jakman85andClaude Opus 4.8
bb2e9fc931
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
28 lines
2.1 KiB
Markdown
28 lines
2.1 KiB
Markdown
# Platform label/annotation convention (PROPOSED contract)
|
|
|
|
These label keys are consumed by the Kyverno policies in this directory. The **values**
|
|
are fixed by the spec; the **keys** are a convention this workstream (WS-TEST) proposes
|
|
and are a **shared contract** with WS-NET (network/egress rendering), WS-SEC (auth), and
|
|
WS-GITOPS (ServiceDefinition → manifest rendering). Per
|
|
[`agents/coordination-protocol.md` §2] a contract like this needs the owning roles'
|
|
sign-off before it is locked. **Escalated as an open question in the T-0.5 report.**
|
|
|
|
| Label key | Applied to | Values | Fixed by | Used by policy |
|
|
|---|---|---|---|---|
|
|
| `homelab.keithjackson.dev/app-namespace` | Namespace | `"true"` | (convention) marks an application namespace / trust zone (docs/03) | all namespace-scoped policies |
|
|
| `homelab.keithjackson.dev/egress-class` | Pod (+ controller template) | `internet` \| `vpn` | docs/03, docs/13 | `require-egress-class-label` (R-NET-05); also the selector Cilium Egress Gateway steers on (ADR-0013) |
|
|
| `homelab.keithjackson.dev/auth-mode` | Pod (+ controller template) | `oidc` \| `forward-auth` \| `native` \| `none` | docs/13, docs/15 | `require-auth-mode-label` (R-IDP-02) |
|
|
| `homelab.keithjackson.dev/baseline` | NetworkPolicy | `default-deny` | (convention) identifies the baseline NP | `require-default-deny-baseline` (generate), `validate-default-deny-shape` |
|
|
| `homelab.keithjackson.dev/secret-managed-by` | Secret | `controller` | (convention) exempts controller-generated Secrets | `disallow-plaintext-secrets` (exclude), admission `secret-provenance` |
|
|
|
|
## Rendering expectation (for WS-GITOPS)
|
|
|
|
The ServiceDefinition (`docs/13`) declares intent — `egress:` and `auth.mode:` — at the
|
|
service level. The renderer (T-0.3 / T-2.3 / T-6.1d) is expected to project those onto
|
|
the **pod template labels** above so that (a) Cilium selects pods by `egress-class` and
|
|
(b) these admission policies pass. Application namespaces are expected to be created
|
|
carrying `app-namespace: "true"` so the baseline is generated and the label/host
|
|
policies apply.
|
|
|
|
[`agents/coordination-protocol.md` §2]: ../../../home-network-k3s/agents/coordination-protocol.md
|