36 lines
2.0 KiB
Markdown
36 lines
2.0 KiB
Markdown
|
# Phase 1 — atlas core
|
||
|
|
|
||
|
|
~4 days. Every surface depends on this. RED → GREEN → REFACTOR.
|
||
|
|
|
||
|
|
## RED (write tests first, confirm they fail)
|
||
|
|
|
||
|
|
- [ ] `redact_test.go` — golden test: serialized snapshot contains none of the denied fields, run against a fixture captured from the real cluster
|
||
|
|
- [ ] `rbac_test.go` — atlas ServiceAccount receives 403 on `get secrets` in every namespace
|
||
|
|
- [ ] `snapshot_test.go` — an informer event produces the expected delta
|
||
|
|
|
||
|
|
## GREEN
|
||
|
|
|
||
|
|
- [ ] ClusterRole: verbs `get,list,watch` only, explicit resource list — no `secrets`, no `*`, no wildcard apiGroups
|
||
|
|
- [ ] client-go informers: kube API (nodes, namespaces, workloads), Argo CD `Application` CRs
|
||
|
|
- [ ] Reducer: informer events → in-memory snapshot, redacted **at write time**
|
||
|
|
- [ ] DTO construction — allowlist only. Emitted: name, namespace, kind, phase, ready counts, restart count, age, node name, health status, sync status, sync wave, explicit label subset. Never emitted: container env/args, image digests/tags, `spec.source.repoURL`, `spec.source.path`, annotations, pod IPs, cluster IPs, Secret names, `status.conditions[].message`, node internal IPs
|
||
|
|
- [ ] Redis publish (snapshot deltas → `kmsvc-redis-master.sqs:6379`)
|
||
|
|
- [ ] NetworkPolicy on atlas: egress restricted to kube API, `prometheus-operated.monitoring`, `reasoning-predictor.llm-serving`, `kmsvc-redis-master.sqs`; ingress from `ingress-nginx` only
|
||
|
|
- [ ] Container hardening: `runAsNonRoot`, read-only root filesystem, all capabilities dropped, `seccompProfile: RuntimeDefault`
|
||
|
|
|
||
|
|
## REFACTOR
|
||
|
|
|
||
|
|
- [ ] Run `simplify` skill pass on reducer/DTO code
|
||
|
|
- [ ] Confirm no `_ =` on errors, no naked returns, every upstream call carries a `context.Context` (go-error-handling, go-context skills)
|
||
|
|
|
||
|
|
## Verify
|
||
|
|
|
||
|
|
```bash
|
||
|
|
kubectl auth can-i get secrets --as=system:serviceaccount:portfolio:atlas # no
|
||
|
|
go test ./... -run TestRedact -v
|
||
|
|
go test ./... -run TestRBAC -v
|
||
|
|
go test ./... -run TestSnapshot -v
|
||
|
|
```
|
||
|
|
|
||
|
|
Next: [03-phase2-topology.md](03-phase2-topology.md)
|