tegwick
cfc9e7d0cb
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb
747 lines
16 KiB
JSON
747 lines
16 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"$id": "https://policy.coulomb.social/schemas/tenancy-posture/v0.1",
|
|
"title": "NetKingdom tenancy posture declaration v0.1",
|
|
"type": "object",
|
|
"required": [
|
|
"schema_version",
|
|
"framework"
|
|
],
|
|
"properties": {
|
|
"schema_version": {
|
|
"const": "0.1"
|
|
},
|
|
"framework": {
|
|
"const": "netkingdom-tenancy-posture"
|
|
},
|
|
"service": {
|
|
"$ref": "#/$defs/serviceName"
|
|
},
|
|
"role": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"responsible_repo": {
|
|
"$ref": "#/$defs/repoName"
|
|
},
|
|
"workload_identity": {
|
|
"$ref": "#/$defs/workloadIdentity"
|
|
},
|
|
"tenancy": {
|
|
"$ref": "#/$defs/tenancy"
|
|
},
|
|
"provider": {
|
|
"$ref": "#/$defs/provider"
|
|
},
|
|
"zones": {
|
|
"$ref": "#/$defs/zoneDeclaration"
|
|
},
|
|
"evidence": {
|
|
"$ref": "#/$defs/evidence"
|
|
},
|
|
"evidence_freshness": {
|
|
"$ref": "#/$defs/evidenceFreshness"
|
|
},
|
|
"notes": {
|
|
"$ref": "#/$defs/stringList"
|
|
},
|
|
"services": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"items": {
|
|
"$ref": "#/$defs/service"
|
|
}
|
|
}
|
|
},
|
|
"oneOf": [
|
|
{
|
|
"required": [
|
|
"service",
|
|
"role",
|
|
"tenancy"
|
|
],
|
|
"not": {
|
|
"required": [
|
|
"services"
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"required": [
|
|
"services"
|
|
],
|
|
"not": {
|
|
"anyOf": [
|
|
{
|
|
"required": [
|
|
"service"
|
|
]
|
|
},
|
|
{
|
|
"required": [
|
|
"role"
|
|
]
|
|
},
|
|
{
|
|
"required": [
|
|
"tenancy"
|
|
]
|
|
},
|
|
{
|
|
"required": [
|
|
"provider"
|
|
]
|
|
},
|
|
{
|
|
"required": [
|
|
"workload_identity"
|
|
]
|
|
},
|
|
{
|
|
"required": [
|
|
"zones"
|
|
]
|
|
},
|
|
{
|
|
"required": [
|
|
"evidence"
|
|
]
|
|
},
|
|
{
|
|
"required": [
|
|
"responsible_repo"
|
|
]
|
|
},
|
|
{
|
|
"required": [
|
|
"evidence_freshness"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|
|
],
|
|
"allOf": [
|
|
{
|
|
"if": {
|
|
"required": [
|
|
"zones"
|
|
]
|
|
},
|
|
"then": {
|
|
"required": [
|
|
"workload_identity"
|
|
]
|
|
}
|
|
}
|
|
],
|
|
"additionalProperties": false,
|
|
"$defs": {
|
|
"serviceName": {
|
|
"type": "string",
|
|
"pattern": "^[a-z0-9][a-z0-9._-]*$"
|
|
},
|
|
"repoName": {
|
|
"type": "string",
|
|
"pattern": "^[a-z0-9]+(-[a-z0-9]+)*$"
|
|
},
|
|
"axisName": {
|
|
"enum": [
|
|
"I",
|
|
"A",
|
|
"E",
|
|
"P",
|
|
"R",
|
|
"V"
|
|
]
|
|
},
|
|
"level": {
|
|
"oneOf": [
|
|
{
|
|
"type": "integer",
|
|
"minimum": 0,
|
|
"maximum": 4
|
|
},
|
|
{
|
|
"const": "n/a"
|
|
}
|
|
]
|
|
},
|
|
"axisVector": {
|
|
"type": "object",
|
|
"required": [
|
|
"I",
|
|
"A",
|
|
"E",
|
|
"P",
|
|
"R",
|
|
"V"
|
|
],
|
|
"properties": {
|
|
"I": {
|
|
"oneOf": [
|
|
{
|
|
"type": "integer",
|
|
"minimum": 0,
|
|
"maximum": 3
|
|
},
|
|
{
|
|
"const": "n/a"
|
|
}
|
|
]
|
|
},
|
|
"A": {
|
|
"$ref": "#/$defs/level"
|
|
},
|
|
"E": {
|
|
"$ref": "#/$defs/level"
|
|
},
|
|
"P": {
|
|
"$ref": "#/$defs/level"
|
|
},
|
|
"R": {
|
|
"$ref": "#/$defs/level"
|
|
},
|
|
"V": {
|
|
"$ref": "#/$defs/level"
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"partialAxisVector": {
|
|
"type": "object",
|
|
"minProperties": 1,
|
|
"properties": {
|
|
"I": {
|
|
"oneOf": [
|
|
{
|
|
"type": "integer",
|
|
"minimum": 0,
|
|
"maximum": 3
|
|
},
|
|
{
|
|
"const": "n/a"
|
|
}
|
|
]
|
|
},
|
|
"A": {
|
|
"$ref": "#/$defs/level"
|
|
},
|
|
"E": {
|
|
"$ref": "#/$defs/level"
|
|
},
|
|
"P": {
|
|
"$ref": "#/$defs/level"
|
|
},
|
|
"R": {
|
|
"$ref": "#/$defs/level"
|
|
},
|
|
"V": {
|
|
"$ref": "#/$defs/level"
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"stringMap": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
}
|
|
},
|
|
"stringList": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
}
|
|
},
|
|
"identityBinding": {
|
|
"type": "object",
|
|
"required": [
|
|
"scheme",
|
|
"authority",
|
|
"subject",
|
|
"principal_type"
|
|
],
|
|
"properties": {
|
|
"scheme": {
|
|
"type": "string",
|
|
"pattern": "^[a-z0-9]+(-[a-z0-9]+)*$",
|
|
"description": "Identity mechanism, for example iam-profile, kubernetes-service-account, ssh-certificate, or openbao-auth-role."
|
|
},
|
|
"authority": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"description": "Authoritative issuer or registry for this principal."
|
|
},
|
|
"subject": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"description": "Exact principal value asserted by the authority."
|
|
},
|
|
"principal_type": {
|
|
"enum": [
|
|
"service",
|
|
"agent"
|
|
],
|
|
"description": "IAM Profile principal type. A human identity is caller context and cannot be the sole workload identity."
|
|
},
|
|
"environment": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"evidence": {
|
|
"$ref": "#/$defs/stringList"
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"workloadIdentity": {
|
|
"type": "object",
|
|
"required": [
|
|
"name",
|
|
"kind",
|
|
"responsible_repo",
|
|
"identity_bindings"
|
|
],
|
|
"properties": {
|
|
"name": {
|
|
"$ref": "#/$defs/serviceName",
|
|
"description": "Stable workload id. It must equal the containing service field."
|
|
},
|
|
"kind": {
|
|
"enum": [
|
|
"application",
|
|
"platform-service",
|
|
"automation",
|
|
"operational-control-plane",
|
|
"maintenance-job"
|
|
]
|
|
},
|
|
"responsible_repo": {
|
|
"$ref": "#/$defs/repoName",
|
|
"description": "Repository accountable for the workload identity and zone declaration."
|
|
},
|
|
"declaration_ref": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"description": "Authoritative owner declaration. Required by RMGR-ADR-004 for a managed deployable, for example rapp-user-engine/declarations/rapp.yaml."
|
|
},
|
|
"identity_bindings": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"items": {
|
|
"$ref": "#/$defs/identityBinding"
|
|
}
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"zoneEvidence": {
|
|
"type": "object",
|
|
"required": [
|
|
"ref",
|
|
"supports"
|
|
],
|
|
"properties": {
|
|
"ref": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"supports": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"uniqueItems": true,
|
|
"items": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
}
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"zoneDeclaration": {
|
|
"type": "object",
|
|
"required": [
|
|
"standard",
|
|
"membership",
|
|
"responsible_party",
|
|
"justification",
|
|
"context",
|
|
"evidence",
|
|
"reviewed",
|
|
"review_due"
|
|
],
|
|
"properties": {
|
|
"standard": {
|
|
"const": "security-zones_v0.1"
|
|
},
|
|
"membership": {
|
|
"enum": [
|
|
"z0-experimental",
|
|
"z1-operational",
|
|
"z2-protected",
|
|
"z3-critical",
|
|
"z2-continuity"
|
|
]
|
|
},
|
|
"responsible_party": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"justification": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"context": {
|
|
"type": "object",
|
|
"required": [
|
|
"maturity",
|
|
"criticality",
|
|
"data_classification"
|
|
],
|
|
"properties": {
|
|
"maturity": {
|
|
"enum": ["M0", "M1", "M2", "M3"]
|
|
},
|
|
"criticality": {
|
|
"enum": ["low", "medium", "high", "critical", "n/a"]
|
|
},
|
|
"data_classification": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"evidence": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"items": {
|
|
"$ref": "#/$defs/zoneEvidence"
|
|
}
|
|
},
|
|
"reviewed": {
|
|
"type": "string",
|
|
"format": "date"
|
|
},
|
|
"review_due": {
|
|
"type": "string",
|
|
"format": "date"
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"paths": {
|
|
"type": "object",
|
|
"propertyNames": {
|
|
"$ref": "#/$defs/axisName"
|
|
},
|
|
"additionalProperties": {
|
|
"type": "object",
|
|
"minProperties": 1,
|
|
"additionalProperties": {
|
|
"$ref": "#/$defs/level"
|
|
}
|
|
}
|
|
},
|
|
"placementException": {
|
|
"type": "object",
|
|
"required": [
|
|
"tenants",
|
|
"P",
|
|
"reason"
|
|
],
|
|
"properties": {
|
|
"tenants": {
|
|
"$ref": "#/$defs/stringList"
|
|
},
|
|
"P": {
|
|
"type": "integer",
|
|
"minimum": 0,
|
|
"maximum": 4
|
|
},
|
|
"reason": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"tier_ref": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"tenancy": {
|
|
"type": "object",
|
|
"required": [
|
|
"current",
|
|
"target",
|
|
"reviewed",
|
|
"review_due",
|
|
"service_class"
|
|
],
|
|
"properties": {
|
|
"current": {
|
|
"$ref": "#/$defs/axisVector"
|
|
},
|
|
"implemented": {
|
|
"$ref": "#/$defs/partialAxisVector"
|
|
},
|
|
"target": {
|
|
"$ref": "#/$defs/axisVector"
|
|
},
|
|
"reviewed": {
|
|
"type": "string",
|
|
"format": "date"
|
|
},
|
|
"review_due": {
|
|
"type": "string",
|
|
"format": "date"
|
|
},
|
|
"service_class": {
|
|
"enum": [
|
|
"latency-critical",
|
|
"interactive",
|
|
"batch"
|
|
]
|
|
},
|
|
"permanent": {
|
|
"type": "array",
|
|
"uniqueItems": true,
|
|
"items": {
|
|
"$ref": "#/$defs/axisName"
|
|
}
|
|
},
|
|
"reason": {
|
|
"$ref": "#/$defs/stringMap"
|
|
},
|
|
"gap": {
|
|
"$ref": "#/$defs/stringMap"
|
|
},
|
|
"paths": {
|
|
"$ref": "#/$defs/paths"
|
|
},
|
|
"placement_exceptions": {
|
|
"type": "array",
|
|
"items": {
|
|
"$ref": "#/$defs/placementException"
|
|
}
|
|
},
|
|
"secondary_stores": {
|
|
"$ref": "#/$defs/stringList"
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"providerAxis": {
|
|
"type": "object",
|
|
"required": [
|
|
"available",
|
|
"maximum"
|
|
],
|
|
"properties": {
|
|
"available": {
|
|
"$ref": "#/$defs/level"
|
|
},
|
|
"maximum": {
|
|
"$ref": "#/$defs/level"
|
|
},
|
|
"conditions": {
|
|
"$ref": "#/$defs/stringList"
|
|
},
|
|
"evidence": {
|
|
"$ref": "#/$defs/stringList"
|
|
},
|
|
"reason": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"provider": {
|
|
"type": "object",
|
|
"required": [
|
|
"axes"
|
|
],
|
|
"properties": {
|
|
"capability": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"profile": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"axes": {
|
|
"type": "object",
|
|
"minProperties": 1,
|
|
"properties": {
|
|
"I": {
|
|
"$ref": "#/$defs/providerAxis"
|
|
},
|
|
"A": {
|
|
"$ref": "#/$defs/providerAxis"
|
|
},
|
|
"E": {
|
|
"$ref": "#/$defs/providerAxis"
|
|
},
|
|
"P": {
|
|
"$ref": "#/$defs/providerAxis"
|
|
},
|
|
"R": {
|
|
"$ref": "#/$defs/providerAxis"
|
|
},
|
|
"V": {
|
|
"$ref": "#/$defs/providerAxis"
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"evidence": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"oneOf": [
|
|
{
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
{
|
|
"$ref": "#/$defs/stringList"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"evidenceFreshnessEntry": {
|
|
"type": "object",
|
|
"required": [
|
|
"kind",
|
|
"observed_at",
|
|
"responsible_repo",
|
|
"scope",
|
|
"remediation"
|
|
],
|
|
"properties": {
|
|
"kind": {
|
|
"enum": [
|
|
"mechanical",
|
|
"adversarial"
|
|
]
|
|
},
|
|
"observed_at": {
|
|
"type": "string",
|
|
"format": "date-time"
|
|
},
|
|
"valid_until": {
|
|
"type": "string",
|
|
"format": "date-time"
|
|
},
|
|
"responsible_repo": {
|
|
"$ref": "#/$defs/repoName"
|
|
},
|
|
"scope": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"remediation": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"source_revision": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
}
|
|
},
|
|
"allOf": [
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"kind": {
|
|
"const": "adversarial"
|
|
}
|
|
},
|
|
"required": [
|
|
"kind"
|
|
]
|
|
},
|
|
"then": {
|
|
"required": [
|
|
"valid_until"
|
|
]
|
|
}
|
|
}
|
|
],
|
|
"additionalProperties": false
|
|
},
|
|
"evidenceFreshness": {
|
|
"type": "object",
|
|
"patternProperties": {
|
|
"^[IAEPRV][0-4]$": {
|
|
"$ref": "#/$defs/evidenceFreshnessEntry"
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"service": {
|
|
"type": "object",
|
|
"required": [
|
|
"service",
|
|
"role",
|
|
"tenancy"
|
|
],
|
|
"properties": {
|
|
"service": {
|
|
"$ref": "#/$defs/serviceName"
|
|
},
|
|
"role": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"responsible_repo": {
|
|
"$ref": "#/$defs/repoName"
|
|
},
|
|
"workload_identity": {
|
|
"$ref": "#/$defs/workloadIdentity"
|
|
},
|
|
"tenancy": {
|
|
"$ref": "#/$defs/tenancy"
|
|
},
|
|
"provider": {
|
|
"$ref": "#/$defs/provider"
|
|
},
|
|
"evidence": {
|
|
"$ref": "#/$defs/evidence"
|
|
},
|
|
"evidence_freshness": {
|
|
"$ref": "#/$defs/evidenceFreshness"
|
|
},
|
|
"notes": {
|
|
"$ref": "#/$defs/stringList"
|
|
},
|
|
"zones": {
|
|
"$ref": "#/$defs/zoneDeclaration"
|
|
}
|
|
},
|
|
"allOf": [
|
|
{
|
|
"if": {
|
|
"required": [
|
|
"zones"
|
|
]
|
|
},
|
|
"then": {
|
|
"required": [
|
|
"workload_identity"
|
|
]
|
|
}
|
|
}
|
|
],
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
}
|