schema_version: ops-mason.kubernetes-plane/v1
id: whitehat-foundational-plane
plan: ../plans/whitehat-foundational-plane.md
expected_context: default
expected_namespace: whitehat
source_repo: whitehat-security
source_revision: 4882c2d47a826a305d5c4e05aa7fcc1252c3887e
implementation_revision: 95129d7a35c8999be359b163b554853c9c6afa3a
evidence_path: ../docs/evidence/whitehat-foundational-plane.json
forbidden_kinds:
  - Pod
  - Secret
manifests:
  - path: ../manifests/whitehat-plane/namespace.yaml
    source_path: plane/namespace.yaml
    sha256: a0919aa0c3d5f92844eeea3834fc684bc6ad112a3c4419be7f759f6b31c1d7a8
  - path: ../manifests/whitehat-plane/network-policy.yaml
    source_path: plane/network-policy.yaml
    sha256: 05097e33221f93f4d82da7c4d5bb688c5ec5807dc15ab4378263cddad6031610
  - path: ../manifests/whitehat-plane/service-account.yaml
    source_path: plane/service-account.yaml
    sha256: 42cb5276ea2f0a555ea835fed5c14397fe76fbfa18b1acec1f3168bb1db54a5d
allowed_objects:
  - api_version: v1
    kind: Namespace
    resource: namespaces
    name: whitehat
  - api_version: networking.k8s.io/v1
    kind: NetworkPolicy
    resource: networkpolicies.networking.k8s.io
    namespace: whitehat
    name: default-deny
  - api_version: networking.k8s.io/v1
    kind: NetworkPolicy
    resource: networkpolicies.networking.k8s.io
    namespace: whitehat
    name: allow-audit-core-e2
  - api_version: v1
    kind: ServiceAccount
    resource: serviceaccounts
    namespace: whitehat
    name: whitehat-runner
dependencies:
  - resource: services
    namespace: audit-core
    name: audit-core
    assertions:
      - path: /spec/ports/0/port
        equals: 8080
  - resource: networkpolicies.networking.k8s.io
    namespace: audit-core
    name: audit-core-whitehat-ingress
    assertions:
      - path: /spec/ingress/0/ports/0/port
        equals: 8080
      - path: /spec/ingress/0/from/0/namespaceSelector/matchLabels/kubernetes.io~1metadata.name
        equals: whitehat
      - path: /spec/ingress/0/from/0/podSelector/matchLabels/whitehat.security~1plane
        equals: "true"
      - path: /spec/ingress/0/from/0/podSelector/matchLabels/whitehat.security~1target
        equals: audit-core