coulomb/reef-railiance
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Reconcile reef bindings and evidence

Browse source
This commit is contained in:
codex 2026-08-21 02:01:49 +02:00
parent 721398125b
commit 3e98b10d81
15 changed files with 541 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

55
evidence/admission/rail-knative-baseline.json
View file

@ -3,29 +3,60 @@
"reef_id": "reef-railiance",
"subject": "rail-knative",
"readiness_state": "verified",
"checked_at": "2026-07-26T18:00:00Z",
"checked_at": "2026-08-20T23:55:06Z",
"checks": {
"compatibility": {
"status": "pass",
"evidence": [
"../rail-knative/declarations/rail.yaml",
"../rail-kubernetes/declarations/rail.yaml"
"../rail-kubernetes/declarations/rail.yaml",
"../verification/rail-runtime-2026-08-21.json"
],
"notes": "Knative 1.22 minimum Kubernetes 1.34; observed Kubernetes 1.35.1."
},
"capacity": {
"status": "pass",
"evidence": ["../preflight/knative-2026-07-26-success.json"],
"notes": "Installation verification passed; 4 CPU remains below the generic 6 CPU recommendation."
"evidence": ["../verification/rail-runtime-2026-08-21.json"],
"notes": "All Knative control-plane deployments are available; 4 CPU remains below the generic 6 CPU recommendation."
},
"ingress": {
"status": "pass",
"evidence": [
"../verification/rail-knative-v1.22.0-2026-07-26.json",
"../verification/rail-runtime-2026-08-21.json"
],
"notes": "Kourier remains ClusterIP-only; public exposure is disabled."
},
"network": {
"status": "pass",
"evidence": [
"../verification/rail-knative-v1.22.0-2026-07-26.json",
"../verification/rail-runtime-2026-08-21.json",
"../../../rapp-qonto/evidence/live/2026-07-29-railiance01.json"
]
},
"identity_and_secrets": {
"status": "pass",
"evidence": ["../../../rapp-qonto/evidence/live/2026-07-29-railiance01.json"]
},
"observability": {
"status": "pass",
"evidence": [
"../verification/rail-knative-v1.22.0-2026-07-26.json",
"../verification/rail-runtime-2026-08-21.json"
],
"notes": "Control-plane availability and lifecycle observations are recorded."
},
"recovery": {
"status": "pass",
"evidence": [
"../verification/rail-knative-v1.22.0-2026-07-26.json",
"../../../rapp-qonto/evidence/live/2026-07-29-railiance01.json"
]
},
"ingress": {"status": "pass", "evidence": ["../verification/rail-knative-v1.22.0-2026-07-26.json"], "notes": "Kourier is verified ClusterIP-only; public exposure is disabled."},
"network": {"status": "pass", "evidence": ["../verification/rail-knative-v1.22.0-2026-07-26.json"]},
"identity_and_secrets": {"status": "unknown", "evidence": []},
"observability": {"status": "pass", "evidence": ["../verification/rail-knative-v1.22.0-2026-07-26.json"], "notes": "Control-plane availability and lifecycle observations are recorded."},
"recovery": {"status": "unknown", "evidence": []},
"failure_domain": {
"status": "fail",
"evidence": ["../preflight/knative-2026-07-26-success.json"],
"evidence": ["../verification/rail-runtime-2026-08-21.json"],
"notes": "Production approval is rejected while Knative shares the single-member control plane."
}
},
@ -33,8 +64,8 @@
{
"risk": "Single server and shared control plane for a critical bank-connected workload",
"status": "open",
"owner": "railiance-infra"
,"decision": "Not accepted for production; verified non-production rail operation may continue."
"owner": "railiance-infra",
"decision": "Not accepted for production; verified non-production rail operation may continue."
}
]
}

34
evidence/admission/rail-kubernetes-baseline.json
View file

@ -2,31 +2,43 @@
"contract_version": "1.0.0",
"reef_id": "reef-railiance",
"subject": "rail-kubernetes",
"readiness_state": "declared",
"checked_at": "2026-07-26T00:00:00Z",
"readiness_state": "verified",
"checked_at": "2026-08-20T23:55:06Z",
"checks": {
"compatibility": {
"status": "pass",
"evidence": [
"declarations/reef.yaml",
"bindings/rails.yaml",
"../rail-kubernetes/declarations/rail.yaml"
"../rail-kubernetes/declarations/rail.yaml",
"../verification/rail-runtime-2026-08-21.json"
]
},
"capacity": {
"status": "unknown",
"evidence": [],
"notes": "Automated capacity and headroom probe not yet recorded."
"status": "pass",
"evidence": ["../verification/rail-runtime-2026-08-21.json"],
"notes": "The only node is Ready with 4 CPU and 16377028Ki allocatable memory; production failure-domain risk remains open."
},
"ingress": {
"status": "pass",
"evidence": ["../verification/rail-runtime-2026-08-21.json"],
"notes": "Traefik is the observed ingress class."
},
"network": {
"status": "pass",
"evidence": [
"../verification/rail-runtime-2026-08-21.json",
"../../../rapp-qonto/evidence/live/2026-07-29-railiance01.json"
],
"notes": "NetworkPolicy objects are present and the Qonto binding has workload-level restricted-egress evidence."
},
"ingress": {"status": "unknown", "evidence": []},
"network": {"status": "unknown", "evidence": []},
"identity_and_secrets": {"status": "unknown", "evidence": []},
"observability": {"status": "unknown", "evidence": []},
"recovery": {"status": "unknown", "evidence": []},
"failure_domain": {
"status": "unknown",
"evidence": [],
"notes": "Current grouped reef has one declared member."
"status": "fail",
"evidence": ["../verification/rail-runtime-2026-08-21.json"],
"notes": "Current grouped reef has one Ready member carrying control-plane and etcd roles."
}
},
"residual_risks": [

76
evidence/verification/rail-runtime-2026-08-21.json Normal file
View file

@ -0,0 +1,76 @@
{
"schema_version": "reef-railiance.rail-runtime-evidence/v1",
"collected_at": "2026-08-20T23:55:06Z",
"collector": "reef-railiance/tools/collect_rail_runtime_evidence.sh",
"executor": "operator-ssh",
"context": "default",
"kubernetes": {
"server_version": "v1.35.1+k3s1",
"nodes": {
"total": 1,
"ready": 1,
"members": [
{
"name": "239.62.205.92.host.secureserver.net",
"roles": ["control-plane", "etcd"],
"kubelet_version": "v1.35.1+k3s1",
"allocatable": {"cpu": "4", "memory": "16377028Ki", "pods": "110"}
}
]
},
"ingress_classes": ["traefik"],
"storage_classes": ["local-path"],
"network_policy_count": 79
},
"knative": {
"deployments": [
{
"name": "activator",
"desired": 1,
"available": 1,
"images": ["gcr.io/knative-releases/knative.dev/serving/cmd/activator@sha256:8f7e9df2642a8ba715ebc55b62abee17b0984b6b6af0c6ec00dabaadf5f8cccb"]
},
{
"name": "autoscaler",
"desired": 1,
"available": 1,
"images": ["gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler@sha256:ec66d97244395b57a67923d4a8c5a95f0264805f1fdb2ee0cdb49ec0f3bd7855"]
},
{
"name": "controller",
"desired": 1,
"available": 1,
"images": ["gcr.io/knative-releases/knative.dev/serving/cmd/controller@sha256:6833f2c83e9f356c274ddb2de40e5471ad2b1c08882c9bd11f5afa240e86d574"]
},
{
"name": "net-kourier-controller",
"desired": 1,
"available": 1,
"images": ["gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier@sha256:a2e8f568a4bf68ef6391bc3afea956d11a8698f6a22c4be50844b1da4f8bcc74"]
},
{
"name": "webhook",
"desired": 1,
"available": 1,
"images": ["gcr.io/knative-releases/knative.dev/serving/cmd/webhook@sha256:c505888f7ee34ccadc1b9a6877d6d49691f633ea28cf8cbe03fcfa6d3afcd584"]
}
],
"all_deployments_available": true,
"ingress": {
"implementation": "net-kourier",
"service_type": "ClusterIP",
"cluster_ip": "10.43.29.12"
},
"services": [
{
"namespace": "rapp-qonto",
"name": "rapp-qonto",
"latest_created_revision": "rapp-qonto-00008",
"latest_ready_revision": "rapp-qonto-00008",
"ready": true
}
]
},
"failure_domain": {"independent_members_observed": 1, "result": "fail-single-node"},
"secret_values_collected": false
}