coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
whitehat-security/plane
History
tegwick 461554a749 Record operator approval of WH-ENG-20260822-AUDIT-E2-01 
Owner acknowledgement remains pending. Offline admission stays fail-closed.
No credentials requested and no packets sent.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
2026-08-22 11:54:09 +02:00
..
namespace.yaml Add governed test plane and close T04/T08 2026-08-22 00:44:21 +02:00
network-policy.yaml Add governed test plane and close T04/T08 2026-08-22 00:44:21 +02:00
README.md Record operator approval of WH-ENG-20260822-AUDIT-E2-01 2026-08-22 11:54:09 +02:00
runner-pod.yaml Add governed test plane and close T04/T08 2026-08-22 00:44:21 +02:00
service-account.yaml Add governed test plane and close T04/T08 2026-08-22 00:44:21 +02:00

README.md

Governed test plane

This repository does not apply cluster objects, request credentials, or send packets. ops-mason provisions the foundational plane from these files before a fresh engagement is proposed. Cancelled IDs WH-ENG-20260821-AUDIT-E2 and WH-ENG-20260821-TENANT-E2 are terminal.

Ordering

  1. Foundational plane: Namespace whitehat, default-deny NetworkPolicy, audit-core egress NetworkPolicy, ServiceAccount whitehat-runner with automountServiceAccountToken: false.
  2. A new unretired engagement proposal (status: proposed).
  3. Operator approval, then target-owner acknowledgement.
  4. Custody projection of two short-lived identities into the runner mount.
  5. whitehat admit-plane, then a runner pod. Not before.

ops-mason applied step 1 on 2026-08-22 (evidence c26a6e5, bundle digest 9636f48f0b994118ff60a8c014e0099486945d66a2b3d3582dc57a09862b2035). The namespace had zero Pods and zero Secrets at apply. That apply authorizes no runner, credential, engagement or traffic.

Controls

  1. Namespace whitehat, default-deny networking, explicit target egress.
  2. Immutable runner identity with required engagement labels and no standing service-account token.
  3. Custody broker projects two short-lived tenant-scoped identities into the runner mount and revokes them. Values never enter Git, chat, evidence or State Hub.
  4. Pinned runner image digest on the engagement.
  5. Independently usable kill switch: create plane/KILL or set WHITEHAT_KILL_SWITCH=1. Admission fails closed while it is engaged.
  6. Rate watcher and automatic lease cleanup in whitehat_security.plane.

Standing versus live

fixture-e2, fixture-e3 and fixture-capacity are in-process classes already permitted by the rules of engagement. live-e2 still needs a dated engagement, target-owner acknowledgement, the provisioned plane namespace, a pinned digest and a connected custody broker. Live e3 and capacity keep separate approval classes and extra envelope fields.