feat: add authz component with configuration and deployment files

[haritzsaiz]

This pull request introduces the new authz authorization service to the Helm chart, integrates it with other components, and adds several configuration improvements. The most significant changes include the deployment and configuration of the authz service, updates to existing component configs to use the new service, and enhancements to gateway and PostgreSQL logging and response handling.

New Authorization Service Integration:

• Added authz service deployment, service, configmap, and HTTPRoute for API exposure (authz-deployment.yml, authz-service.yml, authz-configmap.yml, authz-gateway-httproute.yaml). [1] [2] [3] [4]
• Extended values.yaml to support configuration of the new authz service, including image, database, schemas, credentials, bootstrap, and preload directory (values.yaml).
• Updated all relevant component configmaps (CA, KMS, Device Manager, DMS Manager, AWS Connector, VA, Alerts) to include an authz_client section for connecting to the new service (ca-configmap.yml, kms-configmap.yml, device-manager-configmap.yml, dms-manager-configmap.yml, aws-connector-configmap.yml, va-configmap.yaml, alert-configmap.yml). [1] [2] [3] [4] [5] [6] [7]

Gateway and Security Policy Enhancements:

• Added support for custom 401 and 403 response overrides in the gateway, configurable via values.yaml and implemented in a new envoy-gateway-response-override.yml resource. [1] [2]
• Updated Envoy gateway configuration to remove sensitive headers early in the request processing (envoy-gateway.yml).
• Removed JWT and authorization rules from the gateway security policy, possibly to delegate authz to the new service (envoy-jwt-securitypolicy.yml).

PostgreSQL Logging and Configuration:

• Made the log level for all components' PostgreSQL storage configurable via postgres.logLevel in values.yaml and updated all relevant configmaps to use this value instead of a hardcoded "info" level. [1] [2] [3] [4] [5] [6] [7]

KMS StatefulSet Security Context:

• Added conditional securityContext to the KMS StatefulSet when a filesystem crypto engine is configured, improving security and compatibility (kms-statefulset.yml, _helpers.tpl). [1] [2]

These changes collectively improve the platform's authorization capabilities, security, and configurability.

Closes #89

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

[greptile-apps]

Greptile Summary

This PR introduces the authz authorization service to the Lamassu Helm chart, integrates it with every PKI component via an authz_client config block, and migrates the gateway authentication model from inline JWT validation to per-service external authorization. It also upgrades Envoy Gateway from v1.3.0 to v1.8.0, shifts the Postgres database layout from per-service databases to a single pki database with per-service schemas, and adds the Siemens WFX workflow service.

• New authz service: Deployment, Service, ConfigMap, and HTTPRoute are added; the configmap wires JWKS validation, AMQP event bus, and configurable bootstrap/credentials; all existing service configmaps gain a hardcoded authz_client stanza pointing at the new service.
• Gateway auth model replaced: envoy-jwt-securitypolicy.yml is deleted (removing gateway-level JWT enforcement from all core PKI routes); a new SecurityPolicy applies external-authz only to routes labeled auth=external (currently WFX only), delegating enforcement for the remaining routes entirely to each service's authz_client.
• Database architecture change: migration-job.yaml now always connects to a hardcoded database named pki with search_path=<service>, and the fast-lane init SQL creates schemas within pki rather than separate databases — a breaking change for any upgrade from the previous per-service-database layout.

Confidence Score: 3/5

Not safe to merge without addressing the migration-job regression and the unresolved carryover issues from prior review rounds.

The migration job now hardcodes dbname=pki with no override in values.yaml. Any operator running helm upgrade on an existing installation will have all six pre-install migration jobs fail immediately because a database named pki does not exist on their cluster. Beyond this new finding, multiple issues from prior review rounds remain open: gateway-level JWT enforcement was removed from all core PKI routes with no replacement, PGPASSWORD is exposed as a plain pod env var, wfx.enabled defaults to true causing automatic WFX deployment on upgrade, and the fast-lane postgres heredoc still contains a duplicate init.sql key.

charts/lamassu/templates/migration-job.yaml (hardcoded pki database name), charts/lamassu/templates/envoy-jwt-securitypolicy.yml (deletion removes all gateway auth for core routes), and charts/lamassu/templates/wfx-deployment.yml (plain-text password env var).

Important Files Changed

Filename	Overview
charts/lamassu/templates/migration-job.yaml	Hardcodes dbname=pki for all service migrations — breaks upgrades from per-service database installations
charts/lamassu/templates/authz-deployment.yml	New authz Deployment; lacks an enabled toggle (flagged in prior review) and the schema volumeMount bugs noted earlier appear to have been removed in the current version
charts/lamassu/templates/authz-configmap.yml	New authz ConfigMap; pki/authz schema paths are hardcoded (image must ship them), jwks_url now reads from services.authz.jwkUrl which is properly set in values.yaml
charts/lamassu/templates/envoy-jwt-securitypolicy.yml	Deleted — gateway-level JWT validation and authorization rules removed from all core PKI routes (flagged in prior review as security regression)
charts/lamassu/templates/envoy-external-auth-securitypolicy.yml	New external-authz SecurityPolicy targeting routes labeled auth=external (WFX only); uses v1.8.0 path field, properly guarded by auth.externalAuthorization.enabled
charts/lamassu/templates/envoy-gateway.yml	Replaced EnvoyPatchPolicy mTLS workaround with native clientValidation and adds earlyRequestHeaders.remove to strip spoofable identity headers before forwarding
charts/lamassu/templates/kms-statefulset.yml	Adds conditional pod-level securityContext for filesystem engines but leaves commented-out container-level securityContext dead code (flagged in prior review)
charts/lamassu/templates/wfx-deployment.yml	New WFX Deployment; PGPASSWORD is set as a plain env value (flagged in prior review); iamAuth config defined in values.yaml but never consumed here (flagged in prior review)
charts/lamassu/values.yaml	Adds postgres.logLevel, auth.externalAuthorization, services.authz, and services.wfx blocks; wfx.enabled defaults to true (flagged in prior review); image tags restored to pinned versions
scripts/lamassu-fast-lane.sh	Adds --context and --gateway-ip flags, upgrades Envoy Gateway to v1.8.0 (with CRD pre-apply), rewrites Postgres init SQL to use schemas-in-pki architecture; duplicate init.sql key flagged in prior review

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant Client
    participant EnvoyGateway as Envoy Gateway
    participant AuthzSvc as authz service
    participant PKISvc as PKI Service (CA/KMS/etc.)
    participant WFX

    Note over EnvoyGateway: earlyRequestHeaders.remove strips<br/>X-Principal-Id, X-Lms-Source, etc.

    Client->>EnvoyGateway: "HTTPS request to /api/ca/*"
    Note over EnvoyGateway: No SecurityPolicy on core routes<br/>(jwt-authn removed)
    EnvoyGateway->>PKISvc: Forward request
    PKISvc->>AuthzSvc: authz_client check (in-process)
    AuthzSvc-->>PKISvc: Allow / Deny
    PKISvc-->>Client: Response

    Client->>EnvoyGateway: "HTTPS request to /api/wfx/*"
    Note over EnvoyGateway: SecurityPolicy: external-authz<br/>(auth=external label)
    EnvoyGateway->>AuthzSvc: POST /v1/ext_authz/check
    AuthzSvc-->>EnvoyGateway: 200 OK / 403
    EnvoyGateway->>WFX: Forward (if allowed)
    WFX-->>Client: Response

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant Client
    participant EnvoyGateway as Envoy Gateway
    participant AuthzSvc as authz service
    participant PKISvc as PKI Service (CA/KMS/etc.)
    participant WFX

    Note over EnvoyGateway: earlyRequestHeaders.remove strips<br/>X-Principal-Id, X-Lms-Source, etc.

    Client->>EnvoyGateway: "HTTPS request to /api/ca/*"
    Note over EnvoyGateway: No SecurityPolicy on core routes<br/>(jwt-authn removed)
    EnvoyGateway->>PKISvc: Forward request
    PKISvc->>AuthzSvc: authz_client check (in-process)
    AuthzSvc-->>PKISvc: Allow / Deny
    PKISvc-->>Client: Response

    Client->>EnvoyGateway: "HTTPS request to /api/wfx/*"
    Note over EnvoyGateway: SecurityPolicy: external-authz<br/>(auth=external label)
    EnvoyGateway->>AuthzSvc: POST /v1/ext_authz/check
    AuthzSvc-->>EnvoyGateway: 200 OK / 403
    EnvoyGateway->>WFX: Forward (if allowed)
    WFX-->>Client: Response

Loading

_{Reviews (6): Last reviewed commit: "feat: add conditional http_schemas confi..." | Re-trigger Greptile}

[greptile-apps]

Migration job hardcodes pki database, breaking upgrade path

The DSN now always specifies dbname=pki regardless of what exists on the cluster. Any operator upgrading from the previous chart version — where each service had its own database (ca, kms, alerts, va, devicemanager, dmsmanager) — will see all six migration jobs fail with a "database does not exist" error because a database called pki is not present on their system. The pki database name is also not exposed in values.yaml, so there is no way to override it. Either introduce a migrations.db.database value (defaulting to pki for fresh installs) or add a prominent breaking-change note in the CHANGELOG before this PR is merged.

[jgalipienzo]

@haritzsaiz Should we include the changes of #70 in this PR?