postgres", "apiToken", "kms", "issuerRoots"],
+      "properties": {
+        "postgres": { "$ref": "#/definitions/secretReference" },
+        "apiToken": { "$ref": "#/definitions/secretReference" },
+        "kms": { "$ref": "#/definitions/secretReference" },
+        "issuerRoots": { "$ref": "#/definitions/secretReference" }
+      },
+      "additionalProperties": false
+    },
+    "migrations": {
+      "type": "object",
+      "required": ["enabled", "postgres", "command", "activeDeadlineSeconds", "backoffLimit", "ttlSecondsAfterFinished", "resources"],
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "postgres": {
+          "type": "object",
+          "required": ["existingSecret", "key"],
+          "properties": {
+            "existingSecret": { "type": "string" },
+            "key": { "type": "string" }
+          },
+          "additionalProperties": false
+        },
+        "command": { "type": "array", "minItems": 1, "items": { "type": "string" } },
+        "activeDeadlineSeconds": { "type": "integer", "minimum": 1 },
+        "backoffLimit": { "type": "integer", "minimum": 0 },
+        "ttlSecondsAfterFinished": { "type": "integer", "minimum": 0 },
+        "resources": { "type": "object" }
+      },
+      "additionalProperties": false
+    },
+    "probes": {
+      "type": "object",
+      "required": ["startup", "liveness", "readiness"],
+      "properties": {
+        "startup": { "$ref": "#/definitions/probe" },
+        "liveness": { "$ref": "#/definitions/probe" },
+        "readiness": { "$ref": "#/definitions/probe" }
+      },
+      "additionalProperties": false
+    },
+    "resources": { "type": "object" },
+    "podDisruptionBudget": {
+      "type": "object",
+      "required": ["enabled", "minAvailable"],
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "minAvailable": { "oneOf": [{ "type": "integer", "minimum": 0 }, { "type": "string" }] }
+      },
+      "additionalProperties": false
+    },
+    "podSecurityContext": { "type": "object" },
+    "containerSecurityContext": { "type": "object" },
+    "networkPolicy": { "type": "object" },
+    "topologySpreadConstraints": { "type": "array" },
+    "podAnnotations": { "type": "object" },
+    "podLabels": { "type": "object" },
+    "nodeSelector": { "type": "object" },
+    "tolerations": { "type": "array" },
+    "affinity": { "type": "object" }
+  },
+  "additionalProperties": false,
+  "definitions": {
+    "secretReference": {
+      "type": "object",
+      "required": ["existingSecret", "key", "envName"],
+      "properties": {
+        "existingSecret": { "type": "string" },
+        "key": { "type": "string", "minLength": 1 },
+        "envName": { "type": "string", "pattern": "^[A-Z_][A-Z0-9_]*$" }
+      },
+      "additionalProperties": false
+    },
+    "probe": {
+      "type": "object",
+      "required": ["path", "periodSeconds", "timeoutSeconds", "failureThreshold"],
+      "properties": {
+        "path": { "type": "string", "pattern": "^/" },
+        "periodSeconds": { "type": "integer", "minimum": 1 },
+        "timeoutSeconds": { "type": "integer", "minimum": 1 },
+        "failureThreshold": { "type": "integer", "minimum": 1 }
+      },
+      "additionalProperties": false
+    }
+  }
+}