2026-08-22 00:44:21 +02:00
|
|
|
# Governed test plane
|
|
|
|
|
|
2026-08-22 11:46:58 +02:00
|
|
|
This repository does not apply cluster objects, request credentials, or send
|
|
|
|
|
packets. `ops-mason` provisions the foundational plane from these files
|
|
|
|
|
**before** a fresh engagement is proposed. Cancelled IDs
|
2026-08-22 00:44:21 +02:00
|
|
|
`WH-ENG-20260821-AUDIT-E2` and `WH-ENG-20260821-TENANT-E2` are terminal.
|
|
|
|
|
|
2026-08-22 11:46:58 +02:00
|
|
|
## Ordering
|
|
|
|
|
|
|
|
|
|
1. Foundational plane: Namespace `whitehat`, default-deny NetworkPolicy,
|
|
|
|
|
audit-core egress NetworkPolicy, ServiceAccount `whitehat-runner` with
|
|
|
|
|
`automountServiceAccountToken: false`.
|
|
|
|
|
2. A **new** unretired engagement proposal (`status: proposed`).
|
2026-08-22 11:54:09 +02:00
|
|
|
3. Operator approval, then target-owner acknowledgement.
|
2026-08-22 11:46:58 +02:00
|
|
|
4. Custody projection of two short-lived identities into the runner mount.
|
|
|
|
|
5. `whitehat admit-plane`, then a runner pod. Not before.
|
|
|
|
|
|
|
|
|
|
ops-mason applied step 1 on 2026-08-22 (evidence `c26a6e5`, bundle digest
|
|
|
|
|
`9636f48f0b994118ff60a8c014e0099486945d66a2b3d3582dc57a09862b2035`). The
|
|
|
|
|
namespace had zero Pods and zero Secrets at apply. That apply authorizes no
|
|
|
|
|
runner, credential, engagement or traffic.
|
|
|
|
|
|
2026-08-22 00:44:21 +02:00
|
|
|
## Controls
|
|
|
|
|
|
|
|
|
|
1. Namespace `whitehat`, default-deny networking, explicit target egress.
|
|
|
|
|
2. Immutable runner identity with required engagement labels and no standing
|
|
|
|
|
service-account token.
|
|
|
|
|
3. Custody broker projects two short-lived tenant-scoped identities into the
|
|
|
|
|
runner mount and revokes them. Values never enter Git, chat, evidence or
|
|
|
|
|
State Hub.
|
|
|
|
|
4. Pinned runner image digest on the engagement.
|
|
|
|
|
5. Independently usable kill switch: create `plane/KILL` or set
|
|
|
|
|
`WHITEHAT_KILL_SWITCH=1`. Admission fails closed while it is engaged.
|
|
|
|
|
6. Rate watcher and automatic lease cleanup in `whitehat_security.plane`.
|
|
|
|
|
|
|
|
|
|
## Standing versus live
|
|
|
|
|
|
2026-08-22 11:46:58 +02:00
|
|
|
`fixture-e2`, `fixture-e3` and `fixture-capacity` are in-process classes
|
|
|
|
|
already permitted by the rules of engagement. `live-e2` still needs a dated
|
|
|
|
|
engagement, target-owner acknowledgement, the provisioned plane namespace, a
|
|
|
|
|
pinned digest and a connected custody broker. Live `e3` and `capacity` keep
|
|
|
|
|
separate approval classes and extra envelope fields.
|
