Reconcile reef bindings and evidence

tools/collect_rail_runtime_evidence.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Read-only, secret-free evidence collector for the rails hosted by this reef.
+# The cluster API is intentionally reached through the operator SSH path; 6443
+# remains non-public. Override only when the approved executor name changes.
+remote_host="${RAIL_RUNTIME_HOST:-railiance01}"
+
+ssh -o BatchMode=yes "$remote_host" 'bash -s' <<'REMOTE'
+set -euo pipefail
+
+context="$(kubectl config current-context)"
+server_version="$(kubectl version -o json | jq -r '.serverVersion.gitVersion')"
+nodes="$(kubectl get nodes -o json)"
+knative_deployments="$(kubectl -n knative-serving get deployments -o json)"
+kourier_service="$(kubectl -n kourier-system get service kourier -o json)"
+knative_services="$(kubectl get ksvc -A -o json)"
+ingress_classes="$(kubectl get ingressclass -o json)"
+storage_classes="$(kubectl get storageclass -o json)"
+network_policy_count="$(kubectl get networkpolicy -A -o json | jq '.items | length')"
+
+jq -n \
+  --arg context "$context" \
+  --arg server_version "$server_version" \
+  --argjson nodes "$nodes" \
+  --argjson deployments "$knative_deployments" \
+  --argjson kourier "$kourier_service" \
+  --argjson services "$knative_services" \
+  --argjson ingress_classes "$ingress_classes" \
+  --argjson storage_classes "$storage_classes" \
+  --argjson network_policy_count "$network_policy_count" \
+  '{
+    schema_version: "reef-railiance.rail-runtime-evidence/v1",
+    collected_at: (now | todateiso8601),
+    collector: "reef-railiance/tools/collect_rail_runtime_evidence.sh",
+    executor: "operator-ssh",
+    context: $context,
+    kubernetes: {
+      server_version: $server_version,
+      nodes: {
+        total: ($nodes.items | length),
+        ready: ([$nodes.items[] | select(any(.status.conditions[]; .type == "Ready" and .status == "True"))] | length),
+        members: [$nodes.items[] | {
+          name: .metadata.name,
+          roles: ([.metadata.labels | keys[] | select(startswith("node-role.kubernetes.io/")) | split("/")[1]] | sort),
+          kubelet_version: .status.nodeInfo.kubeletVersion,
+          allocatable: {
+            cpu: .status.allocatable.cpu,
+            memory: .status.allocatable.memory,
+            pods: .status.allocatable.pods
+          }
+        }]
+      },
+      ingress_classes: [$ingress_classes.items[].metadata.name] | sort,
+      storage_classes: [$storage_classes.items[].metadata.name] | sort,
+      network_policy_count: $network_policy_count
+    },
+    knative: {
+      deployments: [$deployments.items[] | {
+        name: .metadata.name,
+        desired: (.spec.replicas // 0),
+        available: (.status.availableReplicas // 0),
+        images: [.spec.template.spec.containers[].image]
+      }] | sort_by(.name),
+      all_deployments_available: (all($deployments.items[]; (.status.availableReplicas // 0) >= (.spec.replicas // 0))),
+      ingress: {
+        implementation: "net-kourier",
+        service_type: $kourier.spec.type,
+        cluster_ip: $kourier.spec.clusterIP
+      },
+      services: [$services.items[] | {
+        namespace: .metadata.namespace,
+        name: .metadata.name,
+        latest_created_revision: .status.latestCreatedRevisionName,
+        latest_ready_revision: .status.latestReadyRevisionName,
+        ready: (any(.status.conditions[]?; .type == "Ready" and .status == "True"))
+      }] | sort_by(.namespace, .name)
+    },
+    failure_domain: {
+      independent_members_observed: ($nodes.items | length),
+      result: (if ($nodes.items | length) > 1 then "requires-source-backed-review" else "fail-single-node" end)
+    },
+    secret_values_collected: false
+  }'
+REMOTE