tegwick
9fbcef7b05
Concrete, reviewable placement request per docs/SecurityPractice.md #7 (I1 Reinforced minimum: dedicated node pool/namespace, given internet reachability via the facade and sole custody of the bank credential). deploy/k8s/qonto-assistant/: modeled on llm-connect's real deployment (deploy/k8s/activity-core-llm-connect/) but tightened -- dedicated namespace (not shared), Deployment starts at replicas:0 (meant to be scaled 0<->1 by the facade, QONTO-WP-0004-T05), ClusterIP-only Service, NetworkPolicy default-deny with ingress limited to the facade and egress limited to DNS+443 (the FQDN-egress limitation is called out explicitly, not silently widened). Verified: `kubectl kustomize` renders all six resources cleanly. externalsecret.yaml depends on CCR-2026-0009 (new), proposed in railiance-platform: a workload-scoped Kubernetes-auth access lane into the existing tenants/binky/qonto-api credential, since CCR-2026-0008 is human/OIDC admin access only and unusable by a running pod. Mirrors CCR-2026-0003's llm-connect/ExternalSecretsOperator pattern. Paired draft ClusterSecretStore also added there. Both validated against schemas/credential-change-request.schema.yaml. Status: proposed, not approved -- explicitly not something this repo can complete alone. railiance/app.toml: staged-promotion contract (criticality=critical, mandatory human approval before Stage 2 traffic exposure and Stage 3 promotion, per railiance-cluster/docs/app-toml-contract.md's own rule for production-critical workloads). Validated against railiance-cluster/schemas/railiance-app.schema.json. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
20 lines
616 B
YAML
20 lines
616 B
YAML
# ClusterIP only. Per docs/SecurityPractice.md §5: qonto-assistant's raw
|
|
# port must never be bound to a publicly-reachable address in any
|
|
# deployment -- the facade (QONTO-WP-0004-T05) is the sole internet-facing
|
|
# component and reaches this Service from inside the cluster.
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: qonto-assistant
|
|
namespace: qonto-assistant
|
|
labels:
|
|
app.kubernetes.io/name: qonto-assistant
|
|
app.kubernetes.io/part-of: qonto-assistant
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app.kubernetes.io/name: qonto-assistant
|
|
ports:
|
|
- name: http
|
|
port: 8080
|
|
targetPort: http
|