mrok 0.7.0__tar.gz → 0.8.1__tar.gz

mrok-0.8.1/.dockerignore

@@ -0,0 +1 @@
+.venv

{mrok-0.7.0 → mrok-0.8.1}/.github/workflows/pr-build-merge.yaml

@@ -62,10 +62,41 @@ jobs:
           path: snapshot_report.html
           if-no-files-found: warn
 
+  helm-checks:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v4
+
+      - name: Lint mrok-controller
+        run: |
+          helm lint charts/mrok-controller
+
+      - name: Render mrok-controller
+        run: |
+          helm template test charts/mrok-controller \
+            --values charts/mrok-controller/values.yaml \
+            > /dev/null
+
+      - name: Lint mrok-frontend
+        run: |
+          helm lint charts/mrok-frontend
+
+      - name: Render mrok-frontend
+        run: |
+          helm template test charts/mrok-frontend \
+            --values charts/mrok-frontend/values.yaml \
+            > /dev/null
+
   build:
     runs-on: ubuntu-latest
     timeout-minutes: 10
-    needs: test
+    needs:
+      - test
+      - helm-checks
 
     steps:
       - uses: actions/checkout@v4

{mrok-0.7.0 → mrok-0.8.1}/.github/workflows/release.yml

@@ -56,6 +56,52 @@ jobs:
     - name: Docker image digest
       run: echo ${{ steps.docker_build.outputs.digest }}
 
+
+  helm-charts:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    needs: [ set-version ]
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v5
+      with:
+        fetch-depth: 0
+
+    - name: 'Get the version'
+      id: get_version
+      run: echo  "VERSION=${GITHUB_REF/refs\/tags\//}" >> "$GITHUB_OUTPUT"
+
+    - name: Install yq (snap)
+      run: |
+        sudo snap install yq
+
+    - name: Patch Helm chart versions
+      run: |
+        for chart in charts/mrok-controller charts/mrok-frontend; do
+          yq e -i ".version = \"${{ steps.get_version.outputs.VERSION }}\"" "$chart/Chart.yaml"
+          yq e -i ".appVersion = \"${{ steps.get_version.outputs.VERSION }}\"" "$chart/Chart.yaml"
+        done
+
+    - name: Package Helm charts
+      run: |
+        helm package charts/mrok-controller
+        helm package charts/mrok-frontend
+
+    - name: Helm registry login
+      run:
+        echo "${{ secrets.REGISTRY_PASSWORD }}" | helm registry login ${{ vars.REGISTRY_LOGIN_SERVER }} \
+          --username ${{ vars.REGISTRY_USERNAME }} \
+          --password-stdin
+
+    - name: Push Helm charts to ACR (OCI)
+      run: |
+        helm push mrok-controller-${{ steps.get_version.outputs.VERSION }}.tgz \
+          oci://${{ vars.REGISTRY_LOGIN_SERVER }}/gha/helm
+
+        helm push mrok-controller-${{ steps.get_version.outputs.VERSION }}.tgz \
+          oci://${{ vars.REGISTRY_LOGIN_SERVER }}/gah/helm
+
+
   dtrack:
     uses: softwareone-platform/ops-template/.github/workflows/dependency-track-python-uv.yml@v1
     with:

mrok-0.8.1/.pre-commit-config.yaml

@@ -0,0 +1,65 @@
+default_language_version:
+  python: python3.12
+exclude: (^|/)__snapshots__/.*\.svg$|errors/.*\.html$
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: check-added-large-files
+      - id: check-toml
+      - id: check-yaml
+        exclude: ^charts/
+        args:
+          - --unsafe
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.10.0
+    hooks:
+      - id: ruff
+        args:
+          - --fix
+      - id: ruff-format
+  - repo: https://github.com/PyCQA/bandit
+    rev: "1.8.0"
+    hooks:
+      - id: bandit
+        args:
+          - -c
+          - pyproject.toml
+          - -r
+          - .
+
+  - repo: local
+    hooks:
+      - id: helm-lint
+        name: helm lint
+        entry: >
+          bash -c '
+          if ! command -v helm >/dev/null 2>&1; then
+            echo "WARNING: helm not installed, skipping helm lint";
+            exit 0;
+          fi;
+          for chart in charts/*/Chart.yaml; do
+            helm lint "$(dirname "$chart")";
+          done
+          '
+        language: system
+        pass_filenames: false
+
+  - repo: local
+    hooks:
+      - id: helm-template
+        name: helm template
+        entry: >
+          bash -c '
+          if ! command -v helm >/dev/null 2>&1; then
+            echo "WARNING: helm not installed, skipping helm template";
+            exit 0;
+          fi;
+          for chart in charts/*/Chart.yaml; do
+            helm template test "$(dirname "$chart")" > /dev/null;
+          done
+          '
+        language: system
+        pass_filenames: false

{mrok-0.7.0 → mrok-0.8.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mrok
-Version: 0.7.0
+Version: 0.8.1
 Summary: MPT Extensions OpenZiti Orchestrator
 Author: SoftwareOne AG
 License:                                  Apache License
@@ -225,7 +225,7 @@ Requires-Dist: pyzmq<28.0.0,>=27.1.0
 Requires-Dist: rich<15.0.0,>=14.1.0
 Requires-Dist: textual-serve<2.0.0,>=1.1.3
 Requires-Dist: textual[syntax]<8.0.0,>=7.2.0
-Requires-Dist: typer<0.20.0,>=0.19.2
+Requires-Dist: typer<1.0.0,>=0.21.1
 Requires-Dist: uvicorn-worker<0.5.0,>=0.4.0
 Description-Content-Type: text/markdown
 

mrok-0.8.1/charts/README.md

@@ -0,0 +1,106 @@
+# mrok Helm Charts
+
+This directory contains Kubernetes Helm charts for deploying the mrok application stack.
+
+## Charts Overview
+
+### 1. mrok-controller
+
+**Description:** Helm chart for deploying the mrok controller component.
+
+**Purpose:** The mrok controller is the central management component that handles orchestration of OpenZiti network.
+
+**Key Configuration Parameters:**
+- `image.repository`: Container image repository (e.g., `<registry>/<org>/<image>`)
+- `image.tag`: Container image tag (e.g., `<image-tag>`)
+- `frontendDomain`: Domain for the frontend service
+- `zitiBaseUrlsClient`: Ziti client API endpoint (e.g., `https://<ziti-client-api-host>`)
+- `zitiBaseUrlsManagement`: Ziti management API endpoint (e.g., `https://<ziti-mgmt-api-host>`)
+- `zitiAuthUsername`: Username for Ziti authentication (default: `admin`)
+- `zitiAuthPassword`: Password for Ziti authentication
+- `loggingDebug`: Enable debug logging (default: `false`)
+- `loggingRich`: Enable rich logging output (default: `false`)
+- `controllerAuthBackends`: Authentication backends (default: `['oidc']`)
+- `controllerAuthOIDCConfigUrl`: OpenID Connect configuration URL
+- `controllerAuthOIDCAudience`: OpenID Connect audience identifier
+
+**Components Deployed:**
+- Deployment: Runs the mrok controller service
+- ConfigMap: Stores configuration data
+- Secret: Stores sensitive credentials
+- Service: Exposes the controller application
+
+---
+
+### 2. mrok-frontend
+
+**Description:** Helm chart for deploying the mrok frontend component.
+
+**Purpose:** The mrok frontend is the reverse proxy that allow to consume the extensions web application exposed through the OpenZiti network.
+
+**Key Configuration Parameters:**
+- `image.repository`: Container image repository (e.g., `<registry>/<org>/<image>`)
+- `image.tag`: Container image tag (e.g., `<image-tag>`)
+- `frontendDomain`: Domain for the frontend service
+- `loggingDebug`: Enable debug logging (default: `false`)
+- `loggingRich`: Enable rich logging output (default: `false`)
+- `identityJson`: Identity JSON file for frontend authentication
+
+**Components Deployed:**
+- Deployment: Runs the mrok frontend service
+- ConfigMap: Stores frontend configuration
+- Secret: Stores sensitive data and identity files
+- Service: Exposes the frontend application
+
+
+---
+
+## Common Template Files
+
+Both charts follow a consistent structure with the following template files:
+
+- **`_helpers.tpl`**: Contains reusable template helpers and label definitions
+- **`configmap.yaml`**: Kubernetes ConfigMap for storing non-sensitive configuration
+- **`deployment.yaml`**: Kubernetes Deployment specification
+- **`secret.yaml`**: Kubernetes Secret for storing sensitive data (passwords, API keys, etc.)
+- **`service.yaml`**: Kubernetes Service for exposing the application
+
+---
+
+## Installation
+
+### Prerequisites
+- Kubernetes cluster (1.19+)
+- Helm 3.x
+
+### Install mrok-controller
+
+```bash
+helm install mrok-controller ./mrok-controller -f values.yaml
+```
+
+### Install mrok-frontend
+
+```bash
+helm install mrok-frontend ./mrok-frontend -f values.yaml
+```
+
+---
+
+## Configuration
+
+Each chart includes a `values.yaml` file with default and placeholder values. Before deploying:
+
+1. Copy the chart directory to your deployment location
+2. Update `values.yaml` with your environment-specific values
+3. Use `helm install` or `helm upgrade` to deploy
+
+Example:
+```bash
+helm upgrade --install mrok-controller ./mrok-controller \
+  --set image.repository=myregistry.azurecr.io/mrok \
+  --set image.tag=1.0.0 \
+  --set frontendDomain=ext.example.com
+```
+
+---

mrok-0.8.1/charts/mrok-controller/Chart.yaml

@@ -0,0 +1,7 @@
+apiVersion: v2
+name: mrok-controller
+description: mrok controller helm chart
+type: application
+
+version: 1.0.0
+appVersion: 1.0.0

mrok-0.8.1/charts/mrok-controller/templates/_helpers.tpl

@@ -0,0 +1,63 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "common.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "common.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains .Release.Name $name -}}
+{{- $name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "common.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Common labels
+*/}}
+{{- define "common.labels" -}}
+helm.sh/chart: {{ include "common.chart" . }}
+{{ include "common.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+{{/*
+Selector labels
+*/}}
+{{- define "common.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "common.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "common.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+    {{ default (include "common.fullname" .) .Values.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccount.name }}
+{{- end -}}
+{{- end -}}

mrok-0.8.1/charts/mrok-controller/templates/configmap.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  namespace: {{ .Release.Namespace }}
+  name: {{ include "common.fullname" . }}
+  labels:
+    {{- include "common.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade
+data:
+  MROK_FRONTEND__DOMAIN: {{ .Values.frontendDomain | quote }}
+  MROK_ZITI__AUTH__USERNAME: {{ .Values.zitiAuthUsername | quote }}
+  MROK_ZITI__BASE_URLS__CLIENT: {{ .Values.zitiBaseUrlsClient | quote }}
+  MROK_ZITI__BASE_URLS__MANAGEMENT: {{ .Values.zitiBaseUrlsManagement | quote }}
+  MROK_LOGGING__DEBUG: {{ .Values.loggingDebug | quote }}
+  MROK_LOGGING__RICH: {{ .Values.loggingRich | quote }}
+  MROK_CONTROLLER__AUTH__BACKENDS: {{ .Values.controllerAuthBackends | quote }}
+  MROK_CONTROLLER__AUTH__OIDC__OPENID_CONFIG_URL: {{ .Values.controllerAuthOIDCConfigUrl | quote }}
+  MROK_CONTROLLER__AUTH__OIDC__AUDIENCE: {{ .Values.controllerAuthOIDCAudience | quote }}

mrok-0.8.1/charts/mrok-controller/templates/deployment.yaml

@@ -0,0 +1,82 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  namespace: {{ .Release.Namespace }}
+  name: {{ include "common.fullname" . }}
+  labels:
+    {{- include "common.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "common.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "common.labels" . | nindent 8 }}
+    spec:
+      containers:
+        - name: main
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          command:
+            - mrok
+          args:
+            - "controller"
+            - "run"
+            - "--host"
+            - "0.0.0.0"
+            - "--port"
+            - "8975"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          envFrom:
+            - configMapRef:
+                name: {{ include "common.fullname" . }}
+            - secretRef:
+                name: {{ include "common.fullname" . }}
+          ports:
+            - name: http
+              containerPort: 8975
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /healthcheck
+              port: http
+            initialDelaySeconds: 15
+            periodSeconds: 30
+            timeoutSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: /healthcheck
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            timeoutSeconds: 5
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      affinity:
+        # Default affinity is set to ensure all pods are not located on the same node.
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 100
+            podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - {{ include "common.name" . }}
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - {{ .Release.Name }}
+              topologyKey: "kubernetes.io/hostname"
+    {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}

mrok-0.8.1/charts/mrok-controller/templates/secret.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  namespace: {{ .Release.Namespace }}
+  name: {{ include "common.fullname" . }}
+  labels:
+    {{- include "common.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade
+data:
+  MROK_ZITI__AUTH__PASSWORD: {{ .Values.zitiAuthPassword | b64enc }}

mrok-0.8.1/charts/mrok-controller/templates/service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  namespace: {{ .Release.Namespace }}
+  name: {{ include "common.fullname" . }}
+  labels:
+    {{- include "common.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 8975
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "common.selectorLabels" . | nindent 4 }}

mrok-0.8.1/charts/mrok-controller/values.yaml

@@ -0,0 +1,13 @@
+image:
+  repository: <registry>/<org>/<image>
+  tag: <image-tag>
+frontendDomain: <frontend-domain>
+zitiBaseUrlsClient: https://<ziti-client-api-host>
+zitiBaseUrlsManagement: https://<ziti-mgmt-api-host>
+zitiAuthUsername: admin
+zitiAuthPassword: "<ziti-admin-password>"
+loggingDebug: "false"
+loggingRich: "false"
+controllerAuthBackends: "['oidc']"
+controllerAuthOIDCConfigUrl: "https://<openid-config-host>/<openid-config-path>"
+controllerAuthOIDCAudience: "http://<auth-audience-host>"

mrok-0.8.1/charts/mrok-frontend/Chart.yaml

@@ -0,0 +1,7 @@
+apiVersion: v2
+name: mrok-frontend
+description: mrok frontend helm chart
+type: application
+
+version: 1.0.0
+appVersion: 1.0.0

mrok-0.8.1/charts/mrok-frontend/templates/_helpers.tpl

@@ -0,0 +1,63 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "common.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "common.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains .Release.Name $name -}}
+{{- $name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "common.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Common labels
+*/}}
+{{- define "common.labels" -}}
+helm.sh/chart: {{ include "common.chart" . }}
+{{ include "common.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+{{/*
+Selector labels
+*/}}
+{{- define "common.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "common.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "common.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+    {{ default (include "common.fullname" .) .Values.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccount.name }}
+{{- end -}}
+{{- end -}}

mrok-0.8.1/charts/mrok-frontend/templates/configmap.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  namespace: {{ .Release.Namespace }}
+  name: {{ include "common.fullname" . }}
+  labels:
+    {{- include "common.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade
+data:
+  MROK_FRONTEND__DOMAIN: {{ .Values.proxyDomain | quote }}
+  MROK_LOGGING__DEBUG: {{ .Values.loggingDebug | quote }}
+  MROK_LOGGING__RICH: {{ .Values.loggingRich | quote }}

mrok-0.8.1/charts/mrok-frontend/templates/deployment.yaml

@@ -0,0 +1,94 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  namespace: {{ .Release.Namespace }}
+  name: {{ include "common.fullname" . }}
+  labels:
+    {{- include "common.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "common.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "common.labels" . | nindent 8 }}
+    spec:
+      containers:
+        - name: main
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          command:
+            - mrok
+          args:
+            - "frontend"
+            - "run"
+            - "--host"
+            - "0.0.0.0"
+            - "--port"
+            - "8975"
+            - "/identity/public.json"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          envFrom:
+            - configMapRef:
+                name: {{ include "common.fullname" . }}
+          volumeMounts:
+            - name: frontend-identity
+              mountPath: /identity
+              readOnly: true
+          ports:
+            - name: http
+              containerPort: 8975
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /healthcheck
+              port: http
+            initialDelaySeconds: 15
+            periodSeconds: 30
+            timeoutSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: /healthcheck
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            timeoutSeconds: 5
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      affinity:
+        # Default affinity is set to ensure all pods are not located on the same node.
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 100
+            podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - {{ include "common.name" . }}
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - {{ .Release.Name }}
+              topologyKey: "kubernetes.io/hostname"
+    {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+
+      volumes:
+        - name: frontend-identity
+          secret:
+            secretName: {{ include "common.fullname" . }}
+            defaultMode: 0444
+            items:
+              - key: public.json
+                path: public.json