coulomb/ops-mason
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
ops-mason/docs/evidence/whitehat-foundational-plane.md
tegwick c26a6e59de build: provision and verify Whitehat foundational plane 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02878-7c21-7692-bcd6-ce2838c4b448
2026-08-22 11:26:49 +02:00

2.2 KiB
Raw Blame History

Whitehat foundational plane apply evidence

Applied: 2026-08-22T09:24:44Z
Plan: whitehat-foundational-plane
Approved by: Bernd Worsch, 2026-08-22
Executor source: ops-mason 2b31863
Bundle digest: 9636f48f0b994118ff60a8c014e0099486945d66a2b3d3582dc57a09862b2035

Provenance and guard result

  • Whitehat coordination revision: 4882c2d47a826a305d5c4e05aa7fcc1252c3887e
  • Plane implementation revision: 95129d7a35c8999be359b163b554853c9c6afa3a
  • The three source files and Mason pins are byte-identical.
  • Context default, create RBAC, audit-core Service TCP 8080, and audit-core-whitehat-ingress exact selectors/port passed.
  • All four objects were absent before apply.
  • All three manifests passed client validation and server dry-run before persistence.

Live objects

Object UID Resource version
Namespace whitehat b0f97761-28a2-4b50-b4cb-890995fc0993 50841574
NetworkPolicy default-deny f4143fc9-4e42-454e-867b-c3fe5a050945 50841577
NetworkPolicy allow-audit-core-e2 84ba88a8-74df-448d-b9ba-066083c49b0f 50841578
ServiceAccount whitehat-runner 6229deb0-82b8-4ca7-aee5-e00b4eff81a9 50841583

Post-apply preflight classifies every object as exact and server-validates all manifests. ServiceAccount token automount is false. The namespace has zero Pods and zero Secrets. Kubernetes created its normal default ServiceAccount and kube-root-ca.crt ConfigMap; neither is part of the bundle.

No runner Pod, credential, projected identity, custody lease, new engagement, or target request was created or sent.

Rollback

Object-scoped rollback, in order:

kubectl -n whitehat delete networkpolicies.networking.k8s.io default-deny
kubectl -n whitehat delete networkpolicies.networking.k8s.io allow-audit-core-e2
kubectl -n whitehat delete serviceaccounts whitehat-runner

Before considering Namespace deletion, inventory it:

kubectl -n whitehat get all,configmaps,secrets,serviceaccounts,networkpolicies

Only if no later or unrelated object exists:

kubectl delete namespaces whitehat

No rollback command was executed. Machine-readable evidence is in docs/evidence/whitehat-foundational-plane.json.