open-platform/mitosis
3
0
Fork 0
Code Issues 27 Pull requests 9 Releases 4 Packages 1 Wiki Activity Actions

POL-0: Kyverno policy-governance model (design) — plat/mitosis#38 #49

Merged
plat merged 1 commit from docs/pol-0-policy-governance into main 2026-07-01 20:33:17 +00:00
Conversation 0 Commits 1 Files changed 1 +273
plat commented 2026-07-01 02:36:33 +00:00
Owner
Copy link

POL-0: Kyverno policy-governance model (design only)

Governance-of-governance doc that gates the whole Kyverno track (POL-1..POL-5). Design only — no code. Adds docs/proposals/policy-governance-kyverno.md.

Framing (held): Kyverno is the deterministic backend (validate/mutate/generate/verifyImages, with generate synchronize:true reverting tampering). The agent authoring policy YAML from an NL prompt is the frontend. Kyverno is not a language-to-system compiler. Today all governance is hand-rolled TS in overlayManifests() (mcp/src/server.ts:2182), rendered once with no drift correction; adding Kyverno is a cheap Flux seam (dependsOn: cert-manager).

Decisions (each with a recommendation + tradeoff):

  1. Policy repo location — recommend a separate policy repo (stricter reviewer set), CODEOWNERS-gated gitops path as bootstrap.
  2. Agent write access — recommend propose-only via human-merged PR, never direct write; per-category yes/no (quota tier: propose; default-deny / PSA / RBAC / failurePolicy: human-only). Tied to RBAC-1.
  3. enforce vs audit — recommend audit-first for new policies (parity migrations of existing TS may ship enforce); generate drift-correction is not delayed.
  4. failurePolicy — recommend fail-closed (Fail), narrowly scoped + HA + break-glass + a kill-the-webhook test, matching authorize() (server.ts:987).

Invariants enumerated so POL-1..POL-5 become buildable: POL-1 baselines; POL-2 generate-migration of overlayManifests(); POL-3 verifyImages/cosign; POL-4 secrets+domains+network; POL-5 RBAC.

Do not merge — for review.

roadmap POL-0 (#38)

## POL-0: Kyverno policy-governance model (design only) Governance-of-governance doc that gates the whole Kyverno track (POL-1..POL-5). **Design only — no code.** Adds `docs/proposals/policy-governance-kyverno.md`. **Framing (held):** Kyverno is the deterministic **backend** (validate/mutate/generate/verifyImages, with `generate synchronize:true` reverting tampering). The agent authoring policy YAML from an NL prompt is the **frontend**. Kyverno is not a language-to-system compiler. Today all governance is hand-rolled TS in `overlayManifests()` (`mcp/src/server.ts:2182`), rendered once with no drift correction; adding Kyverno is a cheap Flux seam (`dependsOn: cert-manager`). **Decisions (each with a recommendation + tradeoff):** 1. **Policy repo location** — recommend a separate `policy` repo (stricter reviewer set), CODEOWNERS-gated `gitops` path as bootstrap. 2. **Agent write access** — recommend propose-only via human-merged PR, never direct write; per-category yes/no (quota tier: propose; default-deny / PSA / RBAC / failurePolicy: human-only). Tied to RBAC-1. 3. **enforce vs audit** — recommend audit-first for new policies (parity migrations of existing TS may ship enforce); `generate` drift-correction is not delayed. 4. **failurePolicy** — recommend fail-closed (`Fail`), narrowly scoped + HA + break-glass + a kill-the-webhook test, matching `authorize()` (`server.ts:987`). **Invariants enumerated** so POL-1..POL-5 become buildable: POL-1 baselines; POL-2 generate-migration of `overlayManifests()`; POL-3 verifyImages/cosign; POL-4 secrets+domains+network; POL-5 RBAC. Do **not** merge — for review. roadmap POL-0 (#38) 
Governance-of-governance doc gating the Kyverno track (POL-1..POL-5).
Decides policy repo location, agent write access, enforce-vs-audit
default, and webhook failurePolicy; enumerates POL-1..POL-5 invariants.

roadmap POL-0 (plat/mitosis#38)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
plat merged commit bd8d0848c1 into main 2026-07-01 20:33:17 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug
Something is not working

  
discussion
An idea that is still being discussed

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
goal

   
help wanted
Need some help

  
horizon:backlog

   
horizon:governance

   
horizon:mvp

   
invalid
Something is wrong

  
operator-decision
Blocked on the owner's call — no agent work until decided

  
question
More information is needed

  
roadmap

   
wontfix
This won't be fixed

No labels
bug
discussion
duplicate
enhancement
goal
help wanted
horizon:backlog
horizon:governance
horizon:mvp
invalid
operator-decision
question
roadmap
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
open-platform/mitosis!49
No description provided.