jakman85andClaude Opus 4.8
8c1368977e
Adopt the spec's Phase-0 clarifications (spec now at pin a7fc19f) into the impl: - schema v1.1: enforce exposure:public => auth.mode!=none (positive+negative tested). - Kyverno: add longhorn=>size and longhorn=>NOT-reacquirable invariants (R-STATE-02/03). - Ratify the homelab.keithjackson.dev/* label-key convention (now in spec docs/03). - R-TEST-06 spec-immutability gate: ci/SPEC_PIN + ci/spec-immutability.sh + gate.sh stage + Makefile target + a Gitea job (checks spec repo clean & at pin). - touched-requirements.sh: conformance tags are the authoritative source. Reconcile 3 CI seams the CI worker flagged (gate was RED, now GREEN): - create schemas/validate.sh (SCHEMA_VALIDATE_CMD entrypoint) — L0 schema gate runs. - fix l1.sh/conformance.sh to run.sh's real interface (fixed _artifacts/ paths; no --junit/--coverage) and collect artifacts. - exec bits on new scripts. make -C ci gate => PASS (l0 skips locally w/o kyverno binary; green in CI). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
28 lines
2.2 KiB
Markdown
28 lines
2.2 KiB
Markdown
# Platform label/annotation convention (RATIFIED)
|
|
|
|
These label keys are consumed by the Kyverno policies in this directory. The **values**
|
|
are fixed by the spec; the **keys** are the platform convention, now **ratified in the
|
|
spec** — `homelab.keithjackson.dev/{egress-class,auth-mode,app-namespace,baseline}` are
|
|
documented in `docs/03-networking-isolation-and-egress.md` ("Platform label-key
|
|
convention") as the contract that network policies, Kyverno rules, and renderers key off.
|
|
Shared contract with WS-NET (egress rendering), WS-SEC (auth), and WS-GITOPS (rendering).
|
|
|
|
| Label key | Applied to | Values | Fixed by | Used by policy |
|
|
|---|---|---|---|---|
|
|
| `homelab.keithjackson.dev/app-namespace` | Namespace | `"true"` | (convention) marks an application namespace / trust zone (docs/03) | all namespace-scoped policies |
|
|
| `homelab.keithjackson.dev/egress-class` | Pod (+ controller template) | `internet` \| `vpn` | docs/03, docs/13 | `require-egress-class-label` (R-NET-05); also the selector Cilium Egress Gateway steers on (ADR-0013) |
|
|
| `homelab.keithjackson.dev/auth-mode` | Pod (+ controller template) | `oidc` \| `forward-auth` \| `native` \| `none` | docs/13, docs/15 | `require-auth-mode-label` (R-IDP-02) |
|
|
| `homelab.keithjackson.dev/baseline` | NetworkPolicy | `default-deny` | (convention) identifies the baseline NP | `require-default-deny-baseline` (generate), `validate-default-deny-shape` |
|
|
| `homelab.keithjackson.dev/secret-managed-by` | Secret | `controller` | (convention) exempts controller-generated Secrets | `disallow-plaintext-secrets` (exclude), admission `secret-provenance` |
|
|
|
|
## Rendering expectation (for WS-GITOPS)
|
|
|
|
The ServiceDefinition (`docs/13`) declares intent — `egress:` and `auth.mode:` — at the
|
|
service level. The renderer (T-0.3 / T-2.3 / T-6.1d) is expected to project those onto
|
|
the **pod template labels** above so that (a) Cilium selects pods by `egress-class` and
|
|
(b) these admission policies pass. Application namespaces are expected to be created
|
|
carrying `app-namespace: "true"` so the baseline is generated and the label/host
|
|
policies apply.
|
|
|
|
[`agents/coordination-protocol.md` §2]: ../../../home-network-k3s/agents/coordination-protocol.md
|