awoooi/docs/security/K8S-ARGOCD-OWNER-REQUEST-DRAFT.md

IwoooS K8s / ArgoCD Owner Request Draft

項目	內容
日期	2026-06-14
狀態	owner_request_draft_ready_not_dispatched
工具	scripts/security/k8s-argocd-owner-request-draft.py
輸入	docs/security/k8s-argocd-manifest-inventory.snapshot.json
Snapshot	docs/security/k8s-argocd-owner-request-draft.snapshot.json
runtime gate	0

1. 目的

P0-20 已建立 K8s / ArgoCD manifest repo-only 清冊，但清冊本身不能當成 owner response，也不能授權 live cluster read、ArgoCD sync 或 kubectl action。本文件將四個 scan group 轉成人工送件前 request draft，讓後續可以按 production、ArgoCD、Velero、monitoring 分別收 owner 回覆與 rollback / validation 欄位。

本文件不是 request sent、不是 owner response received、不是 accepted response、不是 ArgoCD API read、不是 ArgoCD sync、不是 kubectl apply、不是 secret collection，也不是 production write 或 runtime gate。

2. 摘要

指標	值	說明
request draft count	4	production、ArgoCD、Velero、monitoring 四組
C0 / C1 request draft	3 / 1	production、ArgoCD、Velero 為 C0；monitoring 為 C1
request field count	20	每份 request draft 的 envelope 欄位
required owner field count	11	owner、決策、ArgoCD readback、rollback、validation 等欄位
evidence gap count	8	owner response、rendered diff、ArgoCD readback、rollback、post-check 等
blocked action count	13	sync、kubectl、Helm、secret、restart、scale、restore 等全部阻擋
request sent / recipient confirmed	0 / 0	尚未送件
owner response received / accepted	0 / 0	尚未收到，尚未驗收
rendered manifest diff / ArgoCD health readback	0 / 0	尚未產生，尚未接收
ArgoCD sync / kubectl action	0 / 0	尚未批准且未執行
runtime gate / action button	0 / 0	未開啟

3. 四份 Request Draft

Request	Tier	Root	Scope
k8s_argocd_owner_request:awoooi_prod	C0	k8s/awoooi-prod	production namespace manifests、Deployment、CronJob、Secret metadata、RBAC、NetworkPolicy、autoscaling
k8s_argocd_owner_request:argocd	C0	k8s/argocd	ArgoCD Application、metrics NetworkPolicy / NodePort
k8s_argocd_owner_request:velero	C0	k8s/velero	backup / restore manifests、Velero credentials metadata、metrics service
k8s_argocd_owner_request:monitoring	C1	k8s/monitoring	Prometheus rules、monitoring config、alert source 與支援腳本

4. Owner 必填欄位

1. owner_role_or_team
2. decision
3. decision_reason
4. affected_scope
5. redacted_evidence_refs
6. argocd_health_readback_ref
7. argocd_sync_revision_ref
8. rollback_revision
9. followup_owner
10. maintenance_window
11. validation_plan

5. Evidence 缺口

缺口	目前狀態
owner response	0
rendered manifest diff	0
ArgoCD health readback	0
ArgoCD sync revision	0
kubectl dry-run / server validation plan	0
rollout blast radius	0
rollback revision	0
postcheck metrics	0

6. 阻擋動作

以下動作不得由 request draft 直接授權：

1. argocd_sync
2. kubectl_apply
3. kubectl_patch
4. kubectl_delete
5. helm_upgrade
6. secret_value_collection
7. live_cluster_write
8. manual_pod_restart
9. scale_workload
10. change_network_policy
11. change_rbac
12. restore_backup
13. open_runtime_gate

7. 指令

產生 committed snapshot：

python3 scripts/security/k8s-argocd-owner-request-draft.py \
  --root . \
  --inventory-report docs/security/k8s-argocd-manifest-inventory.snapshot.json \
  --output docs/security/k8s-argocd-owner-request-draft.snapshot.json \
  --generated-at 2026-06-14T21:35:00+08:00

驗證 guard：

python3 scripts/security/security-mirror-progress-guard.py --root .

8. 完成度

工作	完成度	說明
owner request draft artifact	100%	4 份 request draft、snapshot、文件與 guard 已固定
request dispatch	0%	尚未送件
owner response received / accepted	0%	尚未收到，尚未驗收
rendered manifest diff / ArgoCD readback	0%	尚未產生或接收
ArgoCD sync / kubectl action	0%	未授權且未執行
runtime gate / production write	0%	未授權且未執行