116 lines
4.5 KiB
Markdown
116 lines
4.5 KiB
Markdown
# IwoooS K8s / ArgoCD Owner Request Draft
|
||
|
||
| 項目 | 內容 |
|
||
|------|------|
|
||
| 日期 | 2026-06-14 |
|
||
| 狀態 | `owner_request_draft_ready_not_dispatched` |
|
||
| 工具 | `scripts/security/k8s-argocd-owner-request-draft.py` |
|
||
| 輸入 | `docs/security/k8s-argocd-manifest-inventory.snapshot.json` |
|
||
| Snapshot | `docs/security/k8s-argocd-owner-request-draft.snapshot.json` |
|
||
| runtime gate | `0` |
|
||
|
||
## 1. 目的
|
||
|
||
P0-20 已建立 K8s / ArgoCD manifest repo-only 清冊，但清冊本身不能當成 owner response，也不能授權 live cluster read、ArgoCD sync 或 `kubectl` action。本文件將四個 scan group 轉成人工送件前 request draft，讓後續可以按 production、ArgoCD、Velero、monitoring 分別收 owner 回覆與 rollback / validation 欄位。
|
||
|
||
本文件不是 request sent、不是 owner response received、不是 accepted response、不是 ArgoCD API read、不是 ArgoCD sync、不是 `kubectl apply`、不是 secret collection，也不是 production write 或 runtime gate。
|
||
|
||
## 2. 摘要
|
||
|
||
| 指標 | 值 | 說明 |
|
||
|------|----|------|
|
||
| request draft count | `4` | production、ArgoCD、Velero、monitoring 四組 |
|
||
| C0 / C1 request draft | `3 / 1` | production、ArgoCD、Velero 為 C0；monitoring 為 C1 |
|
||
| request field count | `20` | 每份 request draft 的 envelope 欄位 |
|
||
| required owner field count | `11` | owner、決策、ArgoCD readback、rollback、validation 等欄位 |
|
||
| evidence gap count | `8` | owner response、rendered diff、ArgoCD readback、rollback、post-check 等 |
|
||
| blocked action count | `13` | sync、kubectl、Helm、secret、restart、scale、restore 等全部阻擋 |
|
||
| request sent / recipient confirmed | `0 / 0` | 尚未送件 |
|
||
| owner response received / accepted | `0 / 0` | 尚未收到，尚未驗收 |
|
||
| rendered manifest diff / ArgoCD health readback | `0 / 0` | 尚未產生，尚未接收 |
|
||
| ArgoCD sync / kubectl action | `0 / 0` | 尚未批准且未執行 |
|
||
| runtime gate / action button | `0 / 0` | 未開啟 |
|
||
|
||
## 3. 四份 Request Draft
|
||
|
||
| Request | Tier | Root | Scope |
|
||
|---------|------|------|-------|
|
||
| `k8s_argocd_owner_request:awoooi_prod` | `C0` | `k8s/awoooi-prod` | production namespace manifests、Deployment、CronJob、Secret metadata、RBAC、NetworkPolicy、autoscaling |
|
||
| `k8s_argocd_owner_request:argocd` | `C0` | `k8s/argocd` | ArgoCD Application、metrics NetworkPolicy / NodePort |
|
||
| `k8s_argocd_owner_request:velero` | `C0` | `k8s/velero` | backup / restore manifests、Velero credentials metadata、metrics service |
|
||
| `k8s_argocd_owner_request:monitoring` | `C1` | `k8s/monitoring` | Prometheus rules、monitoring config、alert source 與支援腳本 |
|
||
|
||
## 4. Owner 必填欄位
|
||
|
||
1. `owner_role_or_team`
|
||
2. `decision`
|
||
3. `decision_reason`
|
||
4. `affected_scope`
|
||
5. `redacted_evidence_refs`
|
||
6. `argocd_health_readback_ref`
|
||
7. `argocd_sync_revision_ref`
|
||
8. `rollback_revision`
|
||
9. `followup_owner`
|
||
10. `maintenance_window`
|
||
11. `validation_plan`
|
||
|
||
## 5. Evidence 缺口
|
||
|
||
| 缺口 | 目前狀態 |
|
||
|------|----------|
|
||
| owner response | `0` |
|
||
| rendered manifest diff | `0` |
|
||
| ArgoCD health readback | `0` |
|
||
| ArgoCD sync revision | `0` |
|
||
| kubectl dry-run / server validation plan | `0` |
|
||
| rollout blast radius | `0` |
|
||
| rollback revision | `0` |
|
||
| postcheck metrics | `0` |
|
||
|
||
## 6. 阻擋動作
|
||
|
||
以下動作不得由 request draft 直接授權：
|
||
|
||
1. `argocd_sync`
|
||
2. `kubectl_apply`
|
||
3. `kubectl_patch`
|
||
4. `kubectl_delete`
|
||
5. `helm_upgrade`
|
||
6. `secret_value_collection`
|
||
7. `live_cluster_write`
|
||
8. `manual_pod_restart`
|
||
9. `scale_workload`
|
||
10. `change_network_policy`
|
||
11. `change_rbac`
|
||
12. `restore_backup`
|
||
13. `open_runtime_gate`
|
||
|
||
## 7. 指令
|
||
|
||
產生 committed snapshot：
|
||
|
||
```bash
|
||
python3 scripts/security/k8s-argocd-owner-request-draft.py \
|
||
--root . \
|
||
--inventory-report docs/security/k8s-argocd-manifest-inventory.snapshot.json \
|
||
--output docs/security/k8s-argocd-owner-request-draft.snapshot.json \
|
||
--generated-at 2026-06-14T21:35:00+08:00
|
||
```
|
||
|
||
驗證 guard：
|
||
|
||
```bash
|
||
python3 scripts/security/security-mirror-progress-guard.py --root .
|
||
```
|
||
|
||
## 8. 完成度
|
||
|
||
| 工作 | 完成度 | 說明 |
|
||
|------|--------|------|
|
||
| owner request draft artifact | `100%` | 4 份 request draft、snapshot、文件與 guard 已固定 |
|
||
| request dispatch | `0%` | 尚未送件 |
|
||
| owner response received / accepted | `0%` | 尚未收到，尚未驗收 |
|
||
| rendered manifest diff / ArgoCD readback | `0%` | 尚未產生或接收 |
|
||
| ArgoCD sync / kubectl action | `0%` | 未授權且未執行 |
|
||
| runtime gate / production write | `0%` | 未授權且未執行 |
|