coulomb/ops-mason
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
ops-mason/manifests/whitehat-plane
History
Exact
tegwick 2b318634b6 build: add guarded Kubernetes plane executor 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02878-7c21-7692-bcd6-ce2838c4b448
2026-08-22 11:23:38 +02:00
..
namespace.yaml build: add guarded Kubernetes plane executor 2026-08-22 11:23:38 +02:00
network-policy.yaml build: add guarded Kubernetes plane executor 2026-08-22 11:23:38 +02:00
README.md build: add guarded Kubernetes plane executor 2026-08-22 11:23:38 +02:00
service-account.yaml build: add guarded Kubernetes plane executor 2026-08-22 11:23:38 +02:00

README.md

Whitehat foundational plane source pins

These three YAML files are byte-for-byte pins of the selected whitehat-security contract files at coordination revision 4882c2d47a826a305d5c4e05aa7fcc1252c3887e; the implementation revision is 95129d7a35c8999be359b163b554853c9c6afa3a.

The preserved CONTRACT ONLY header means the source repository does not own or perform the apply. In this repository, only the guarded bundle executor may apply them, after validating bundles/whitehat-foundational-plane.yaml and the approved construction plan. Do not invoke kubectl apply directly on this directory.

Pinned SHA-256 digests:

  • namespace.yaml: a0919aa0c3d5f92844eeea3834fc684bc6ad112a3c4419be7f759f6b31c1d7a8
  • network-policy.yaml: 05097e33221f93f4d82da7c4d5bb688c5ec5807dc15ab4378263cddad6031610
  • service-account.yaml: 42cb5276ea2f0a555ea835fed5c14397fe76fbfa18b1acec1f3168bb1db54a5d

Excluded unconditionally: runner Pod, Secret, credential, projected identity, engagement lease, and traffic.

Rollback is generated by:

ops-mason plane rollback-plan \
  --bundle bundles/whitehat-foundational-plane.yaml

It never executes deletion. Namespace deletion remains conditional on a fresh inventory proving that no later or unrelated object entered the namespace.