tegwick
9fbcef7b05
Concrete, reviewable placement request per docs/SecurityPractice.md #7 (I1 Reinforced minimum: dedicated node pool/namespace, given internet reachability via the facade and sole custody of the bank credential). deploy/k8s/qonto-assistant/: modeled on llm-connect's real deployment (deploy/k8s/activity-core-llm-connect/) but tightened -- dedicated namespace (not shared), Deployment starts at replicas:0 (meant to be scaled 0<->1 by the facade, QONTO-WP-0004-T05), ClusterIP-only Service, NetworkPolicy default-deny with ingress limited to the facade and egress limited to DNS+443 (the FQDN-egress limitation is called out explicitly, not silently widened). Verified: `kubectl kustomize` renders all six resources cleanly. externalsecret.yaml depends on CCR-2026-0009 (new), proposed in railiance-platform: a workload-scoped Kubernetes-auth access lane into the existing tenants/binky/qonto-api credential, since CCR-2026-0008 is human/OIDC admin access only and unusable by a running pod. Mirrors CCR-2026-0003's llm-connect/ExternalSecretsOperator pattern. Paired draft ClusterSecretStore also added there. Both validated against schemas/credential-change-request.schema.yaml. Status: proposed, not approved -- explicitly not something this repo can complete alone. railiance/app.toml: staged-promotion contract (criticality=critical, mandatory human approval before Stage 2 traffic exposure and Stage 3 promotion, per railiance-cluster/docs/app-toml-contract.md's own rule for production-critical workloads). Validated against railiance-cluster/schemas/railiance-app.schema.json. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
13 lines
565 B
YAML
13 lines
565 B
YAML
# Dedicated namespace, not shared with activity-core or any other workload.
|
|
# Per docs/SecurityPractice.md §7: qonto-assistant is the sole holder of a
|
|
# real bank credential and must be internet-reachable (via the facade,
|
|
# QONTO-WP-0004-T05) -- Kings Guard isolation profile I1 "Reinforced"
|
|
# minimum, I2 "Dedicated" worth considering. A dedicated namespace is the
|
|
# baseline either way.
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: qonto-assistant
|
|
labels:
|
|
app.kubernetes.io/part-of: qonto-assistant
|
|
railiance-platform/isolation-profile: reinforced
|