coulomb/ops-mason
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

build: provision and verify Whitehat foundational plane

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02878-7c21-7692-bcd6-ce2838c4b448
This commit is contained in:
tegwick 2026-08-22 11:26:49 +02:00
parent acab22ff25
commit c26a6e59de
6 changed files with 244 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
tests/test_kubernetes_plane.py
View file

@ -28,7 +28,10 @@ def test_whitehat_bundle_is_exactly_four_allowlisted_objects() -> None:
"NetworkPolicy/whitehat/allow-audit-core-e2",
"ServiceAccount/whitehat/whitehat-runner",
]
assert bundle.plan().is_approved()
plan = bundle.plan()
assert plan.status == "built"
assert plan.approved_by == "Bernd Worsch"
assert plan.approved_at == "2026-08-22"
assert {doc["kind"] for doc in bundle.documents} == {
"Namespace",
"NetworkPolicy",
@ -234,6 +237,11 @@ def test_apply_runs_guarded_path_and_writes_metadata_only_evidence(tmp_path: Pat
runner=cluster,
)
assert evidence["verification"]["negative_scope"] == {"pods": 0, "secrets": 0}
assert evidence["apply"] == {
"field_manager": "ops-mason",
"server_validated_manifests": ["manifests/plane.yaml"],
"persisted_manifests": ["manifests/plane.yaml"],
}
assert bundle.evidence_path.exists()
text = bundle.evidence_path.read_text()
assert "uid-1" in text