e40fc5ec5d
Activation-layer staging, fail-closed until enablement: a per-tenant hux-evidence-producer sidecar on the exact reviewed WebUI image runs hux_producer.run_once on a 60s loop, inert until the Vault-staged evidence key (tolerant init, tmpfs, 0400, staged only for the hux service and producer containers - never hermes or webui), the policy ConfigMap, and the scope ConfigMap exist. Adds least-privilege read-only RBAC (pods+statefulset in hermes, the single named Flux Kustomization), tenant egress to the Kubernetes API ClusterIP and the traefik edge, the policy allowlist, hux_producer packaging in the WebUI image, and a third expected WebUI consumer in the Flux release renderer. Delivery and image-automation gates enforce the boundary. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BvMSXH8VH2tMWXanb8SJdf
14 lines
448 B
JSON
14 lines
448 B
JSON
{
|
|
"schema": "hux.release_evidence_policy.v1",
|
|
"max_evidence_age_seconds": 900,
|
|
"workloads": {
|
|
"hermes-webui": {
|
|
"review_url_prefix": "https://scm.bstein.dev/atlas/titan-iac/pulls/",
|
|
"jenkins_job_url": "https://jenkins.bstein.dev/job/hermes-webui-image",
|
|
"image_repository": "registry.bstein.dev/bstein/hermes-webui",
|
|
"flux_kustomization": "hermes",
|
|
"health_url": "https://chat.bstein.dev/health"
|
|
}
|
|
}
|
|
}
|