tegwick
c26a6e59de
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02878-7c21-7692-bcd6-ce2838c4b448
62 lines
2.2 KiB
Markdown
62 lines
2.2 KiB
Markdown
# Whitehat foundational plane apply evidence
|
|
|
|
Applied: `2026-08-22T09:24:44Z`
|
|
Plan: `whitehat-foundational-plane`
|
|
Approved by: Bernd Worsch, 2026-08-22
|
|
Executor source: ops-mason `2b31863`
|
|
Bundle digest: `9636f48f0b994118ff60a8c014e0099486945d66a2b3d3582dc57a09862b2035`
|
|
|
|
## Provenance and guard result
|
|
|
|
- Whitehat coordination revision:
|
|
`4882c2d47a826a305d5c4e05aa7fcc1252c3887e`
|
|
- Plane implementation revision:
|
|
`95129d7a35c8999be359b163b554853c9c6afa3a`
|
|
- The three source files and Mason pins are byte-identical.
|
|
- Context `default`, create RBAC, audit-core Service TCP 8080, and
|
|
`audit-core-whitehat-ingress` exact selectors/port passed.
|
|
- All four objects were absent before apply.
|
|
- All three manifests passed client validation and server dry-run before
|
|
persistence.
|
|
|
|
## Live objects
|
|
|
|
| Object | UID | Resource version |
|
|
| --- | --- | --- |
|
|
| Namespace `whitehat` | `b0f97761-28a2-4b50-b4cb-890995fc0993` | `50841574` |
|
|
| NetworkPolicy `default-deny` | `f4143fc9-4e42-454e-867b-c3fe5a050945` | `50841577` |
|
|
| NetworkPolicy `allow-audit-core-e2` | `84ba88a8-74df-448d-b9ba-066083c49b0f` | `50841578` |
|
|
| ServiceAccount `whitehat-runner` | `6229deb0-82b8-4ca7-aee5-e00b4eff81a9` | `50841583` |
|
|
|
|
Post-apply preflight classifies every object as `exact` and server-validates
|
|
all manifests. ServiceAccount token automount is `false`. The namespace has
|
|
zero Pods and zero Secrets. Kubernetes created its normal `default`
|
|
ServiceAccount and `kube-root-ca.crt` ConfigMap; neither is part of the bundle.
|
|
|
|
No runner Pod, credential, projected identity, custody lease, new engagement,
|
|
or target request was created or sent.
|
|
|
|
## Rollback
|
|
|
|
Object-scoped rollback, in order:
|
|
|
|
```bash
|
|
kubectl -n whitehat delete networkpolicies.networking.k8s.io default-deny
|
|
kubectl -n whitehat delete networkpolicies.networking.k8s.io allow-audit-core-e2
|
|
kubectl -n whitehat delete serviceaccounts whitehat-runner
|
|
```
|
|
|
|
Before considering Namespace deletion, inventory it:
|
|
|
|
```bash
|
|
kubectl -n whitehat get all,configmaps,secrets,serviceaccounts,networkpolicies
|
|
```
|
|
|
|
Only if no later or unrelated object exists:
|
|
|
|
```bash
|
|
kubectl delete namespaces whitehat
|
|
```
|
|
|
|
No rollback command was executed. Machine-readable evidence is in
|
|
`docs/evidence/whitehat-foundational-plane.json`.
|