tegwick
5082f86c61
Align plane ordering with Mason's apply, record the fresh audit-core engagement as proposed, and keep offline admission fail-closed until operator approval and owner acknowledgement exist. Assistant: grok Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
33 lines
1.5 KiB
Markdown
33 lines
1.5 KiB
Markdown
# Plane provision request — not an engagement
|
|
|
|
Status: **foundational plane applied by ops-mason 2026-08-22** (`c26a6e5`).
|
|
This repository still applies nothing. Next: proposed engagement
|
|
`WH-ENG-20260822-AUDIT-E2-01`, not a runner or credential.
|
|
|
|
`WHITEHAT-WP-0001-T08` encoded the governed test plane as a contract. Live E2
|
|
still needs the cluster objects. This note asks `ops-mason` to provision the
|
|
**namespace, default-deny network policy, and runner service account** from
|
|
`plane/`. It does **not** authorize:
|
|
|
|
- applying the runner pod
|
|
- projecting credentials
|
|
- sending packets
|
|
- reusing `WH-ENG-20260821-AUDIT-E2` or `WH-ENG-20260821-TENANT-E2`
|
|
|
|
## Requested objects
|
|
|
|
| Object | File | Notes |
|
|
| --- | --- | --- |
|
|
| Namespace `whitehat` | `plane/namespace.yaml` | restricted PSS |
|
|
| Default-deny NetworkPolicy | `plane/network-policy.yaml` | audit-core egress is documented, not a standing allow for other targets |
|
|
| ServiceAccount `whitehat-runner` | `plane/service-account.yaml` | `automountServiceAccountToken: false` |
|
|
|
|
Do not create a credential secret. The live custody broker is still
|
|
unconnected; whitehat will fail closed until a later engagement ID exists.
|
|
|
|
## Next engagement (not this request)
|
|
|
|
After the namespace exists, a **new** audit-core E2 ID can be drafted. It will
|
|
need two ordinary tenant-scoped `may_read`/`may_write` fixture senders, TTL
|
|
≤ 900s, projected into the runner mount without exposing values to the agent.
|
|
That is a separate request and uses a new ID.
|