e40fc5ec5d
Activation-layer staging, fail-closed until enablement: a per-tenant hux-evidence-producer sidecar on the exact reviewed WebUI image runs hux_producer.run_once on a 60s loop, inert until the Vault-staged evidence key (tolerant init, tmpfs, 0400, staged only for the hux service and producer containers - never hermes or webui), the policy ConfigMap, and the scope ConfigMap exist. Adds least-privilege read-only RBAC (pods+statefulset in hermes, the single named Flux Kustomization), tenant egress to the Kubernetes API ClusterIP and the traefik edge, the policy allowlist, hux_producer packaging in the WebUI image, and a third expected WebUI consumer in the Flux release renderer. Delivery and image-automation gates enforce the boundary. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BvMSXH8VH2tMWXanb8SJdf
55 lines
1.4 KiB
YAML
55 lines
1.4 KiB
YAML
# services/hermes/hux-evidence-rbac.yaml
|
|
# Read-only facts for the HUX-12 evidence producer sidecar: Ready pod
|
|
# imageIDs and the desired StatefulSet image in this namespace, plus the
|
|
# single named Flux Kustomization's applied revision. The pod service
|
|
# account gains nothing writable and nothing secret.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: hermes-hux-evidence-read
|
|
namespace: hermes
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: [pods]
|
|
verbs: [get, list]
|
|
- apiGroups: [apps]
|
|
resources: [statefulsets]
|
|
verbs: [get]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: hermes-hux-evidence-read
|
|
namespace: hermes
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: hermes-hux-evidence-read
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: hermes-chat
|
|
namespace: hermes
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: hermes-hux-evidence-kustomization-read
|
|
rules:
|
|
- apiGroups: [kustomize.toolkit.fluxcd.io]
|
|
resources: [kustomizations]
|
|
resourceNames: [hermes]
|
|
verbs: [get]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: hermes-hux-evidence-kustomization-read
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: hermes-hux-evidence-kustomization-read
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: hermes-chat
|
|
namespace: hermes
|