From e8876c453f3cbf71b3c1489104258d6463a217c9 Mon Sep 17 00:00:00 2001 From: Your Name Date: Sun, 14 Jun 2026 19:14:12 +0800 Subject: [PATCH] =?UTF-8?q?docs(security):=20=E6=96=B0=E5=A2=9E=20K8s=20Ar?= =?UTF-8?q?goCD=20manifest=20=E6=B8=85=E5=86=8A=20[skip=20ci]?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/LOGBOOK.md | 27 + .../HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md | 6 + .../IWOOOS-CONFIG-CONTROL-INVENTORY.md | 2 + .../security/K8S-ARGOCD-MANIFEST-INVENTORY.md | 118 ++ .../SECURITY-SUPPLY-CHAIN-PROGRESS.md | 3 +- ...8s-argocd-manifest-inventory.snapshot.json | 1534 +++++++++++++++++ ...-04-15-MASTER-ai-autonomous-flywheel-v2.md | 15 + ...026-06-04-iwooos-security-governance-p0.md | 7 +- .../security/k8s-argocd-manifest-inventory.py | 329 ++++ .../security-mirror-progress-guard.py | 148 ++ 10 files changed, 2185 insertions(+), 4 deletions(-) create mode 100644 docs/security/K8S-ARGOCD-MANIFEST-INVENTORY.md create mode 100644 docs/security/k8s-argocd-manifest-inventory.snapshot.json create mode 100644 scripts/security/k8s-argocd-manifest-inventory.py diff --git a/docs/LOGBOOK.md b/docs/LOGBOOK.md index 7fd9bc7f1..00d95fdb9 100644 --- a/docs/LOGBOOK.md +++ b/docs/LOGBOOK.md @@ -1,3 +1,30 @@ +## 2026-06-14｜K8s / ArgoCD manifest repo-only 清冊本地完成 + +**背景**：K8s / ArgoCD / production manifests 會直接影響 Deployment、CronJob、RBAC、NetworkPolicy、Secret metadata、Velero restore 與 monitoring rule。高價值配置 coverage 已指出尚未把 ArgoCD health / sync readback 與 rollback revision 收成 owner packet；因此先建立 repo-only manifest inventory，避免之後把 ArgoCD sync 或 `kubectl` 操作當成低風險變更。 + +**完成項目**： +- 新增 `scripts/security/k8s-argocd-manifest-inventory.py`，只讀 `k8s/awoooi-prod`、`k8s/argocd`、`k8s/velero`、`k8s/monitoring` source files，產生 path、SHA256、top-level `kind:` marker 與 owner gate 缺口。 +- 新增 `docs/security/k8s-argocd-manifest-inventory.snapshot.json`，固定 `file_count=49`、`c0_file_count=36`、`c1_file_count=13`、`yaml_manifest_file_count=45`、`unique_kind_count=20`、`top_level_kind_marker_count=56`。 +- 新增 `docs/security/K8S-ARGOCD-MANIFEST-INVENTORY.md`，說明 scan groups、owner 必填欄位、evidence 缺口、blocked actions 與完成度。 +- `security-mirror-progress-guard.py` 已鎖住新 snapshot 的 schema、summary、execution false flags、group ids、kind counts、blocked actions 與每列 false flags。 +- `SECURITY-SUPPLY-CHAIN-PROGRESS.md`、P0 主控板、`IWOOOS-CONFIG-CONTROL-INVENTORY.md` 與 MASTER 已同步 P0-20。 + +**本地驗證**： +- `python3 -m json.tool docs/security/k8s-argocd-manifest-inventory.snapshot.json` 通過。 +- `python3 -m py_compile scripts/security/k8s-argocd-manifest-inventory.py scripts/security/security-mirror-progress-guard.py` 通過。 +- 產生器 smoke：`K8S_ARGOCD_MANIFEST_INVENTORY_OK files=49 c0=36 yaml=45 kinds=20 runtime_gate=0`。 +- `python3 scripts/security/security-mirror-progress-guard.py --root .` → `SECURITY_MIRROR_PROGRESS_GUARD_OK`。 +- `python3 scripts/security/source-control-owner-response-guard.py --root .` → `SOURCE_CONTROL_OWNER_RESPONSE_GUARD_OK`。 +- `python3 scripts/ops/doc-secrets-sanity-check.py docs .gitea` → `DOC_SECRET_SANITY_OK scanned_files=822`。 +- `git diff --check` 通過。 +- diff-only 工作溝通片語掃描通過；未加入工作溝通原文、委派 XML、內嵌瀏覽器上下文或內部抱怨內容。 +- Snapshot assertion 通過：`K8S_ARGOCD_MANIFEST_INVENTORY_ASSERTIONS_OK files=49 c0=36 yaml=45 kinds=20 blocked=13 runtime_gate=0`。 + +**完成度與邊界**： +- P0-20 K8s / ArgoCD manifest repo-only 清冊：`100%`。 +- Production browser verification：不適用；本輪只改 repo 內文件、snapshot、guard 與產生器，不變更前端 bundle 或 runtime。 +- owner response、rendered manifest diff、ArgoCD health readback、ArgoCD sync、kubectl action、live cluster read、secret collection、manual pod restart、scale workload、RBAC / NetworkPolicy change、restore backup、live evidence、runtime gate、action buttons、production write 全部維持 `0 / false`。 + ## 2026-06-14｜DNS / TLS / certbot owner confirmation request 本地完成 **背景**：DNS / TLS / certbot 屬於公開入口即時風險配置；既有 repo-only 清冊已指出 4 個 domain 的 `server_name` 與 certificate path domain 不同。這不直接代表錯誤或 TLS 失效，但必須先由 owner 以脫敏 evidence 確認 SAN、wildcard 或共用憑證覆蓋關係，才能再談 DNS query、TLS probe、certbot renew 或 Nginx reload。 diff --git a/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md b/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md index b6ce9151f..50566ce9d 100644 --- a/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md +++ b/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md @@ -26,6 +26,12 @@ 此同步只修正長期覆蓋矩陣與變更 Gate 的一致性，不代表 live evidence 已收到，也不代表可執行 `nginx -t`、reload、certbot renew 或 DNS / TLS 變更。 +## 1.2 2026-06-14 K8s / ArgoCD manifest repo-only 清冊 + +已新增 `docs/security/K8S-ARGOCD-MANIFEST-INVENTORY.md` 與 `docs/security/k8s-argocd-manifest-inventory.snapshot.json`，將 `k8s/awoooi-prod`、`k8s/argocd`、`k8s/velero`、`k8s/monitoring` 轉成 repo-only manifest inventory。 + +目前固定為 `file_count=49`、`c0_file_count=36`、`yaml_manifest_file_count=45`、`unique_kind_count=20`、`top_level_kind_marker_count=56`、`blocked_action_count=13`、`runtime_gate_count=0`。此 artifact 只補上 K8s / ArgoCD source inventory 的可重跑基線；owner request、rendered manifest diff、ArgoCD health readback、ArgoCD sync、kubectl action、live cluster read 與 production write 仍全部未授權。 + ## 2. 覆蓋摘要 | 指標 | 目前值 | 說明 | diff --git a/docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md b/docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md index c50a62be8..92f0cfafd 100644 --- a/docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md +++ b/docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md @@ -146,6 +146,8 @@ Nginx 是目前必須最先資安控管的配置，原因是它同時控制公 | P2 | Package / supply-chain baselines | `pnpm-lock.yaml`、`package.json`、Dockerfiles、inventory snapshots | repo owner | lockfile drift, CVE / license policy, image digest evidence | | P3 | Runbook / endpoint docs / snapshots | `docs/reference/*`、`docs/runbooks/*`、`docs/security/*.snapshot.json` | doc owner | no secret value, stale endpoint flag, owner-reviewed evidence refs | +2026-06-14 P0-20 已新增 `docs/security/K8S-ARGOCD-MANIFEST-INVENTORY.md` 與 `docs/security/k8s-argocd-manifest-inventory.snapshot.json`，把 K8s / ArgoCD / Velero / monitoring repo source 固定為 `files=49`、`c0=36`、`yaml=45`、`unique_kinds=20`、`blocked_actions=13` 的只讀清冊。這只是 repo-only manifest inventory，不是 live cluster read、ArgoCD API read、ArgoCD sync、kubectl action、Helm upgrade、secret collection、manual pod restart、scale workload、RBAC / NetworkPolicy change、restore backup、production write 或 runtime gate。 + ## 4. 新增規範 1. 高價值配置必須先分級：C0 / C1 / C2 / C3。 diff --git a/docs/security/K8S-ARGOCD-MANIFEST-INVENTORY.md b/docs/security/K8S-ARGOCD-MANIFEST-INVENTORY.md new file mode 100644 index 000000000..c14124d96 --- /dev/null +++ b/docs/security/K8S-ARGOCD-MANIFEST-INVENTORY.md @@ -0,0 +1,118 @@ +# IwoooS K8s / ArgoCD Production Manifest Repo-only 清冊 + +| 項目 | 內容 | +|------|------| +| 日期 | 2026-06-14 | +| 狀態 | `repo_only_inventory_ready_no_live_cluster_read` | +| 工具 | `scripts/security/k8s-argocd-manifest-inventory.py` | +| Snapshot | `docs/security/k8s-argocd-manifest-inventory.snapshot.json` | +| runtime gate | `0` | + +## 1. 目的 + +K8s / ArgoCD / production manifests 會直接影響部署、replica、cronjob、RBAC、NetworkPolicy、Secret metadata、Velero restore、PrometheusRule 與 public service exposure。這些配置一旦被未審查修改，可能造成壞部署、自動同步、權限擴張、告警失效或備援誤操作。 + +本清冊只讀 repo 內 `k8s/awoooi-prod`、`k8s/argocd`、`k8s/velero`、`k8s/monitoring` source files，整理 path、SHA256、top-level `kind:` marker 與 owner gate 缺口。它不做 `kubectl`、不連 ArgoCD、不讀 live cluster、不套用 manifest、不 sync、不改 secret。 + +## 2. 摘要 + +| 指標 | 值 | 說明 | +|------|----|------| +| scan group count | `4` | production、ArgoCD、Velero、monitoring | +| file count | `49` | 四個 root 下所有 source files | +| C0 / C1 file count | `36 / 13` | production / ArgoCD / Velero 為 C0；monitoring 為 C1 | +| YAML manifest / supporting source | `45 / 4` | `.yaml` / `.yml` 與 README / shell / patch 類支援檔 | +| unique kind count | `20` | repo-only top-level `kind:` marker | +| top-level kind marker count | `56` | 非完整 schema validation，只記 repo marker | +| Deployment / CronJob | `5 / 5` | workload 與排程會影響 runtime | +| Secret / RBAC / NetworkPolicy | `6 / 5 / 6` | 權限與流量控管面 | +| Autoscaling / PrometheusRule | `6 / 4` | HPA / VPA 與告警規則 | +| ArgoCD Application | `1` | `k8s/argocd/awoooi-prod-app.yaml` | +| owner response received / accepted | `0 / 0` | 尚未收到，尚未驗收 | +| rendered manifest diff / ArgoCD health readback | `0 / 0` | 尚未產生或接收 | +| ArgoCD sync / kubectl action | `0 / 0` | 尚未批准且未執行 | +| runtime gate / action button | `0 / 0` | 未開啟 | + +## 3. 掃描分組 + +| Group | Tier | Files | YAML | Supporting | 邊界 | +|-------|------|-------|------|------------|------| +| `awoooi_prod` | `C0` | `25` | `24` | `1` | production namespace manifests；不得由清冊直接套用 | +| `argocd` | `C0` | `4` | `3` | `1` | ArgoCD application 與 metrics exposure；不得由清冊直接 sync | +| `velero` | `C0` | `7` | `6` | `1` | backup / restore manifests；不得由清冊直接 restore | +| `monitoring` | `C1` | `13` | `12` | `1` | alert source 與 monitoring config；不得由清冊直接 reload | + +## 4. Owner 必填欄位 + +任何 production manifest change、ArgoCD sync、kubectl action、secret metadata 變更、Velero restore 或 monitoring rule reload 候選，都至少要具備： + +1. `owner_role_or_team` +2. `decision` +3. `decision_reason` +4. `affected_scope` +5. `redacted_evidence_refs` +6. `argocd_health_readback_ref` +7. `argocd_sync_revision_ref` +8. `rollback_revision` +9. `followup_owner` +10. `maintenance_window` +11. `validation_plan` + +## 5. Evidence 缺口 + +| 缺口 | 目前狀態 | +|------|----------| +| owner response | `0` | +| rendered manifest diff | `0` | +| ArgoCD health readback | `0` | +| ArgoCD sync revision | `0` | +| kubectl dry-run / server validation plan | `0` | +| rollout blast radius | `0` | +| rollback revision | `0` | +| postcheck metrics | `0` | + +## 6. 阻擋動作 + +本清冊不得被用來授權以下動作： + +1. `argocd_sync` +2. `kubectl_apply` +3. `kubectl_patch` +4. `kubectl_delete` +5. `helm_upgrade` +6. `secret_value_collection` +7. `live_cluster_write` +8. `manual_pod_restart` +9. `scale_workload` +10. `change_network_policy` +11. `change_rbac` +12. `restore_backup` +13. `open_runtime_gate` + +## 7. 指令 + +產生 committed snapshot： + +```bash +python3 scripts/security/k8s-argocd-manifest-inventory.py \ + --root . \ + --output docs/security/k8s-argocd-manifest-inventory.snapshot.json \ + --generated-at 2026-06-14T21:05:00+08:00 +``` + +驗證 guard： + +```bash +python3 scripts/security/security-mirror-progress-guard.py --root . +``` + +## 8. 完成度 + +| 工作 | 完成度 | 說明 | +|------|--------|------| +| repo-only manifest inventory | `100%` | 49 個 source files、45 個 YAML manifest、20 類 top-level kind marker 已固定 | +| owner request draft | `0%` | 尚未把清冊轉成逐 group owner request | +| live ArgoCD / K8s readback | `0%` | 尚未批准且未執行 | +| rendered manifest diff | `0%` | 尚未產生 | +| ArgoCD sync / kubectl action | `0%` | 未授權且未執行 | +| runtime gate / production write | `0%` | 未授權且未執行 | diff --git a/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md b/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md index 68f92eb87..13635fde2 100644 --- a/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md +++ b/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md @@ -7,7 +7,7 @@ | 本階段完成 | 資安供應鏈 contract manifest + Source Control Approval Board + Draft Reconcile Plan + Ref Detail Diff + Ref Truth Classification + Source Control Ref Truth Owner Response 收件包 + GitHub Primary Readiness Gate + GitHub Primary Rollback ADR + GitHub Target Owner Decision Response 收件包 + Gitea 認證清冊匯出請求 + Gitea 認證清冊匯入驗收契約 + Gitea 清冊覆蓋 Owner Attestation + Gitea Owner Attestation Approval Lane 對齊 + Gitea Owner Attestation Response 收件包 + Workflow / Secret Name Inventory + Workflow / Secret Name Local Evidence + Workflow / Secret Name Redacted Export Request + Workflow / Secret Name Owner Response 收件包 + Source Control Owner Response Validation Rollup + Kali 112 live integration status + Security Finding contract + Kali scan scope approval package + Security Approval Queue + S3 人工批准 Gate + S3 人工決策紀錄 + S3 人工審查封包 + S3 人工決策狀態轉移 + S3 後續 runtime gate 準備契約 + 鏡像 readiness index + 鏡像接收計畫 + 鏡像事件信封 + 鏡像路由矩陣 + 鏡像驗收契約 + 鏡像隔離契約 + 鏡像 dry-run 報告契約 + 鏡像狀態彙整契約 + IwoooS 前端態勢入口 + IwoooS posture projection contract + IwoooS 既有前端資安頁面整合 + IwoooS 覆蓋與邊界矩陣 + IwoooS 只讀資安處理旅程 + IwoooS owner evidence readiness board + IwoooS host coverage view + IwoooS host action gate matrix + IwoooS host evidence readiness board + IwoooS host evidence collection order + IwoooS host evidence intake preflight + IwoooS host evidence review outcome lanes + IwoooS host evidence review handoff packets + IwoooS host evidence reviewer checklist + IwoooS host evidence reviewer outcome lanes + IwoooS host owner decision candidate packets + IwoooS host owner decision review checklist + IwoooS host owner decision review outcome lanes + IwoooS host owner decision record draft packets + IwoooS host owner decision record draft review checklist + IwoooS host owner decision record draft review outcome lanes + IwoooS host owner decision record write-up packets + IwoooS host owner decision record write-up review checklist + IwoooS host owner decision record write-up review outcome lanes + IwoooS host owner decision record formal candidate packets + IwoooS host owner decision record formal candidate review checklist + IwoooS host owner decision record formal candidate review outcome lanes + IwoooS host owner decision record formal record queue packets + IwoooS host owner decision record formal record queue review checklist + IwoooS host owner decision record formal record queue review outcome lanes + IwoooS host owner decision record human handoff readiness packets + IwoooS host owner decision record human handoff readiness review checklist + IwoooS host owner decision record human handoff readiness review outcome lanes + IwoooS host owner decision record human record owner review candidate packets + IwoooS host owner decision record human record owner review candidate checklist + IwoooS host owner decision record human record owner review candidate outcome lanes + IwoooS host owner decision record human record owner review preparation packets + IwoooS host owner decision record human record owner review preparation checklist + IwoooS progress acceleration lanes + IwoooS owner response next-action focus + IwoooS S4.9 owner response preflight + IwoooS S4.9 owner response request templates + IwoooS progress hold movement gates + IwoooS AwoooP read-only landing readiness + IwoooS AwoooP cross-session handoff packets + AwoooP 首頁 IwoooS 資安鏡像候選 + AwoooP 工作鏈路 IwoooS 資安鏡像候選 + AwoooP 審批佇列 IwoooS owner response 只讀焦點 | | 本階段追加 | AwoooP 合約儀表板 IwoooS 資安契約只讀候選 + AwoooP 租戶管理 IwoooS 資安租戶範圍只讀候選 + AwoooP 執行監控 IwoooS 執行狀態只讀候選 + 既有安全 / 合規頁面 IwoooS 只讀反向橋接 + 告警 / 錯誤 / 授權 / 治理頁面 IwoooS 只讀反向橋接 + 稽核 / 工程審查頁面 IwoooS 深色只讀反向橋接 + IwoooS 前端資安頁面連接狀態板 + IwoooS GitHub 主要來源就緒度只讀狀態板 + AwoooP 工作鏈路 GitHub 主要來源就緒度只讀工作項 + AwoooP 合約儀表板 GitHub 主要來源就緒度合約只讀候選 + AwoooP 審批佇列 GitHub 主要來源就緒度審批邊界 + AwoooP 首頁 GitHub 主要來源就緒度只讀摘要 + AwoooP 租戶管理 GitHub 主要來源就緒度租戶範圍 + AwoooP 執行監控 GitHub 主要來源就緒度執行邊界 + IwoooS / AwoooP 資安可視區塊繁體中文呈現防護檢查 + AwoooP 執行詳情 / 審批詳情繁體中文呈現防護檢查 + AwoooP 首頁負責人回覆驗收總覽 + AwoooP 工作鏈路負責人回覆驗收只讀工作項 + AwoooP 合約儀表板負責人回覆驗收契約只讀候選 + AwoooP 審批佇列負責人回覆驗收只讀審查邊界 + AwoooP 租戶管理負責人回覆驗收租戶範圍 + AwoooP 執行監控負責人回覆驗收執行邊界 + AwoooP 執行詳情負責人回覆驗收詳情邊界 + AwoooP 審批決策負責人回覆驗收審批邊界 + IwoooS AwoooP 資安入口覆蓋狀態板 + IwoooS 階段式資安收斂節奏圖 + IwoooS 下一步人工收件作戰板 + IwoooS 人工回覆安全驗收閘道 + IwoooS 人工回覆審查結果分流 + IwoooS 人工決策準備佇列 + IwoooS 人工決策紀錄草稿防誤用 + IwoooS 人工決策正式紀錄負責人指派確認準備包 + IwoooS 人工決策正式紀錄負責人指派確認清單 + IwoooS 人工決策正式紀錄負責人指派確認結果分流 + IwoooS 人工決策正式紀錄負責人指派決策準備包 + IwoooS 人工決策正式紀錄負責人指派決策檢查清單 + IwoooS S4.9 負責人回覆封套欄位 + IwoooS S4.9 負責人回覆封套送件前檢查 + IwoooS S4.9 負責人回覆封套送件前結果分流 + IwoooS S4.9 負責人回覆送件請求草稿 + IwoooS S4.9 負責人回覆送件鏈路摘要 + IwoooS 低摩擦分階段收斂主控 + IwoooS 低摩擦下一步行動邊界 + IwoooS 64% 進度移動訊號驗收條 + IwoooS 第一個進度解鎖路徑 + IwoooS 第一解鎖證據包 + IwoooS 第一解鎖證據包預檢分流 + IwoooS 第一解鎖證據包補件路徑 + IwoooS 第一解鎖證據包補件送審前檢查 + IwoooS 第一解鎖證據包補件送審結果分流 + IwoooS 第一解鎖證據包 reviewer 指派準備包 + IwoooS 第一解鎖證據包 reviewer 指派前檢查 + IwoooS 第一解鎖證據包 reviewer 指派前檢查結果分流 + IwoooS 正式只讀 landing 與 Kali 112 只讀證據進度重估 | | 本階段追加補充 | IwoooS 目前具體工作地圖 + IwoooS 目前具體交付清單 + IwoooS 目前阻塞與解除條件 + IwoooS 三軸進度與全產品套用範圍 + IwoooS 全產品分階段套用台帳 + IwoooS 全產品 rollout 波次驗收門檻 + IwoooS 全產品 rollout 驗收結果分流 + IwoooS 全產品證據接線地圖 + IwoooS 全產品證據接線預檢 + IwoooS 全產品證據接線預檢結果分流 + IwoooS 全產品預檢補件回收台帳 + IwoooS 全產品補件重試門檻 + IwoooS 全產品重試結果分流 + IwoooS 全產品人工審查候選準備 + IwoooS 全產品人工審查候選預檢 + IwoooS 全產品人工審查候選預檢結果分流 + IwoooS 全產品人工審查候選預檢補件回收台帳 + IwoooS 全產品人工審查候選預檢補件重試門檻 + IwoooS 全產品只讀套用快照 + P2-145 owner response acceptance gate 正式驗證完成 | -| P0 追加 | IwoooS P0 配置控管優先序前台正式驗證完成；Nginx public gateway、DNS / TLS / certbot、K8s / ArgoCD / production manifests、Workflow / runner / secret metadata、Public / admin / API runtime config、agent-bounty runtime / treasury 六類先列為即時風險配置；高價值配置 Gate 已補上 `k8s/nginx/**`、`scripts/ops/**/*cert*`、`scripts/ops/**/*tls*`，sample 從 `matched=0 / C0=0` 收斂到 `matched=3 / C0=2`；Gate 預設工作樹 preflight 已可讀取 staged / unstaged / untracked，本地 smoke 對臨時 `k8s/nginx/*` 檔命中 C0；Owner Packet snapshot 已同步為 `packets=3 / c0=2`，Coverage snapshot 已同步最新 patterns；IwoooS / AwoooP 前台 Owner Packet 摘要已正式驗證 `packet=3 / c0=2`，feature commit `e999c16b`、deploy marker `16c6b983`、Gitea code-review `2973` / CD `2972` success；IwoooS posture projection snapshot / schema / guard 已同步 `packet=3 / c0=2`，不再保留舊 `1 / 0` 口徑；高價值配置 Owner Packet 收件預檢已新增 `checks=9 / lanes=5 / required_fields=27 / blocked_requests=16`；高價值配置 Owner Request 草稿包已新增 `drafts=3 / handoff_fields=11 / forbidden_payloads=12 / sent=0`；Public Gateway live conf 匯出請求包已新增 `requests=3 / c0=2 / redaction_rules=8 / received=0`；Public Gateway redacted export 收件預檢已新增 `candidates=3 / c0=2 / checks=10 / rejection_guards=12 / received=0 / accepted=0`；Public Gateway rendered diff / nginx gate 草稿已新增 `candidates=3 / c0=2 / stages=7 / blocked=14 / rendered_diff=0 / runtime=0`；DNS / TLS / certbot Owner Confirmation Request 已新增 `requests=4 / c0=4 / fields=9 / questions=5 / guards=12 / received=0 / accepted=0`；owner response / live evidence / runtime gate / action buttons 仍全部為 0 | +| P0 追加 | IwoooS P0 配置控管優先序前台正式驗證完成；Nginx public gateway、DNS / TLS / certbot、K8s / ArgoCD / production manifests、Workflow / runner / secret metadata、Public / admin / API runtime config、agent-bounty runtime / treasury 六類先列為即時風險配置；高價值配置 Gate 已補上 `k8s/nginx/**`、`scripts/ops/**/*cert*`、`scripts/ops/**/*tls*`，sample 從 `matched=0 / C0=0` 收斂到 `matched=3 / C0=2`；Gate 預設工作樹 preflight 已可讀取 staged / unstaged / untracked，本地 smoke 對臨時 `k8s/nginx/*` 檔命中 C0；Owner Packet snapshot 已同步為 `packets=3 / c0=2`，Coverage snapshot 已同步最新 patterns；IwoooS / AwoooP 前台 Owner Packet 摘要已正式驗證 `packet=3 / c0=2`，feature commit `e999c16b`、deploy marker `16c6b983`、Gitea code-review `2973` / CD `2972` success；IwoooS posture projection snapshot / schema / guard 已同步 `packet=3 / c0=2`，不再保留舊 `1 / 0` 口徑；高價值配置 Owner Packet 收件預檢已新增 `checks=9 / lanes=5 / required_fields=27 / blocked_requests=16`；高價值配置 Owner Request 草稿包已新增 `drafts=3 / handoff_fields=11 / forbidden_payloads=12 / sent=0`；Public Gateway live conf 匯出請求包已新增 `requests=3 / c0=2 / redaction_rules=8 / received=0`；Public Gateway redacted export 收件預檢已新增 `candidates=3 / c0=2 / checks=10 / rejection_guards=12 / received=0 / accepted=0`；Public Gateway rendered diff / nginx gate 草稿已新增 `candidates=3 / c0=2 / stages=7 / blocked=14 / rendered_diff=0 / runtime=0`；DNS / TLS / certbot Owner Confirmation Request 已新增 `requests=4 / c0=4 / fields=9 / questions=5 / guards=12 / received=0 / accepted=0`；K8s / ArgoCD manifest repo-only 清冊已新增 `files=49 / c0=36 / yaml=45 / kinds=20 / blocked=13 / runtime=0`；owner response / live evidence / runtime gate / action buttons 仍全部為 0 | | 原則 | 低摩擦分階段；文件、schema、read-only evidence 優先；不做 runtime enforcement、不切 primary | | P0 主控板 | `docs/workplans/2026-06-04-iwooos-security-governance-p0.md` | @@ -393,6 +393,7 @@ headline 要再往上，需要 S4.9 / S4.10 / S4.11 / S4.12 任一 owner respons | Public Gateway redacted export 收件預檢 | 本地完成 | `public-gateway-redacted-export-intake-preflight.snapshot.json` 已固定 `intake_candidate_count=3`、`c0_intake_candidate_count=2`、`validation_check_count=10`、`rejection_guard_count=12`、`reviewer_intake_lane_count=5`、`redacted_export_received_count=0`、`accepted_redacted_export_count=0`，並由 `security-mirror-progress-guard.py` 鎖住 intake ids、validation checks、rejection guards、reviewer lanes 與 false flags | 這是 redacted export 收件前預檢，不是 request sent、recipient confirmed、redacted export received / accepted、raw live conf stored、rendered diff ready、`nginx -t`、Nginx reload、route smoke、DNS / TLS probe、certbot renew、host write、production write 或 runtime gate；不需要 production browser smoke | | Public Gateway rendered diff / nginx gate 草稿 | 本地完成 | `public-gateway-rendered-diff-gate-draft.snapshot.json` 已固定 `diff_gate_candidate_count=3`、`c0_diff_gate_candidate_count=2`、`preflight_stage_count=7`、`blocked_action_count=14`、`redacted_export_accepted_count=0`、`rendered_diff_ready_count=0`、`nginx_test_executed_count=0`、`runtime_gate_count=0`，並由 `security-mirror-progress-guard.py` 鎖住 diff gate ids、preflight stages、blocked actions 與 false flags | 這是 rendered diff / nginx / route smoke 分階段 gate 草稿，不是 redacted export accepted、rendered diff ready、`nginx -t`、Nginx reload、route smoke、DNS / TLS probe、certbot renew、host write、production write 或 runtime gate；不需要 production browser smoke | | DNS / TLS / certbot Owner Confirmation Request | 本地完成 | `domain-tls-certbot-owner-confirmation-request.snapshot.json` 已固定 `owner_confirmation_request_count=4`、`c0_owner_confirmation_request_count=4`、`required_owner_field_count=9`、`confirmation_question_count=5`、`rejection_guard_count=12`、`owner_response_received_count=0`、`owner_response_accepted_count=0`、`runtime_gate_count=0`，並由 `security-mirror-progress-guard.py` 鎖住 request ids、confirmation questions、rejection guards 與 false flags | 這是 SAN / wildcard / 共用憑證覆蓋關係的 owner confirmation request 草稿，不是 request sent、recipient confirmed、owner response received / accepted、DNS query、TLS probe、certbot renew、Nginx reload、route smoke、host write、production write 或 runtime gate；不需要 production browser smoke | +| K8s / ArgoCD manifest repo-only 清冊 | 本地完成 | `k8s-argocd-manifest-inventory.snapshot.json` 已固定 `file_count=49`、`c0_file_count=36`、`yaml_manifest_file_count=45`、`unique_kind_count=20`、`top_level_kind_marker_count=56`、`required_owner_field_count=11`、`evidence_gap_count=8`、`blocked_action_count=13`，並由 `security-mirror-progress-guard.py` 鎖住 group ids、kind counts、blocked actions 與 false flags | 這是 repo-only manifest inventory，不是 live cluster read、ArgoCD API read、ArgoCD sync、kubectl apply / patch / delete、Helm upgrade、secret collection、manual pod restart、scale workload、RBAC / NetworkPolicy change、restore backup、production write 或 runtime gate；不需要 production browser smoke | | S3 approval gate | 進行中 | `security_approval_gate_v1` 已建立 8 個人工 gate items：7 pending、1 block candidate、0 approved | 不得繞過人工批准；批准後仍需 follow-up runtime gate | | S3.0 人工批准 Gate 契約 | 完成草案 | 定義批准範圍、決策選項、required reviewers、still forbidden 與 follow-up runtime gate | AwoooP 可記錄決策，不可執行 gate item | | S3.1 人工決策紀錄契約 | 完成草案 | `security_approval_decision_record_v1` 已建立；目前 0 筆 decision records、0 個 runtime action 授權 | AwoooP 可稽核決策，不可把決策當執行 | diff --git a/docs/security/k8s-argocd-manifest-inventory.snapshot.json b/docs/security/k8s-argocd-manifest-inventory.snapshot.json new file mode 100644 index 000000000..353f295ce --- /dev/null +++ b/docs/security/k8s-argocd-manifest-inventory.snapshot.json @@ -0,0 +1,1534 @@ +{ + "blocked_actions": [ + "argocd_sync", + "kubectl_apply", + "kubectl_patch", + "kubectl_delete", + "helm_upgrade", + "secret_value_collection", + "live_cluster_write", + "manual_pod_restart", + "scale_workload", + "change_network_policy", + "change_rbac", + "restore_backup", + "open_runtime_gate" + ], + "evidence_gaps": [ + "owner_response", + "rendered_manifest_diff", + "argocd_health_readback", + "argocd_sync_revision", + "kubectl_dry_run_or_server_validation_plan", + "rollout_blast_radius", + "rollback_revision", + "postcheck_metrics" + ], + "execution_boundaries": { + "action_buttons_allowed": false, + "argocd_api_read_authorized": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "live_cluster_read_authorized": false, + "live_cluster_read_executed": false, + "manifest_apply_authorized": false, + "manifest_apply_executed": false, + "not_authorization": true, + "production_write_authorized": false, + "runtime_execution_authorized": false, + "secret_value_collection_allowed": false + }, + "gate_tag_counts": { + "apply_capable_script": 1, + "argocd_application": 1, + "availability_and_scaling": 3, + "backup_restore": 9, + "monitoring_alerting": 12, + "network_policy": 2, + "rbac": 2, + "secret_metadata": 6, + "supporting_source": 8, + "workload_or_schedule": 10 + }, + "generated_at": "2026-06-14T21:05:00+08:00", + "git_commit": "551d8144", + "group_summaries": [ + { + "control_tier": "C0", + "file_count": 25, + "group_id": "awoooi_prod", + "label": "AWOOOI production namespace manifests", + "owner_gate_required_count": 25, + "owner_response_accepted_count": 0, + "root": "k8s/awoooi-prod", + "runtime_gate_count": 0, + "supporting_source_file_count": 1, + "yaml_manifest_file_count": 24 + }, + { + "control_tier": "C0", + "file_count": 4, + "group_id": "argocd", + "label": "ArgoCD application and metrics exposure", + "owner_gate_required_count": 4, + "owner_response_accepted_count": 0, + "root": "k8s/argocd", + "runtime_gate_count": 0, + "supporting_source_file_count": 1, + "yaml_manifest_file_count": 3 + }, + { + "control_tier": "C0", + "file_count": 7, + "group_id": "velero", + "label": "Velero backup / restore manifests", + "owner_gate_required_count": 7, + "owner_response_accepted_count": 0, + "root": "k8s/velero", + "runtime_gate_count": 0, + "supporting_source_file_count": 1, + "yaml_manifest_file_count": 6 + }, + { + "control_tier": "C1", + "file_count": 13, + "group_id": "monitoring", + "label": "K8s monitoring and alert source", + "owner_gate_required_count": 13, + "owner_response_accepted_count": 0, + "root": "k8s/monitoring", + "runtime_gate_count": 0, + "supporting_source_file_count": 1, + "yaml_manifest_file_count": 12 + } + ], + "kind_counts": { + "Application": 1, + "BackupStorageLocation": 1, + "ClusterRole": 1, + "ClusterRoleBinding": 2, + "ConfigMap": 3, + "CronJob": 5, + "Deployment": 5, + "HorizontalPodAutoscaler": 3, + "Kustomization": 1, + "LimitRange": 1, + "List": 1, + "Namespace": 2, + "NetworkPolicy": 6, + "PodDisruptionBudget": 3, + "PrometheusRule": 4, + "ResourceQuota": 1, + "Secret": 6, + "Service": 5, + "ServiceAccount": 2, + "VerticalPodAutoscaler": 3 + }, + "manifest_rows": [ + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "supporting_source" + ], + "group_id": "awoooi_prod", + "group_label": "AWOOOI production namespace manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/awoooi-prod/01-namespace-quota.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "2470af56f88422182d6d5aa31719fd79285e9a67836df75864755f2d48189877", + "top_level_kind_count": 3, + "top_level_kinds": [ + "Namespace", + "ResourceQuota", + "LimitRange" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "network_policy" + ], + "group_id": "awoooi_prod", + "group_label": "AWOOOI production namespace manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/awoooi-prod/02-network-policy.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "f5ea6a9f5fb0cc44664d97a3ed639fa4b43ffd9bcfd70a1f6b44640791b7859f", + "top_level_kind_count": 4, + "top_level_kinds": [ + "NetworkPolicy", + "NetworkPolicy", + "NetworkPolicy", + "NetworkPolicy" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "secret_metadata" + ], + "group_id": "awoooi_prod", + "group_label": "AWOOOI production namespace manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/awoooi-prod/03-secrets.example.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "c89d02a01e6dcc58c1e8c5540716f07e7bd0ebdcf725e7972add709444849908", + "top_level_kind_count": 1, + "top_level_kinds": [ + "Secret" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "supporting_source" + ], + "group_id": "awoooi_prod", + "group_label": "AWOOOI production namespace manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/awoooi-prod/04-configmap.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "c1bffe0abe394a1da0476f4d26ac7962e10f6e06162afa9c114af69f38651b90", + "top_level_kind_count": 1, + "top_level_kinds": [ + "ConfigMap" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "supporting_source", + "gate_tags": [ + "supporting_source" + ], + "group_id": "awoooi_prod", + "group_label": "AWOOOI production namespace manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/awoooi-prod/04-configmap.yaml.patch-consensus", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "50125869b4e808fca11d0f8a85eca59e7e9a2116184aca99f68ef3addb1bc4c4", + "top_level_kind_count": 0, + "top_level_kinds": [] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "secret_metadata" + ], + "group_id": "awoooi_prod", + "group_label": "AWOOOI production namespace manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/awoooi-prod/04-repair-known-hosts-template.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "6814f63c5ce7234cf7ed36b7bc478665e7c2b741c60ebc30e670a73c34fea7ff", + "top_level_kind_count": 1, + "top_level_kinds": [ + "Secret" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "secret_metadata" + ], + "group_id": "awoooi_prod", + "group_label": "AWOOOI production namespace manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/awoooi-prod/04-repair-ssh-key-template.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "74690ce69b6eff1412935a454b791735f470630da3325cee6673515a886e4952", + "top_level_kind_count": 1, + "top_level_kinds": [ + "Secret" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "secret_metadata" + ], + "group_id": "awoooi_prod", + "group_label": "AWOOOI production namespace manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/awoooi-prod/04-ssh-mcp-secret.example.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "702edff37865728a2c7af19592ad959e8ee1122d2ccbe888da88e26d5ceb77dc", + "top_level_kind_count": 1, + "top_level_kinds": [ + "Secret" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "workload_or_schedule" + ], + "group_id": "awoooi_prod", + "group_label": "AWOOOI production namespace manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/awoooi-prod/05-deployment-web.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "a9387a84dbaeca1527370d4c7557a5308e9d95e28c1ca006b56b7bf1034d283b", + "top_level_kind_count": 2, + "top_level_kinds": [ + "Deployment", + "Service" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "workload_or_schedule" + ], + "group_id": "awoooi_prod", + "group_label": "AWOOOI production namespace manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/awoooi-prod/06-deployment-api.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "5e4e3520203679512b38670ca99df689f94acb97e2dcccc2b849e20493d6b804", + "top_level_kind_count": 2, + "top_level_kinds": [ + "Deployment", + "Service" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "rbac" + ], + "group_id": "awoooi_prod", + "group_label": "AWOOOI production namespace manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/awoooi-prod/07-rbac.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "5082f9e0f24998a9efb1927f1135769542115526847710c91a582810cd118c02", + "top_level_kind_count": 3, + "top_level_kinds": [ + "ServiceAccount", + "ClusterRole", + "ClusterRoleBinding" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "workload_or_schedule" + ], + "group_id": "awoooi_prod", + "group_label": "AWOOOI production namespace manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/awoooi-prod/08-deployment-worker.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "6d635bd0c0680b91c47c0d21ad2d55a21c4751eb8e9bb32eace523458ab555f8", + "top_level_kind_count": 1, + "top_level_kinds": [ + "Deployment" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "availability_and_scaling" + ], + "group_id": "awoooi_prod", + "group_label": "AWOOOI production namespace manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/awoooi-prod/09-pdb.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "dfd3d5a39f393602cb349b11f21f3278a88cb2d0acdb2a4889d2ae3f2d954efc", + "top_level_kind_count": 3, + "top_level_kinds": [ + "PodDisruptionBudget", + "PodDisruptionBudget", + "PodDisruptionBudget" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "workload_or_schedule" + ], + "group_id": "awoooi_prod", + "group_label": "AWOOOI production namespace manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/awoooi-prod/10-deployment-auto-repair-canary.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "56ed112a071d72bffdde7f27cb4415c75cd765cfccbc59ba2208256a4f13e641", + "top_level_kind_count": 1, + "top_level_kinds": [ + "Deployment" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "availability_and_scaling" + ], + "group_id": "awoooi_prod", + "group_label": "AWOOOI production namespace manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/awoooi-prod/11-vpa.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "18a977f6aef5fe220eab826b182c0cd3b069bdf6317f281c8aec4828fd93d168", + "top_level_kind_count": 3, + "top_level_kinds": [ + "VerticalPodAutoscaler", + "VerticalPodAutoscaler", + "VerticalPodAutoscaler" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "workload_or_schedule" + ], + "group_id": "awoooi_prod", + "group_label": "AWOOOI production namespace manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/awoooi-prod/12-cronjob-drift-scanner.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "c68c454c45f78cf7dab2ab16fe09ec86b5b3c7f2ae958b50b3b3c56ca4e22346", + "top_level_kind_count": 1, + "top_level_kinds": [ + "CronJob" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "availability_and_scaling" + ], + "group_id": "awoooi_prod", + "group_label": "AWOOOI production namespace manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/awoooi-prod/12-hpa.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "ab08e174a982fd8d1cfda919dea2f40e0545cac1f277d25a603f43547e6cf1d6", + "top_level_kind_count": 3, + "top_level_kinds": [ + "HorizontalPodAutoscaler", + "HorizontalPodAutoscaler", + "HorizontalPodAutoscaler" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "workload_or_schedule" + ], + "group_id": "awoooi_prod", + "group_label": "AWOOOI production namespace manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/awoooi-prod/13-cronjob-k3s-report.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "6ddd92c5f55a1c5219a5bdf35f5f514ba9b23487b19212b2fa0d3ebd98a0a42d", + "top_level_kind_count": 1, + "top_level_kinds": [ + "CronJob" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "workload_or_schedule" + ], + "group_id": "awoooi_prod", + "group_label": "AWOOOI production namespace manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/awoooi-prod/14-cronjob-weekly-report.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "59ded7259d94108a8157d3123753eb5f74a17bc95e1873b5921032cc3241bd99", + "top_level_kind_count": 1, + "top_level_kinds": [ + "CronJob" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "workload_or_schedule" + ], + "group_id": "awoooi_prod", + "group_label": "AWOOOI production namespace manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/awoooi-prod/15-cronjob-km-vectorize.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "2c4029274bfea99f2fa1a8004dcead3fd648ce53afc0e43e0643d8ec251f33af", + "top_level_kind_count": 1, + "top_level_kinds": [ + "CronJob" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "supporting_source" + ], + "group_id": "awoooi_prod", + "group_label": "AWOOOI production namespace manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/awoooi-prod/15-service-registry-configmap.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "7b91f296d81b9114c929ccb74e008442c04f1baf47d1caa861c439a090fc4a9c", + "top_level_kind_count": 1, + "top_level_kinds": [ + "ConfigMap" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "backup_restore", + "workload_or_schedule" + ], + "group_id": "awoooi_prod", + "group_label": "AWOOOI production namespace manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/awoooi-prod/16-cronjob-backup-restore-test.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "356ab2223d0fc2e1b4d7e4e1163ef23bed62e1c22588c46ffd010d090359557b", + "top_level_kind_count": 1, + "top_level_kinds": [ + "CronJob" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "backup_restore" + ], + "group_id": "awoooi_prod", + "group_label": "AWOOOI production namespace manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/awoooi-prod/17-configmap-backup-restore-scripts.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "c3e4605372a9f5c5f94713e1f8b5d8d0dccd6886c76c43522053e1468521bc1d", + "top_level_kind_count": 1, + "top_level_kinds": [ + "ConfigMap" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "secret_metadata" + ], + "group_id": "awoooi_prod", + "group_label": "AWOOOI production namespace manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/awoooi-prod/awoooi-migrator-secret.template.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "e88aa6d8ac3026d5802235955afa7aa6893b79b4f5fbe5fbdd37c8c1f8ec4d15", + "top_level_kind_count": 1, + "top_level_kinds": [ + "Secret" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "supporting_source" + ], + "group_id": "awoooi_prod", + "group_label": "AWOOOI production namespace manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/awoooi-prod/kustomization.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "ca71848909a88c0c2a4e4e38f5dd6225b34a800d3c59e12217bef245806ba776", + "top_level_kind_count": 1, + "top_level_kinds": [ + "Kustomization" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "supporting_source", + "gate_tags": [ + "supporting_source" + ], + "group_id": "argocd", + "group_label": "ArgoCD application and metrics exposure", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/argocd/DEPLOY.md", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "56f971682d79789d63a566bd8267f84e2a9d309fabc229e11ac4d29f36a6ef7c", + "top_level_kind_count": 0, + "top_level_kinds": [] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "network_policy" + ], + "group_id": "argocd", + "group_label": "ArgoCD application and metrics exposure", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/argocd/argocd-metrics-network-policy.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "41ccd0bb22410c48adc84eae74391106c3f28fe181786cfe4128a07f99d2942c", + "top_level_kind_count": 2, + "top_level_kinds": [ + "NetworkPolicy", + "NetworkPolicy" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "supporting_source" + ], + "group_id": "argocd", + "group_label": "ArgoCD application and metrics exposure", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/argocd/argocd-metrics-nodeport.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "7f4a8f09206ce0afc185fe11d5e55265bb553b671471724cdcd83c259ec7d266", + "top_level_kind_count": 2, + "top_level_kinds": [ + "Service", + "Service" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "argocd_application" + ], + "group_id": "argocd", + "group_label": "ArgoCD application and metrics exposure", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/argocd/awoooi-prod-app.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "3012d79061db47c624e42ac734faf719705610b8fc6ec6e4bf4497cf85231902", + "top_level_kind_count": 1, + "top_level_kinds": [ + "Application" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "backup_restore" + ], + "group_id": "velero", + "group_label": "Velero backup / restore manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/velero/00-namespace.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "385b2f43f03ba3b2a53b4e90b7a221af234f4bec46665c8b6086fe90a4e9b37e", + "top_level_kind_count": 1, + "top_level_kinds": [ + "Namespace" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "backup_restore", + "secret_metadata" + ], + "group_id": "velero", + "group_label": "Velero backup / restore manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/velero/01-credentials.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "54d829a3204c2fa2d1bb3c8be1bf250914dd7a517d13900bee0fa9878760c930", + "top_level_kind_count": 1, + "top_level_kinds": [ + "Secret" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "backup_restore", + "rbac", + "workload_or_schedule" + ], + "group_id": "velero", + "group_label": "Velero backup / restore manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/velero/02-velero-install.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "60d7ea59ef8b2ad38dc8bf6bca80be35609e8d317210c44204bdd5ad9901b47a", + "top_level_kind_count": 4, + "top_level_kinds": [ + "ServiceAccount", + "ClusterRoleBinding", + "BackupStorageLocation", + "Deployment" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "supporting_source", + "gate_tags": [ + "backup_restore" + ], + "group_id": "velero", + "group_label": "Velero backup / restore manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/velero/README.md", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "94dd54ab0587087f4eb6d95b956a8b889fc2546c43e9f01b7d48572245f522de", + "top_level_kind_count": 0, + "top_level_kinds": [] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "backup_restore" + ], + "group_id": "velero", + "group_label": "Velero backup / restore manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/velero/crds/velero-crds.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "d5558cd419c8d46bdc958064cb97f963d1ea793866414c025906ec15033512ed", + "top_level_kind_count": 0, + "top_level_kinds": [] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "backup_restore" + ], + "group_id": "velero", + "group_label": "Velero backup / restore manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/velero/velero-install-full.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "ef942a5e7a39f1becfbec3870085774f8a6bbdf225be36e7d9f4cfd8890984e1", + "top_level_kind_count": 1, + "top_level_kinds": [ + "List" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C0", + "file_type": "yaml_manifest", + "gate_tags": [ + "backup_restore" + ], + "group_id": "velero", + "group_label": "Velero backup / restore manifests", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/velero/velero-metrics-service.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "684959def32b792e2bca34b477afcdfe2b0c6dfd0cb90f4b681a514922d62b75", + "top_level_kind_count": 1, + "top_level_kinds": [ + "Service" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C1", + "file_type": "yaml_manifest", + "gate_tags": [ + "monitoring_alerting" + ], + "group_id": "monitoring", + "group_label": "K8s monitoring and alert source", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/monitoring/alert-chain-monitor.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "03ad55d72425f27071ba3afa8d43959a7ee361cc8f76fcf2ca295a33297bbf54", + "top_level_kind_count": 1, + "top_level_kinds": [ + "PrometheusRule" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C1", + "file_type": "yaml_manifest", + "gate_tags": [ + "monitoring_alerting" + ], + "group_id": "monitoring", + "group_label": "K8s monitoring and alert source", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/monitoring/database-alerts.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "6077aa4e061c6604519eaede01144ffec46c39a6715a296a1ae54ff5484a0111", + "top_level_kind_count": 1, + "top_level_kinds": [ + "PrometheusRule" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C1", + "file_type": "supporting_source", + "gate_tags": [ + "apply_capable_script", + "monitoring_alerting" + ], + "group_id": "monitoring", + "group_label": "K8s monitoring and alert source", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/monitoring/deploy-prometheus-config.sh", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "5511681efdd5563aa980396b2ebb37b7d28e43092feda48f3cba014a4b863adf", + "top_level_kind_count": 0, + "top_level_kinds": [] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C1", + "file_type": "yaml_manifest", + "gate_tags": [ + "supporting_source" + ], + "group_id": "monitoring", + "group_label": "K8s monitoring and alert source", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/monitoring/docker-compose-110.yml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "00126e9a5cb7a3cf2bf02cfddefea11f05849b46835a4e602eac4777fcb25281", + "top_level_kind_count": 0, + "top_level_kinds": [] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C1", + "file_type": "yaml_manifest", + "gate_tags": [ + "monitoring_alerting" + ], + "group_id": "monitoring", + "group_label": "K8s monitoring and alert source", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/monitoring/flywheel-alerts.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "74334919400623ff4115472e39ba30a6bbc5383bc7dfd6a3fae7bd06531e7cc6", + "top_level_kind_count": 1, + "top_level_kinds": [ + "PrometheusRule" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C1", + "file_type": "yaml_manifest", + "gate_tags": [ + "monitoring_alerting" + ], + "group_id": "monitoring", + "group_label": "K8s monitoring and alert source", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/monitoring/k3s-alerts-supplemental.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "14fd4f8c7deaf22c6828ffbf66400e6d0e274f03db1999197af26311bdb6d203", + "top_level_kind_count": 0, + "top_level_kinds": [] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C1", + "file_type": "yaml_manifest", + "gate_tags": [ + "monitoring_alerting" + ], + "group_id": "monitoring", + "group_label": "K8s monitoring and alert source", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/monitoring/k3s-alerts.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "be1a4e796f6f6363566898ffd07ac37a938255b895cde11743fe0770d9946663", + "top_level_kind_count": 0, + "top_level_kinds": [] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C1", + "file_type": "yaml_manifest", + "gate_tags": [ + "monitoring_alerting" + ], + "group_id": "monitoring", + "group_label": "K8s monitoring and alert source", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/monitoring/minio-kali-alerts.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "3f3ca8c012a40f5a9983b6f587dfd60ffd0a8fb3dcea6b793cb1d5fbad0fe50b", + "top_level_kind_count": 0, + "top_level_kinds": [] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C1", + "file_type": "yaml_manifest", + "gate_tags": [ + "monitoring_alerting" + ], + "group_id": "monitoring", + "group_label": "K8s monitoring and alert source", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/monitoring/nvidia-alerts.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "c43a6413269dadc8269b9724ee905650f39926249a37c7339179ec88facdf972", + "top_level_kind_count": 1, + "top_level_kinds": [ + "PrometheusRule" + ] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C1", + "file_type": "yaml_manifest", + "gate_tags": [ + "monitoring_alerting" + ], + "group_id": "monitoring", + "group_label": "K8s monitoring and alert source", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/monitoring/prometheus-config-additions.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "67bd6ef7b9da39fd4decb5254dc9bea1980f54fcd162f8468ac98f49258a39b4", + "top_level_kind_count": 0, + "top_level_kinds": [] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C1", + "file_type": "yaml_manifest", + "gate_tags": [ + "monitoring_alerting" + ], + "group_id": "monitoring", + "group_label": "K8s monitoring and alert source", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/monitoring/prometheus-config-phase-o.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "7bdb94a23f6f14912c89655e5313fb745a772286671647db32d7ee2f07b50d9d", + "top_level_kind_count": 0, + "top_level_kinds": [] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C1", + "file_type": "yaml_manifest", + "gate_tags": [ + "monitoring_alerting" + ], + "group_id": "monitoring", + "group_label": "K8s monitoring and alert source", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/monitoring/prometheus-remote-write-signoz.yaml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "da6ae1ef0be420b07fc0f56861e548d049ec53fd0f601ee913797304315fbcc7", + "top_level_kind_count": 0, + "top_level_kinds": [] + }, + { + "action_buttons_allowed": false, + "argocd_health_readback_received": false, + "argocd_sync_authorized": false, + "argocd_sync_executed": false, + "control_tier": "C1", + "file_type": "yaml_manifest", + "gate_tags": [ + "monitoring_alerting" + ], + "group_id": "monitoring", + "group_label": "K8s monitoring and alert source", + "kubectl_action_authorized": false, + "kubectl_action_executed": false, + "owner_gate_required": true, + "owner_response_accepted": false, + "owner_response_received": false, + "path": "k8s/monitoring/prometheus.yml", + "rendered_manifest_diff_ready": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "sha256": "5ea5ec736686dabb05bff0691dd45196eae4d2ab645c14b3f812748186ad6da9", + "top_level_kind_count": 0, + "top_level_kinds": [] + } + ], + "mode": "repo_only_manifest_inventory", + "next_steps": [ + "將 repo-only 清冊轉成 owner request 草稿；未有 owner response 前不得 sync 或 apply。", + "未來若要讀 live ArgoCD / K8s，只能另開 readback approval，不得由本清冊推定授權。", + "任何 ArgoCD sync、kubectl action、secret rotation 或 restore 都必須另開 maintenance window、rollback revision 與 post-check gate。" + ], + "required_owner_fields": [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "argocd_health_readback_ref", + "argocd_sync_revision_ref", + "rollback_revision", + "followup_owner", + "maintenance_window", + "validation_plan" + ], + "scan_groups": [ + { + "control_tier": "C0", + "group_id": "awoooi_prod", + "label": "AWOOOI production namespace manifests", + "root": "k8s/awoooi-prod" + }, + { + "control_tier": "C0", + "group_id": "argocd", + "label": "ArgoCD application and metrics exposure", + "root": "k8s/argocd" + }, + { + "control_tier": "C0", + "group_id": "velero", + "label": "Velero backup / restore manifests", + "root": "k8s/velero" + }, + { + "control_tier": "C1", + "group_id": "monitoring", + "label": "K8s monitoring and alert source", + "root": "k8s/monitoring" + } + ], + "schema_version": "k8s_argocd_manifest_inventory_v1", + "status": "repo_only_inventory_ready_no_live_cluster_read", + "summary": { + "action_button_count": 0, + "argocd_application_count": 1, + "argocd_health_readback_received_count": 0, + "argocd_sync_authorized_count": 0, + "argocd_sync_executed_count": 0, + "autoscaling_object_count": 6, + "blocked_action_count": 13, + "c0_file_count": 36, + "c1_file_count": 13, + "cronjob_object_count": 5, + "deployment_object_count": 5, + "evidence_gap_count": 8, + "file_count": 49, + "kubectl_action_authorized_count": 0, + "kubectl_action_executed_count": 0, + "live_cluster_read_authorized_count": 0, + "live_cluster_read_executed_count": 0, + "network_policy_object_count": 6, + "owner_response_accepted_count": 0, + "owner_response_received_count": 0, + "prometheus_rule_count": 4, + "rbac_object_count": 5, + "rendered_manifest_diff_ready_count": 0, + "required_owner_field_count": 11, + "runtime_gate_count": 0, + "scan_group_count": 4, + "secret_object_count": 6, + "secret_value_collection_allowed_count": 0, + "supporting_source_file_count": 4, + "top_level_kind_marker_count": 56, + "unique_kind_count": 20, + "yaml_manifest_file_count": 45 + } +} diff --git a/docs/superpowers/specs/2026-04-15-MASTER-ai-autonomous-flywheel-v2.md b/docs/superpowers/specs/2026-04-15-MASTER-ai-autonomous-flywheel-v2.md index e245e3874..c707c7e88 100644 --- a/docs/superpowers/specs/2026-04-15-MASTER-ai-autonomous-flywheel-v2.md +++ b/docs/superpowers/specs/2026-04-15-MASTER-ai-autonomous-flywheel-v2.md @@ -693,6 +693,7 @@ Alert / Sentry / SigNoz / Gitea / Market Watch / Operator | `docs/security/public-gateway-redacted-export-intake-preflight.snapshot.json` + `scripts/security/public-gateway-redacted-export-intake-preflight.py` | Public Gateway redacted export 收件預檢已本地完成；承接 live conf 匯出請求包，固定 3 份 intake candidate、2 份 C0、1 份 C1、11 欄 intake field、10 項 validation check、12 類 rejection guard 與 5 條 reviewer intake lane；request sent、recipient confirmed、redacted export received、accepted、quarantine、rejected、rendered diff、`nginx -t`、reload、route smoke、runtime gate、action buttons 仍全部為 `0` | 這是 redacted export 收件前預檢，不是 request sent、recipient confirmed、live conf received / accepted、raw conf 收存、rendered diff ready、`nginx -t`、Nginx reload、DNS / TLS probe、certbot renew、route smoke、host write、production write 或 runtime gate | | `docs/security/public-gateway-rendered-diff-gate-draft.snapshot.json` + `scripts/security/public-gateway-rendered-diff-gate-draft.py` | Public Gateway rendered diff / nginx gate 草稿已本地完成；承接 redacted export intake preflight，固定 3 份 diff gate candidate、2 份 C0、1 份 C1、12 欄 diff gate field、7 個 preflight stage 與 14 類 blocked action；redacted export accepted、rendered diff ready、`nginx -t` executed、reload、route smoke、DNS / TLS probe、certbot renew、runtime gate、action buttons 仍全部為 `0` | 這是 rendered diff / nginx / route smoke 分階段 gate 草稿，不是 redacted export accepted、rendered diff ready、`nginx -t`、Nginx reload、DNS / TLS probe、certbot renew、route smoke、host write、production write 或 runtime gate | | `docs/security/domain-tls-certbot-owner-confirmation-request.snapshot.json` + `scripts/security/domain-tls-certbot-owner-confirmation-request.py` | DNS / TLS / certbot Owner Confirmation Request 已本地完成；承接 domain / TLS / certbot repo-only 清冊，固定 4 份 owner confirmation request、4 份 C0、9 欄 required owner fields、16 欄 request fields、5 題 confirmation questions 與 12 類 rejection guard；request sent、recipient confirmed、owner response received / accepted、DNS query、TLS probe、certbot renew、Nginx reload、runtime gate、action buttons 仍全部為 `0` | 這是 SAN / wildcard / 共用憑證覆蓋關係的 owner confirmation request 草稿，不是 request sent、owner response received / accepted、DNS query、live TLS probe、certbot renew、Nginx reload、route smoke、host write、production write 或 runtime gate | +| `docs/security/k8s-argocd-manifest-inventory.snapshot.json` + `scripts/security/k8s-argocd-manifest-inventory.py` | K8s / ArgoCD manifest repo-only 清冊已本地完成；掃描 `k8s/awoooi-prod`、`k8s/argocd`、`k8s/velero`、`k8s/monitoring`，固定 4 個 scan groups、49 個 files、36 個 C0 files、45 個 YAML manifests、20 個 unique top-level kind markers、11 欄 required owner fields、8 個 evidence gaps 與 13 類 blocked action；owner response、rendered manifest diff、ArgoCD health readback、ArgoCD sync、kubectl action、live cluster read、runtime gate、action buttons 仍全部為 `0` | 這是 repo-only manifest inventory，不是 live cluster read、ArgoCD API read、ArgoCD sync、kubectl apply / patch / delete、Helm upgrade、secret collection、manual pod restart、scale workload、RBAC / NetworkPolicy change、restore backup、production write 或 runtime gate | | `docs/evaluations/ai_agent_live_read_model_gate_2026-06-11.json` + `GET /api/v1/agents/agent-live-read-model-gate` | P2-403B AgentSession / Redis Streams live read model gate；定義 safe fields、Redis envelope、worker gate、rollback plan 與 no-write smoke，不連 DB、不讀寫 Redis、不啟動 worker | #### 3.2.1c 2026-06-11 AI Agent 主動營運委派與版本生命週期契約 @@ -837,6 +838,7 @@ Repo / registry / release notes / K8s / host / observability / backup evidence 74. 建立 Public Gateway redacted export 收件預檢。✅ 本地完成；新增 `public-gateway-redacted-export-intake-preflight.py`、snapshot 與說明文件，將三份 live conf export request 轉成 `intake_candidate_count=3`、`c0_intake_candidate_count=2`、`validation_check_count=10`、`rejection_guard_count=12`、`reviewer_intake_lane_count=5` 的收件前預檢；request sent、recipient confirmed、redacted export received、accepted、quarantine、rejected、rendered diff、`nginx -t`、reload、route smoke、runtime gate、action buttons 仍全部為 `0`。這不是 request sent、live conf received / accepted、raw conf 收存、rendered diff ready、`nginx -t`、Nginx reload、DNS / TLS probe、certbot renew、host write、production write 或 runtime gate。 75. 建立 Public Gateway rendered diff / nginx gate 草稿。✅ 本地完成；新增 `public-gateway-rendered-diff-gate-draft.py`、snapshot 與說明文件，將三份 redacted export intake candidate 轉成 `diff_gate_candidate_count=3`、`c0_diff_gate_candidate_count=2`、`preflight_stage_count=7`、`blocked_action_count=14` 的 rendered diff / nginx / route smoke 分階段 gate 草稿；redacted export accepted、rendered diff ready、`nginx -t` executed、reload、route smoke、DNS / TLS probe、certbot renew、runtime gate、action buttons 仍全部為 `0`。這不是 redacted export accepted、rendered diff ready、`nginx -t`、Nginx reload、DNS / TLS probe、certbot renew、host write、production write 或 runtime gate。 76. 建立 DNS / TLS / certbot Owner Confirmation Request。✅ 本地完成；新增 `domain-tls-certbot-owner-confirmation-request.py`、snapshot 與說明文件，將 4 個 certificate path 需確認的 domain 轉成 `owner_confirmation_request_count=4`、`c0_owner_confirmation_request_count=4`、`required_owner_field_count=9`、`confirmation_question_count=5`、`rejection_guard_count=12` 的 owner confirmation request 草稿；request sent、recipient confirmed、owner response received / accepted、DNS query、TLS probe、certbot renew、Nginx reload、host write、runtime gate、action buttons 仍全部為 `0`。這不是 request sent、owner response received / accepted、DNS query、live TLS probe、certbot renew、Nginx reload、route smoke、production write 或 runtime gate。 +77. 建立 K8s / ArgoCD manifest repo-only 清冊。✅ 本地完成；新增 `k8s-argocd-manifest-inventory.py`、snapshot 與說明文件，將 `k8s/awoooi-prod`、`k8s/argocd`、`k8s/velero`、`k8s/monitoring` 轉成 `file_count=49`、`c0_file_count=36`、`yaml_manifest_file_count=45`、`unique_kind_count=20`、`top_level_kind_marker_count=56`、`blocked_action_count=13` 的 repo-only manifest inventory；owner response、rendered manifest diff、ArgoCD health readback、ArgoCD sync、kubectl action、live cluster read、secret collection、runtime gate、action buttons 仍全部為 `0`。這不是 live cluster read、ArgoCD API read、ArgoCD sync、kubectl action、Helm upgrade、secret collection、manual pod restart、scale workload、RBAC / NetworkPolicy change、restore backup、production write 或 runtime gate。 #### 3.2.1d 2026-06-11 Agent 互動、學習與成長證據面 @@ -4774,3 +4776,16 @@ Trigger commit `f5cd37b7` 與 deploy marker `0ba92357` 已把 governance UI 的 - P0 總帳、供應鏈進度、Domain / TLS 清冊、Public Gateway preflight 與 MASTER artifact 表已同步 P0-19。 **裁決：** 這是 SAN / wildcard / 共用憑證覆蓋關係的 owner confirmation request 草稿，不是 request sent、recipient confirmed、owner response received / accepted、DNS query、live TLS probe、certbot renew、Nginx reload、route smoke、host write、active scan、production write 或 runtime gate；IwoooS headline 仍維持 `64%`，active runtime gate 仍 `0`。 + +### 2026-06-14 21:05 (台北) — §3.2 / §5 — 新增 K8s / ArgoCD manifest repo-only 清冊 — 把 production manifests 轉成 owner gate 基線 + +**觸發**：K8s / ArgoCD / production manifests 會直接影響 deployment、cronjob、RBAC、NetworkPolicy、Secret metadata、Velero restore 與 monitoring rule；高價值配置 coverage 已指出尚未把 ArgoCD health / sync readback 與 rollback revision 收成 owner packet。此階段仍不得 live cluster read、ArgoCD API read、ArgoCD sync、kubectl action、Helm upgrade、secret collection、manual pod restart、scale workload、restore backup 或 production write。 + +**已推進：** +- 新增 `scripts/security/k8s-argocd-manifest-inventory.py`，只讀 `k8s/awoooi-prod`、`k8s/argocd`、`k8s/velero`、`k8s/monitoring` repo source files。 +- 新增 `docs/security/k8s-argocd-manifest-inventory.snapshot.json`，固定 `file_count=49`、`c0_file_count=36`、`yaml_manifest_file_count=45`、`unique_kind_count=20`、`top_level_kind_marker_count=56`、`blocked_action_count=13`。 +- 新增 `docs/security/K8S-ARGOCD-MANIFEST-INVENTORY.md`，說明 scan groups、owner 必填欄位、evidence 缺口、blocked actions 與完成度。 +- `security-mirror-progress-guard.py` 已鎖住新 snapshot 的 schema、summary、execution false flags、group ids、kind counts、blocked actions 與每列 false flags。 +- P0 總帳、供應鏈進度、IwoooS 配置控管總清單與 MASTER artifact 表已同步 P0-20。 + +**裁決：** 這是 repo-only manifest inventory，不是 live cluster read、ArgoCD API read、ArgoCD sync、kubectl apply / patch / delete、Helm upgrade、secret collection、manual pod restart、scale workload、RBAC / NetworkPolicy change、restore backup、active scan、production write 或 runtime gate；IwoooS headline 仍維持 `64%`，active runtime gate 仍 `0`。 diff --git a/docs/workplans/2026-06-04-iwooos-security-governance-p0.md b/docs/workplans/2026-06-04-iwooos-security-governance-p0.md index 9754c7dcc..1819dd9d2 100644 --- a/docs/workplans/2026-06-04-iwooos-security-governance-p0.md +++ b/docs/workplans/2026-06-04-iwooos-security-governance-p0.md @@ -9,7 +9,7 @@ | 工作視窗 | IwoooS / AWOOOI 資安治理 P0 | | 本次乾淨 worktree | `/tmp/awoooi-iwooos-p2-138-release-decision-hold-20260614-1038` | | 本次分支 | `codex/iwooos-p2-145-owner-response-acceptance-20260614` | -| 最新觀察到的 `gitea/main` | `757f6a53 docs(security): 更新 P0 主控板同步基線 [skip ci]` | +| 最新觀察到的 `gitea/main` | `551d8144 docs(security): 新增 DNS TLS owner confirmation request [skip ci]` | | 最新 P0 Telegram 告警 / 批准執行真相鏈基準 | code `32e4beca`、deploy marker `717b5870`、code-review `2658`、CD `2657`；no-action approval 不再觸發 executor，可執行修復 approval 會寫入 `auto_repair_executions`、KM 與 verifier | | 最新 P0 Telegram no-action 人工處置包基準 | code `cd928852`、deploy marker `9181cc0e`、code-review `2666`；正式部署 tree 已包含 no-action 人工處置包、`處置包 / 重診 / 歷史 / 靜默 / 真相鏈 / Runs` 鍵盤、production pod render / keyboard smoke | | 最新 P0 MCP evidence / PlayBook 修復候選基準 | code `cc614023`、D1 blocker clarity `47d677ac`、D2 manual draft package `febe9ecf`、D3 draft work item `e8d5eafb`、D4 work item detail panel `e8a5bac5`、D5 coverage gap contract 本地完成；目前 production deploy marker 仍為 `985a2cfe` 的 D4 Work Items detail panel，D5 尚待推送 / 部署驗證。正式部署 tree 經 production pod smoke 與 Work Items browser smoke 確認可由 MCP evidence + approved PlayBook trust 產生 medium approval candidate、綁定預配置 approval id、不外露 preallocated metadata，且通用兜底 / 診斷型 PlayBook 不會被誤當修復命令；若缺安全修復候選，Telegram 人工處置包會顯示阻擋原因、下一步、PlayBook 草案欄位與 AwoooP 修復候選草案工作項，工作項頁會顯示 PlayBook 草案處置板、必填欄位、阻擋原因、下一步與 Runs / 審批連結；D5 讓 blocked result 進一步輸出服務 coverage gap、blocking stage、必收 MCP evidence refs 與 PlayBook template fields | @@ -21,7 +21,7 @@ | 最新 P2-D2 Code Review 候選分類基準 | code `292cfec9`、deploy marker `4cfe5ff7`、CD `2586`、code-review `2587`；Code Review route 可見文案已搬到 `codeReview` i18n namespace，四類候選分類與人工批准流程已正式驗證 | | 最新 P2-D2 AwoooP Runs fallback 文案基準 | code `7f6028c3`、deploy marker `bf016e91`、CD `2590`、code-review `2591`；Runs / Callback / Source Flow fallback 文案已正式驗證 | | 最新 AwoooP Tenants 全域產品資產台帳 D1 基準 | code `fef94df8`、deploy marker `180a6543`、code-review `2967`、CD `2966`；正式 API 顯示產品 / 專案 `16`、網站 / 服務入口 `31`、source-control candidate repo `10`，已納入 `2026fifa.wooo.work`、WOOO Open Design、n8n、Grist、Vault、Ollama、Monitor 與 AWOOOI API / AIOps 服務入口；owner response / runtime gate / action button 仍 `0` | -| 最新 P0 Public Gateway / DNS TLS 配置控管基準 | P0-15 `5068654d` live conf 匯出請求包、P0-16 `f856df1c` redacted export 收件預檢、P0-17 `762f73a6` rendered diff / nginx gate 草稿、P0-19 本輪 DNS / TLS / certbot owner confirmation request 草稿；Public Gateway 三段固定 requests / candidates `3`、C0 `2`，DNS / TLS 固定 owner confirmation requests `4`、C0 `4`；request sent、owner response received / accepted、redacted export received / accepted、raw conf stored、rendered diff ready、`nginx -t`、reload、DNS query、TLS probe、certbot renew、route smoke、runtime gate、action button 全部 `0` | +| 最新 P0 Public Gateway / DNS TLS / K8s 配置控管基準 | P0-15 `5068654d` live conf 匯出請求包、P0-16 `f856df1c` redacted export 收件預檢、P0-17 `762f73a6` rendered diff / nginx gate 草稿、P0-19 `551d8144` DNS / TLS / certbot owner confirmation request 草稿、P0-20 本輪 K8s / ArgoCD manifest repo-only 清冊；Public Gateway 三段固定 requests / candidates `3`、C0 `2`，DNS / TLS 固定 owner confirmation requests `4`、C0 `4`，K8s manifest 固定 files `49`、C0 `36`、YAML `45`、kinds `20`；request sent、owner response received / accepted、redacted export received / accepted、raw conf stored、rendered diff ready、`nginx -t`、reload、DNS query、TLS probe、certbot renew、ArgoCD sync、kubectl action、route smoke、runtime gate、action button 全部 `0` | | 最新 AI Agent automation P1-305 / P1-306 基準 | code `4f0787f8`、deploy marker `af3a9d48`、CD `2592`、code-review `2593`；任務批准邊界與進度彙總已正式驗證；backlog `70%`、done `16/23`、下一步 `P1-001` | | 最新 AI Agent automation P1-001 基準 | code `de3007b7`、stability fix `fd33591c`、deploy marker `8caba233`、LOGBOOK / marker 對齊 `37c0e171`；runtime surface `22`、Secret surface `4`、live gaps `6`、backlog `74%`、done `17/23`、下一步 `P1-002` | | 最新 AI Agent automation P1-002 基準 | code `943faaee`、stability fix `ff266926`、deploy marker `01b8712d`、LOGBOOK / marker 對齊 `70c01003`；Gitea workflows `9`、runner contracts `4`、需 runner attestation workflows `8`、backlog `78%`、done `18/23`、下一步 `P1-003` | @@ -30,7 +30,7 @@ | 最新 S4.9 owner response intake form 基準 | `docs/security/S4-9-OWNER-RESPONSE-INTAKE-FORM.md`；五題可填表、六欄填寫規則、reviewer 收件欄與 outcome lanes 已固定；owner response gate 仍 `0%` | | 最新 S4.9 reviewer validation checklist 基準 | `docs/security/S4-9-REVIEWER-VALIDATION-CHECKLIST.md`；Reviewer 分工、V0-V8 gates、outcome 決策表、count transition 與 cross-packet consistency 已固定；owner response gate 仍 `0%` | | 最新 S4.9 security acceptance record template 基準 | `docs/security/S4-9-SECURITY-ACCEPTANCE-RECORD-TEMPLATE.md`；acceptance record 前置條件、欄位、count transition、decision outcome、evidence redaction 與不可授權聲明已固定；owner response gate 仍 `0%` | -| 目前平行 Session | AwoooP thread `019e9168-3e85-7053-a63f-471eb77b1457` 已同步 P0-15 `5068654d`、P0-16 `f856df1c`、P0-17 `762f73a6`、P0-18 `757f6a53`；P0-19 完成後需再同步本輪 commit 與 0 / false 邊界，後續進下一個 P0 / P1 前仍需重新 fetch / fast-forward，避免 LOGBOOK / workplan 衝突 | +| 目前平行 Session | AwoooP thread `019e9168-3e85-7053-a63f-471eb77b1457` 已同步 P0-15 `5068654d`、P0-16 `f856df1c`、P0-17 `762f73a6`、P0-18 `757f6a53`、P0-19 `551d8144`；P0-20 完成後需再同步本輪 commit 與 0 / false 邊界，後續進下一個 P0 / P1 前仍需重新 fetch / fast-forward，避免 LOGBOOK / workplan 衝突 | | 前一個正式 IwoooS 候選基準 | code `7b8fc093`、deploy marker `45c63488`、LOGBOOK `02cadee6` | | 最新導航 IA 基準 | code `973fc7a4`、LOGBOOK `2555c811`、deploy marker `0260ec89` | | 禁止事項 | 不 force push、不 destructive git、不 SSH 修改主機、不 active scan、不收 secrets 明文、不把 AwoooP approval 當資安批准、不把 UI 可見當 runtime 授權 | @@ -85,6 +85,7 @@ | P0-17 | Public Gateway rendered diff / nginx gate 草稿 | 100% | 已新增 `public-gateway-rendered-diff-gate-draft.py`、snapshot 與文件，把 3 份 redacted export intake candidate 轉成 rendered diff、`nginx -t`、reload、route smoke、DNS / TLS、certbot、rollback / post-check 分階段 gate 草稿；redacted export accepted、rendered diff ready、`nginx -t` executed、reload、route smoke、runtime gate 仍全部為 `0` | `PUBLIC_GATEWAY_RENDERED_DIFF_GATE_DRAFT_OK candidates=3 c0=2 stages=7 blocked=14 runtime_gate=0`；progress guard 固定 snapshot schema、summary、false flags、diff gate ids、preflight stages、blocked actions 與每份草稿 false flags；純 repo 內文件 / snapshot / guard，不需要 production browser smoke | | P0-18 | P0 主控板同步基線回填 | 100% | 已將本次 worktree、分支、最新 `gitea/main`、Public Gateway P0-15~P0-17 基準與平行 AwoooP Session 同步狀態回填，避免下一個 Session 用舊 2026-06-11 worktree / 舊 commit 判讀 | 只改 P0 總帳與 LOGBOOK；需跑 progress guard、owner response guard、doc secret sanity、diff check 與工作視窗片語掃描；不需要 production browser smoke | | P0-19 | DNS / TLS / certbot owner confirmation request | 100% | 已新增 `domain-tls-certbot-owner-confirmation-request.py`、snapshot 與文件，把 4 個 certificate path 需確認 domain 轉成 owner confirmation request 草稿；全部 `C0`，必填 owner 欄位 `9`，confirmation questions `5`，rejection guards `12`；request sent、recipient confirmed、owner response received / accepted、DNS query、TLS probe、certbot renew、Nginx reload、host write、runtime gate 仍全部為 `0` | `DOMAIN_TLS_CERTBOT_OWNER_CONFIRMATION_REQUEST_OK requests=4 c0=4 fields=9 received=0 runtime_gate=0`；progress guard 固定 snapshot schema、summary、false flags、request ids、confirmation questions、rejection guards 與每份草稿 false flags；純 repo 內文件 / snapshot / guard，不需要 production browser smoke | +| P0-20 | K8s / ArgoCD manifest repo-only 清冊 | 100% | 已新增 `k8s-argocd-manifest-inventory.py`、snapshot 與文件，把 `k8s/awoooi-prod`、`k8s/argocd`、`k8s/velero`、`k8s/monitoring` 轉成 repo-only manifest inventory；files `49`、C0 `36`、YAML `45`、unique kinds `20`、blocked actions `13`；owner response、rendered diff、ArgoCD health readback、ArgoCD sync、kubectl action、live cluster read、secret collection、runtime gate 仍全部為 `0` | `K8S_ARGOCD_MANIFEST_INVENTORY_OK files=49 c0=36 yaml=45 kinds=20 runtime_gate=0`；progress guard 固定 snapshot schema、summary、group ids、kind counts、blocked actions 與每列 false flags；純 repo 內文件 / snapshot / guard，不需要 production browser smoke | ## 3. S4.9 Owner Response Gate 規範 diff --git a/scripts/security/k8s-argocd-manifest-inventory.py b/scripts/security/k8s-argocd-manifest-inventory.py new file mode 100644 index 000000000..033d13aa2 --- /dev/null +++ b/scripts/security/k8s-argocd-manifest-inventory.py @@ -0,0 +1,329 @@ +#!/usr/bin/env python3 +""" +IwoooS K8s / ArgoCD production manifest repo-only 清冊。 + +本工具只讀取 repo 內 K8s / ArgoCD / Velero / monitoring source files，整理 +path、SHA256、top-level kind marker 與 owner gate 缺口。它不做 kubectl、 +不連 ArgoCD、不讀 live cluster、不套用 manifest、不 sync、不改 secret。 +""" + +from __future__ import annotations + +import argparse +import hashlib +import json +import subprocess +import sys +from collections import Counter +from datetime import datetime, timedelta, timezone +from pathlib import Path +from typing import Any + + +TAIPEI = timezone(timedelta(hours=8)) + +SCAN_GROUPS = [ + { + "group_id": "awoooi_prod", + "label": "AWOOOI production namespace manifests", + "root": "k8s/awoooi-prod", + "control_tier": "C0", + }, + { + "group_id": "argocd", + "label": "ArgoCD application and metrics exposure", + "root": "k8s/argocd", + "control_tier": "C0", + }, + { + "group_id": "velero", + "label": "Velero backup / restore manifests", + "root": "k8s/velero", + "control_tier": "C0", + }, + { + "group_id": "monitoring", + "label": "K8s monitoring and alert source", + "root": "k8s/monitoring", + "control_tier": "C1", + }, +] + +REQUIRED_OWNER_FIELDS = [ + "owner_role_or_team", + "decision", + "decision_reason", + "affected_scope", + "redacted_evidence_refs", + "argocd_health_readback_ref", + "argocd_sync_revision_ref", + "rollback_revision", + "followup_owner", + "maintenance_window", + "validation_plan", +] + +EVIDENCE_GAPS = [ + "owner_response", + "rendered_manifest_diff", + "argocd_health_readback", + "argocd_sync_revision", + "kubectl_dry_run_or_server_validation_plan", + "rollout_blast_radius", + "rollback_revision", + "postcheck_metrics", +] + +BLOCKED_ACTIONS = [ + "argocd_sync", + "kubectl_apply", + "kubectl_patch", + "kubectl_delete", + "helm_upgrade", + "secret_value_collection", + "live_cluster_write", + "manual_pod_restart", + "scale_workload", + "change_network_policy", + "change_rbac", + "restore_backup", + "open_runtime_gate", +] + + +def git_short_sha(root: Path) -> str: + try: + result = subprocess.run( + ["git", "rev-parse", "--short", "HEAD"], + cwd=root, + check=True, + capture_output=True, + text=True, + ) + return result.stdout.strip() + except Exception: + return "unknown" + + +def sha256_file(path: Path) -> str: + digest = hashlib.sha256() + with path.open("rb") as handle: + for chunk in iter(lambda: handle.read(65536), b""): + digest.update(chunk) + return digest.hexdigest() + + +def is_yaml_like(path: Path) -> bool: + return path.suffix in {".yaml", ".yml"} + + +def extract_top_level_kinds(text: str) -> list[str]: + kinds: list[str] = [] + for line in text.splitlines(): + if line.startswith("kind:"): + value = line.split(":", 1)[1].strip() + if value: + kinds.append(value) + return kinds + + +def gate_tags_for(path: Path, kinds: list[str]) -> list[str]: + tags: set[str] = set() + name = str(path).lower() + kind_set = set(kinds) + + if "Application" in kind_set: + tags.add("argocd_application") + if kind_set & {"Deployment", "CronJob"}: + tags.add("workload_or_schedule") + if "Secret" in kind_set or "secret" in name or "credentials" in name: + tags.add("secret_metadata") + if kind_set & {"ClusterRole", "ClusterRoleBinding", "ServiceAccount"}: + tags.add("rbac") + if "NetworkPolicy" in kind_set: + tags.add("network_policy") + if kind_set & {"PodDisruptionBudget", "HorizontalPodAutoscaler", "VerticalPodAutoscaler"}: + tags.add("availability_and_scaling") + if kind_set & {"BackupStorageLocation"} or "velero" in name or "backup" in name or "restore" in name: + tags.add("backup_restore") + if kind_set & {"PrometheusRule"} or "prometheus" in name or "alert" in name: + tags.add("monitoring_alerting") + if path.suffix == ".sh": + tags.add("apply_capable_script") + if not tags: + tags.add("supporting_source") + return sorted(tags) + + +def row_for(path: Path, group: dict[str, str], repo_root: Path) -> dict[str, Any]: + relative = path.relative_to(repo_root).as_posix() + text = path.read_text(encoding="utf-8", errors="ignore") + kinds = extract_top_level_kinds(text) if is_yaml_like(path) else [] + gate_tags = gate_tags_for(path, kinds) + return { + "path": relative, + "group_id": group["group_id"], + "group_label": group["label"], + "control_tier": group["control_tier"], + "file_type": "yaml_manifest" if is_yaml_like(path) else "supporting_source", + "sha256": sha256_file(path), + "top_level_kinds": kinds, + "top_level_kind_count": len(kinds), + "gate_tags": gate_tags, + "owner_gate_required": True, + "owner_response_received": False, + "owner_response_accepted": False, + "rendered_manifest_diff_ready": False, + "argocd_health_readback_received": False, + "argocd_sync_authorized": False, + "argocd_sync_executed": False, + "kubectl_action_authorized": False, + "kubectl_action_executed": False, + "secret_value_collection_allowed": False, + "runtime_gate": False, + "action_buttons_allowed": False, + } + + +def build_report(root: Path, generated_at: str | None) -> dict[str, Any]: + report_time = generated_at or datetime.now(TAIPEI).isoformat(timespec="seconds") + rows: list[dict[str, Any]] = [] + group_summaries: list[dict[str, Any]] = [] + + for group in SCAN_GROUPS: + group_root = root / group["root"] + files = sorted(path for path in group_root.rglob("*") if path.is_file()) + group_rows = [row_for(path, group, root) for path in files] + rows.extend(group_rows) + group_summaries.append( + { + "group_id": group["group_id"], + "label": group["label"], + "root": group["root"], + "control_tier": group["control_tier"], + "file_count": len(group_rows), + "yaml_manifest_file_count": sum(1 for row in group_rows if row["file_type"] == "yaml_manifest"), + "supporting_source_file_count": sum(1 for row in group_rows if row["file_type"] != "yaml_manifest"), + "owner_gate_required_count": len(group_rows), + "owner_response_accepted_count": 0, + "runtime_gate_count": 0, + } + ) + + kind_counter: Counter[str] = Counter() + gate_tag_counter: Counter[str] = Counter() + for row in rows: + kind_counter.update(row["top_level_kinds"]) + gate_tag_counter.update(row["gate_tags"]) + + c0_rows = [row for row in rows if row["control_tier"] == "C0"] + c1_rows = [row for row in rows if row["control_tier"] == "C1"] + + return { + "schema_version": "k8s_argocd_manifest_inventory_v1", + "generated_at": report_time, + "git_commit": git_short_sha(root), + "mode": "repo_only_manifest_inventory", + "status": "repo_only_inventory_ready_no_live_cluster_read", + "scan_groups": SCAN_GROUPS, + "summary": { + "scan_group_count": len(SCAN_GROUPS), + "file_count": len(rows), + "c0_file_count": len(c0_rows), + "c1_file_count": len(c1_rows), + "yaml_manifest_file_count": sum(1 for row in rows if row["file_type"] == "yaml_manifest"), + "supporting_source_file_count": sum(1 for row in rows if row["file_type"] != "yaml_manifest"), + "unique_kind_count": len(kind_counter), + "top_level_kind_marker_count": sum(kind_counter.values()), + "deployment_object_count": kind_counter["Deployment"], + "cronjob_object_count": kind_counter["CronJob"], + "secret_object_count": kind_counter["Secret"], + "network_policy_object_count": kind_counter["NetworkPolicy"], + "rbac_object_count": kind_counter["ServiceAccount"] + + kind_counter["ClusterRole"] + + kind_counter["ClusterRoleBinding"], + "autoscaling_object_count": kind_counter["HorizontalPodAutoscaler"] + + kind_counter["VerticalPodAutoscaler"], + "argocd_application_count": kind_counter["Application"], + "prometheus_rule_count": kind_counter["PrometheusRule"], + "required_owner_field_count": len(REQUIRED_OWNER_FIELDS), + "evidence_gap_count": len(EVIDENCE_GAPS), + "blocked_action_count": len(BLOCKED_ACTIONS), + "owner_response_received_count": 0, + "owner_response_accepted_count": 0, + "rendered_manifest_diff_ready_count": 0, + "argocd_health_readback_received_count": 0, + "argocd_sync_authorized_count": 0, + "argocd_sync_executed_count": 0, + "kubectl_action_authorized_count": 0, + "kubectl_action_executed_count": 0, + "live_cluster_read_authorized_count": 0, + "live_cluster_read_executed_count": 0, + "secret_value_collection_allowed_count": 0, + "runtime_gate_count": 0, + "action_button_count": 0, + }, + "execution_boundaries": { + "live_cluster_read_authorized": False, + "live_cluster_read_executed": False, + "argocd_api_read_authorized": False, + "argocd_sync_authorized": False, + "argocd_sync_executed": False, + "kubectl_action_authorized": False, + "kubectl_action_executed": False, + "manifest_apply_authorized": False, + "manifest_apply_executed": False, + "secret_value_collection_allowed": False, + "production_write_authorized": False, + "runtime_execution_authorized": False, + "action_buttons_allowed": False, + "not_authorization": True, + }, + "required_owner_fields": REQUIRED_OWNER_FIELDS, + "evidence_gaps": EVIDENCE_GAPS, + "blocked_actions": BLOCKED_ACTIONS, + "kind_counts": dict(sorted(kind_counter.items())), + "gate_tag_counts": dict(sorted(gate_tag_counter.items())), + "group_summaries": group_summaries, + "manifest_rows": rows, + "next_steps": [ + "將 repo-only 清冊轉成 owner request 草稿；未有 owner response 前不得 sync 或 apply。", + "未來若要讀 live ArgoCD / K8s，只能另開 readback approval，不得由本清冊推定授權。", + "任何 ArgoCD sync、kubectl action、secret rotation 或 restore 都必須另開 maintenance window、rollback revision 與 post-check gate。", + ], + } + + +def main() -> int: + parser = argparse.ArgumentParser(description="IwoooS K8s / ArgoCD production manifest repo-only 清冊") + parser.add_argument("--root", default=".", help="repo root") + parser.add_argument("--output", help="寫出 JSON 報告") + parser.add_argument("--generated-at", help="固定報告時間，供 committed snapshot 使用") + args = parser.parse_args() + + root = Path(args.root).resolve() + report = build_report(root, args.generated_at) + payload = json.dumps(report, ensure_ascii=False, indent=2, sort_keys=True) + + if args.output: + output = Path(args.output) + output.parent.mkdir(parents=True, exist_ok=True) + output.write_text(payload + "\n", encoding="utf-8") + else: + print(payload) + + summary = report["summary"] + print( + "K8S_ARGOCD_MANIFEST_INVENTORY_OK " + f"files={summary['file_count']} " + f"c0={summary['c0_file_count']} " + f"yaml={summary['yaml_manifest_file_count']} " + f"kinds={summary['unique_kind_count']} " + f"runtime_gate={summary['runtime_gate_count']}", + file=sys.stderr, + ) + return 0 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/scripts/security/security-mirror-progress-guard.py b/scripts/security/security-mirror-progress-guard.py index 25ec88e57..258483eb6 100755 --- a/scripts/security/security-mirror-progress-guard.py +++ b/scripts/security/security-mirror-progress-guard.py @@ -104,6 +104,9 @@ def validate(root: Path) -> None: domain_tls_owner_confirmation_request = load_json( security_dir / "domain-tls-certbot-owner-confirmation-request.snapshot.json" ) + k8s_argocd_manifest_inventory = load_json( + security_dir / "k8s-argocd-manifest-inventory.snapshot.json" + ) public_gateway_preflight_inventory = load_json( security_dir / "public-gateway-preflight-inventory.snapshot.json" ) @@ -13789,6 +13792,151 @@ def validate(root: Path) -> None: f"domain_tls_owner_confirmation_request.{request['request_id']}.{false_key}", request[false_key], ) + k8s_argocd_summary = k8s_argocd_manifest_inventory["summary"] + assert_equal( + "k8s_argocd_manifest_inventory.schema", + k8s_argocd_manifest_inventory["schema_version"], + "k8s_argocd_manifest_inventory_v1", + ) + assert_equal( + "k8s_argocd_manifest_inventory.status", + k8s_argocd_manifest_inventory["status"], + "repo_only_inventory_ready_no_live_cluster_read", + ) + expected_k8s_argocd_summary = { + "scan_group_count": 4, + "file_count": 49, + "c0_file_count": 36, + "c1_file_count": 13, + "yaml_manifest_file_count": 45, + "supporting_source_file_count": 4, + "unique_kind_count": 20, + "top_level_kind_marker_count": 56, + "deployment_object_count": 5, + "cronjob_object_count": 5, + "secret_object_count": 6, + "network_policy_object_count": 6, + "rbac_object_count": 5, + "autoscaling_object_count": 6, + "argocd_application_count": 1, + "prometheus_rule_count": 4, + "required_owner_field_count": 11, + "evidence_gap_count": 8, + "blocked_action_count": 13, + "owner_response_received_count": 0, + "owner_response_accepted_count": 0, + "rendered_manifest_diff_ready_count": 0, + "argocd_health_readback_received_count": 0, + "argocd_sync_authorized_count": 0, + "argocd_sync_executed_count": 0, + "kubectl_action_authorized_count": 0, + "kubectl_action_executed_count": 0, + "live_cluster_read_authorized_count": 0, + "live_cluster_read_executed_count": 0, + "secret_value_collection_allowed_count": 0, + "runtime_gate_count": 0, + "action_button_count": 0, + } + for key, expected in expected_k8s_argocd_summary.items(): + assert_equal( + f"k8s_argocd_manifest_inventory.summary.{key}", + k8s_argocd_summary[key], + expected, + ) + for false_key in [ + "live_cluster_read_authorized", + "live_cluster_read_executed", + "argocd_api_read_authorized", + "argocd_sync_authorized", + "argocd_sync_executed", + "kubectl_action_authorized", + "kubectl_action_executed", + "manifest_apply_authorized", + "manifest_apply_executed", + "secret_value_collection_allowed", + "production_write_authorized", + "runtime_execution_authorized", + "action_buttons_allowed", + ]: + assert_false( + f"k8s_argocd_manifest_inventory.execution_boundaries.{false_key}", + k8s_argocd_manifest_inventory["execution_boundaries"][false_key], + ) + assert_true( + "k8s_argocd_manifest_inventory.execution_boundaries.not_authorization", + k8s_argocd_manifest_inventory["execution_boundaries"]["not_authorization"], + ) + expected_k8s_group_ids = ["awoooi_prod", "argocd", "velero", "monitoring"] + assert_equal( + "k8s_argocd_manifest_inventory.group_ids", + [item["group_id"] for item in k8s_argocd_manifest_inventory["group_summaries"]], + expected_k8s_group_ids, + ) + expected_k8s_blocked_actions = [ + "argocd_sync", + "kubectl_apply", + "kubectl_patch", + "kubectl_delete", + "helm_upgrade", + "secret_value_collection", + "live_cluster_write", + "manual_pod_restart", + "scale_workload", + "change_network_policy", + "change_rbac", + "restore_backup", + "open_runtime_gate", + ] + assert_equal( + "k8s_argocd_manifest_inventory.blocked_actions", + k8s_argocd_manifest_inventory["blocked_actions"], + expected_k8s_blocked_actions, + ) + expected_k8s_kind_counts = { + "Application": 1, + "BackupStorageLocation": 1, + "ClusterRole": 1, + "ClusterRoleBinding": 2, + "ConfigMap": 3, + "CronJob": 5, + "Deployment": 5, + "HorizontalPodAutoscaler": 3, + "Kustomization": 1, + "LimitRange": 1, + "List": 1, + "Namespace": 2, + "NetworkPolicy": 6, + "PodDisruptionBudget": 3, + "PrometheusRule": 4, + "ResourceQuota": 1, + "Secret": 6, + "Service": 5, + "ServiceAccount": 2, + "VerticalPodAutoscaler": 3, + } + assert_equal( + "k8s_argocd_manifest_inventory.kind_counts", + k8s_argocd_manifest_inventory["kind_counts"], + expected_k8s_kind_counts, + ) + for row in k8s_argocd_manifest_inventory["manifest_rows"]: + for false_key in [ + "owner_response_received", + "owner_response_accepted", + "rendered_manifest_diff_ready", + "argocd_health_readback_received", + "argocd_sync_authorized", + "argocd_sync_executed", + "kubectl_action_authorized", + "kubectl_action_executed", + "secret_value_collection_allowed", + "runtime_gate", + "action_buttons_allowed", + ]: + assert_false( + f"k8s_argocd_manifest_inventory.manifest_rows.{row['path']}.{false_key}", + row[false_key], + ) assert_equal( "iwooos_projection.summary.domain_tls_certbot_inventory_managed_domain_count", iwooos_projection["summary"]["domain_tls_certbot_inventory_managed_domain_count"],