tegwick
2b318634b6
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02878-7c21-7692-bcd6-ce2838c4b448
61 lines
2.2 KiB
YAML
61 lines
2.2 KiB
YAML
schema_version: ops-mason.kubernetes-plane/v1
|
|
id: whitehat-foundational-plane
|
|
plan: ../plans/whitehat-foundational-plane.md
|
|
expected_context: default
|
|
expected_namespace: whitehat
|
|
source_repo: whitehat-security
|
|
source_revision: 4882c2d47a826a305d5c4e05aa7fcc1252c3887e
|
|
implementation_revision: 95129d7a35c8999be359b163b554853c9c6afa3a
|
|
evidence_path: ../docs/evidence/whitehat-foundational-plane.json
|
|
forbidden_kinds:
|
|
- Pod
|
|
- Secret
|
|
manifests:
|
|
- path: ../manifests/whitehat-plane/namespace.yaml
|
|
source_path: plane/namespace.yaml
|
|
sha256: a0919aa0c3d5f92844eeea3834fc684bc6ad112a3c4419be7f759f6b31c1d7a8
|
|
- path: ../manifests/whitehat-plane/network-policy.yaml
|
|
source_path: plane/network-policy.yaml
|
|
sha256: 05097e33221f93f4d82da7c4d5bb688c5ec5807dc15ab4378263cddad6031610
|
|
- path: ../manifests/whitehat-plane/service-account.yaml
|
|
source_path: plane/service-account.yaml
|
|
sha256: 42cb5276ea2f0a555ea835fed5c14397fe76fbfa18b1acec1f3168bb1db54a5d
|
|
allowed_objects:
|
|
- api_version: v1
|
|
kind: Namespace
|
|
resource: namespaces
|
|
name: whitehat
|
|
- api_version: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
resource: networkpolicies.networking.k8s.io
|
|
namespace: whitehat
|
|
name: default-deny
|
|
- api_version: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
resource: networkpolicies.networking.k8s.io
|
|
namespace: whitehat
|
|
name: allow-audit-core-e2
|
|
- api_version: v1
|
|
kind: ServiceAccount
|
|
resource: serviceaccounts
|
|
namespace: whitehat
|
|
name: whitehat-runner
|
|
dependencies:
|
|
- resource: services
|
|
namespace: audit-core
|
|
name: audit-core
|
|
assertions:
|
|
- path: /spec/ports/0/port
|
|
equals: 8080
|
|
- resource: networkpolicies.networking.k8s.io
|
|
namespace: audit-core
|
|
name: audit-core-whitehat-ingress
|
|
assertions:
|
|
- path: /spec/ingress/0/ports/0/port
|
|
equals: 8080
|
|
- path: /spec/ingress/0/from/0/namespaceSelector/matchLabels/kubernetes.io~1metadata.name
|
|
equals: whitehat
|
|
- path: /spec/ingress/0/from/0/podSelector/matchLabels/whitehat.security~1plane
|
|
equals: "true"
|
|
- path: /spec/ingress/0/from/0/podSelector/matchLabels/whitehat.security~1target
|
|
equals: audit-core
|