jakman85andClaude Opus 4.8
8c1368977e
Adopt the spec's Phase-0 clarifications (spec now at pin a7fc19f) into the impl: - schema v1.1: enforce exposure:public => auth.mode!=none (positive+negative tested). - Kyverno: add longhorn=>size and longhorn=>NOT-reacquirable invariants (R-STATE-02/03). - Ratify the homelab.keithjackson.dev/* label-key convention (now in spec docs/03). - R-TEST-06 spec-immutability gate: ci/SPEC_PIN + ci/spec-immutability.sh + gate.sh stage + Makefile target + a Gitea job (checks spec repo clean & at pin). - touched-requirements.sh: conformance tags are the authoritative source. Reconcile 3 CI seams the CI worker flagged (gate was RED, now GREEN): - create schemas/validate.sh (SCHEMA_VALIDATE_CMD entrypoint) — L0 schema gate runs. - fix l1.sh/conformance.sh to run.sh's real interface (fixed _artifacts/ paths; no --junit/--coverage) and collect artifacts. - exec bits on new scripts. make -C ci gate => PASS (l0 skips locally w/o kyverno binary; green in CI). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2.2 KiB
Platform label/annotation convention (RATIFIED)
These label keys are consumed by the Kyverno policies in this directory. The values
are fixed by the spec; the keys are the platform convention, now ratified in the
spec — homelab.keithjackson.dev/{egress-class,auth-mode,app-namespace,baseline} are
documented in docs/03-networking-isolation-and-egress.md ("Platform label-key
convention") as the contract that network policies, Kyverno rules, and renderers key off.
Shared contract with WS-NET (egress rendering), WS-SEC (auth), and WS-GITOPS (rendering).
| Label key | Applied to | Values | Fixed by | Used by policy |
|---|---|---|---|---|
homelab.keithjackson.dev/app-namespace |
Namespace | "true" |
(convention) marks an application namespace / trust zone (docs/03) | all namespace-scoped policies |
homelab.keithjackson.dev/egress-class |
Pod (+ controller template) | internet | vpn |
docs/03, docs/13 | require-egress-class-label (R-NET-05); also the selector Cilium Egress Gateway steers on (ADR-0013) |
homelab.keithjackson.dev/auth-mode |
Pod (+ controller template) | oidc | forward-auth | native | none |
docs/13, docs/15 | require-auth-mode-label (R-IDP-02) |
homelab.keithjackson.dev/baseline |
NetworkPolicy | default-deny |
(convention) identifies the baseline NP | require-default-deny-baseline (generate), validate-default-deny-shape |
homelab.keithjackson.dev/secret-managed-by |
Secret | controller |
(convention) exempts controller-generated Secrets | disallow-plaintext-secrets (exclude), admission secret-provenance |
Rendering expectation (for WS-GITOPS)
The ServiceDefinition (docs/13) declares intent — egress: and auth.mode: — at the
service level. The renderer (T-0.3 / T-2.3 / T-6.1d) is expected to project those onto
the pod template labels above so that (a) Cilium selects pods by egress-class and
(b) these admission policies pass. Application namespaces are expected to be created
carrying app-namespace: "true" so the baseline is generated and the label/host
policies apply.