open-platform/mitosis

Fork 0

/goal /ultracode-workflows [POL-5] policy-govern the RBAC/identity invariants #43

New issue

Closed

opened 2026-07-01 02:03:52 +00:00 by plat · 2 comments

plat commented

2026-07-01 02:03:52 +00:00

Owner

Track/Wave: POL-5 · Wave G5 · Size M
Repos: gitops
Depends on: POL-1, RBAC-2, RBAC-4

Why

The RBAC guarantees (private-by-permission, no god-PAT, scoped agent runs) must be continuously enforced so a future overlay change can't silently ship an app without forwardAuth or an over-scoped agent SA.

Scope

Kyverno ClusterPolicies: every app Ingress must carry the forwardAuth middleware annotation (RBAC-2); no ServiceAccount may bind an admin-scoped/god-PAT-equivalent ClusterRole; agent runs must use the per-app agent-ctx namespaced Role (RBAC-4), never a cluster-wide grant.

Acceptance

An app Ingress missing the forwardAuth middleware is rejected; a SA binding an admin ClusterRole is rejected; an agent-ctx SA with the scoped namespaced Role admits — validated on the staging platform.

Notes

Adds distinct policy files; shares only the kyverno kustomization include line.

Part of the First Client Deploy → Governance roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.

**Track/Wave:** `POL-5` · Wave **G5** · Size **M** **Repos:** `gitops` **Depends on:** POL-1, RBAC-2, RBAC-4 ## Why The RBAC guarantees (private-by-permission, no god-PAT, scoped agent runs) must be continuously enforced so a future overlay change can't silently ship an app without forwardAuth or an over-scoped agent SA. ## Scope Kyverno ClusterPolicies: every app Ingress must carry the forwardAuth middleware annotation (RBAC-2); no ServiceAccount may bind an admin-scoped/god-PAT-equivalent ClusterRole; agent runs must use the per-app agent-ctx namespaced Role (RBAC-4), never a cluster-wide grant. ## Acceptance An app Ingress missing the forwardAuth middleware is rejected; a SA binding an admin ClusterRole is rejected; an agent-ctx SA with the scoped namespaced Role admits — validated on the staging platform. ## Notes **Adds distinct policy files; shares only the kyverno kustomization include line.** --- *Part of the **First Client Deploy → Governance** roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.*

plat added this to the Client Deploy → Governance Roadmap milestone

2026-07-01 02:03:52 +00:00

plat added the

goal

roadmap

horizon:governance

labels

2026-07-01 02:03:52 +00:00

plat added a new dependency

2026-07-01 02:04:51 +00:00

#39 /goal /ultracode-workflows [POL-1] land Kyverno as a Flux-reconciled component + primitive-independent baselines

plat added a new dependency

2026-07-01 02:04:52 +00:00

#29 /goal /ultracode-workflows [RBAC-2] forwardAuth platform-auth service + Traefik middleware (apps private by Forgejo permission, zero app auth code)

plat added a new dependency

2026-07-01 02:04:52 +00:00

#31 /goal /ultracode-workflows [RBAC-4] retire the god-PAT — per-user delegated agent identity + per-app scoped read-only kube token

plat added a new dependency

2026-07-01 02:04:57 +00:00

#46 /goal /ultracode-workflows [GATE] validated grandchild acceptance gate — secrets+domains+rbac+policy on a VPS depth-2/3 platform

plat referenced this issue

2026-07-01 02:05:20 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47

plat referenced this issue from a commit

2026-07-01 20:41:19 +00:00

POL-5: Kyverno validate RBAC/identity invariants (plat/mitosis#43)

plat referenced this issue from a commit

2026-07-01 21:22:33 +00:00

POL-5: Kyverno validate RBAC/identity invariants (plat/mitosis#43) (#9)

plat referenced this issue

2026-07-02 02:21:34 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47

plat referenced this issue from a commit

2026-07-02 15:46:59 +00:00

kyverno: reports-controller read RBAC for POL-4/POL-5 audited kinds (plat/mitosis#42 plat/mitosis#43)

plat referenced this issue from a commit

2026-07-02 15:46:59 +00:00

POL-4/POL-5: default-off Audit->Enforce flip component + ENFORCE.md (plat/mitosis#42 plat/mitosis#43)

plat commented

2026-07-02 15:48:08 +00:00

Author

Owner

Enforce-flip prepared (POL-5 half): plat/gitops#14 — default-off, reviewable, NOT merged.

Same one-include-line mechanism as the POL-4 half (components: [enforce] in kyverno-policies).
POL-5 calls: no-admin-clusterrole-binding and agent-runs-use-scoped-role flip to Enforce (zero live violations; offline matrix: tenant-SA→cluster-admin CRB denied, agent-ctx CRB denied, agent-ctx→ClusterRole/edit denied, the sanctioned Role/agent-ctx binding admits) — but their failurePolicy deliberately stays Ignore: the ClusterRoleBinding rules match a cluster-scoped kind that escapes the webhook's namespaceSelector bound, and Fail there could let a Kyverno outage block Flux applying platform RBAC — wedging exactly the recovery path POL-0 Decision 4 requires to stay open. Deny-when-reachable + background audit is the honest posture.
require-forwardauth-on-app-ingress is deferred by default (observed live: it correctly FAILs every app Ingress while PLAT_FORWARD_AUTH is off — flipping it would reject every app deploy). A separate opt-in enforce-forwardauth/ component exists for platforms running PLAT_FORWARD_AUTH=1: components: [enforce, enforce-forwardauth].
Audit visibility fixed on main (default-safe): the reports-controller had no read RBAC for RoleBindings/ClusterRoleBindings, so both POL-5 binding policies produced zero background report entries — the bake window #42/#43 depend on was structurally blind.

Operator pulls the trigger; ENFORCE.md carries the checklist (disposable germination with the component active + kill-the-webhook test).

**Enforce-flip prepared (POL-5 half): plat/gitops#14 — default-off, reviewable, NOT merged.** - Same one-include-line mechanism as the POL-4 half (`components: [enforce]` in kyverno-policies). - POL-5 calls: `no-admin-clusterrole-binding` and `agent-runs-use-scoped-role` flip to **Enforce** (zero live violations; offline matrix: tenant-SA→cluster-admin CRB denied, agent-ctx CRB denied, agent-ctx→`ClusterRole/edit` denied, the sanctioned `Role/agent-ctx` binding admits) — but their `failurePolicy` deliberately stays **Ignore**: the ClusterRoleBinding rules match a cluster-scoped kind that escapes the webhook's namespaceSelector bound, and `Fail` there could let a Kyverno outage block Flux applying *platform* RBAC — wedging exactly the recovery path POL-0 Decision 4 requires to stay open. Deny-when-reachable + background audit is the honest posture. - `require-forwardauth-on-app-ingress` is **deferred by default** (observed live: it correctly FAILs every app Ingress while PLAT_FORWARD_AUTH is off — flipping it would reject every app deploy). A separate opt-in `enforce-forwardauth/` component exists for platforms running PLAT_FORWARD_AUTH=1: `components: [enforce, enforce-forwardauth]`. - Audit visibility fixed on main (default-safe): the reports-controller had no read RBAC for RoleBindings/ClusterRoleBindings, so both POL-5 binding policies produced **zero** background report entries — the bake window #42/#43 depend on was structurally blind. Operator pulls the trigger; ENFORCE.md carries the checklist (disposable germination with the component active + kill-the-webhook test).

plat added the

operator-decision

label

2026-07-06 14:52:18 +00:00

plat referenced this issue

2026-07-06 14:52:45 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47

plat commented

2026-07-06 19:24:10 +00:00

Author

Owner

Enforce flip DONE + live (2026-07-06), with 2 bugs found & fixed

The Audit→Enforce flip (components: [enforce]) is merged to plat/gitops main (PR #15, on top of #14) and captured in the genesis seed r41, so every future germination + the nightly gate now carry Enforce. Verified live on the product-garden.com granddaughter: admission controller 3 replicas (HA), 11 validate rules at Enforce, plaintext-Secret / unregistered-host / public-image all denied.

Pre-flight (qa-d1) + this real-VPS app run surfaced 3 issues, all handled:

PR#14 ConfigMap was half-inert — Flux merges spec.values OVER valuesFrom, so the enforce ConfigMap's replicas/namespaceSelector never landed. Fixed inline in the kyverno HelmRelease (PR #15).
ENFORCE.md kill-test was fail-OPEN — a graceful scale --replicas=0 makes Kyverno delete its own webhooks; rewrote it to a crash-style kill (PR #15).
Enforce broke ALL app TLS (#91) — disallow-unmanaged-secrets blocked cert-manager's issuance temporaries (wildcard-plat-tls-<rand>). Fixed with a glob allowlist (gitops#17). This is why the flip must not go onto a live app-serving platform without the fix — the current ENFORCE.md pre-flight doesn't deploy a real app+TLS.

Enforce is delivered. Closing #42/#43; residual hardening (ENFORCE.md checklist gap) tracked in #91.

## Enforce flip DONE + live (2026-07-06), with 2 bugs found & fixed The Audit→Enforce flip (`components: [enforce]`) is merged to **plat/gitops main** (PR #15, on top of #14) and captured in the **genesis seed r41**, so every future germination + the nightly gate now carry Enforce. Verified live on the `product-garden.com` granddaughter: admission controller **3 replicas** (HA), 11 validate rules at Enforce, plaintext-Secret / unregistered-host / public-image all **denied**. Pre-flight (qa-d1) + this real-VPS app run surfaced 3 issues, all handled: 1. **PR#14 ConfigMap was half-inert** — Flux merges `spec.values` OVER `valuesFrom`, so the enforce ConfigMap's replicas/namespaceSelector never landed. Fixed inline in the kyverno HelmRelease (PR #15). 2. **ENFORCE.md kill-test was fail-OPEN** — a graceful `scale --replicas=0` makes Kyverno delete its own webhooks; rewrote it to a crash-style kill (PR #15). 3. **Enforce broke ALL app TLS** (#91) — `disallow-unmanaged-secrets` blocked cert-manager's issuance temporaries (`wildcard-plat-tls-<rand>`). Fixed with a glob allowlist (gitops#17). **This is why the flip must not go onto a live app-serving platform without the fix** — the current ENFORCE.md pre-flight doesn't deploy a real app+TLS. Enforce is delivered. Closing #42/#43; residual hardening (ENFORCE.md checklist gap) tracked in #91.

plat closed this issue

2026-07-06 19:24:10 +00:00