riotpiao.com/tasks/02-phase1-atlas-core.md

Phase 1 — atlas core

~4 days. Every surface depends on this. RED → GREEN → REFACTOR.

RED (write tests first, confirm they fail)

• redact_test.go — golden test: serialized snapshot contains none of the denied fields, run against a fixture captured from the real cluster
• rbac_test.go — atlas ServiceAccount receives 403 on get secrets in every namespace
• snapshot_test.go — an informer event produces the expected delta

GREEN

• ClusterRole: verbs get,list,watch only, explicit resource list — no secrets, no *, no wildcard apiGroups
• client-go informers: kube API (nodes, namespaces, workloads), Argo CD Application CRs
• Reducer: informer events → in-memory snapshot, redacted at write time
• DTO construction — allowlist only. Emitted: name, namespace, kind, phase, ready counts, restart count, age, node name, health status, sync status, sync wave, explicit label subset. Never emitted: container env/args, image digests/tags, spec.source.repoURL, spec.source.path, annotations, pod IPs, cluster IPs, Secret names, status.conditions[].message, node internal IPs
• Redis publish (snapshot deltas → kmsvc-redis-master.sqs:6379)
• NetworkPolicy on atlas: egress restricted to kube API, prometheus-operated.monitoring, reasoning-predictor.llm-serving, kmsvc-redis-master.sqs; ingress from ingress-nginx only
• Container hardening: runAsNonRoot, read-only root filesystem, all capabilities dropped, seccompProfile: RuntimeDefault

REFACTOR

• Run simplify skill pass on reducer/DTO code
• Confirm no _ = on errors, no naked returns, every upstream call carries a context.Context (go-error-handling, go-context skills)

Verify

kubectl auth can-i get secrets --as=system:serviceaccount:portfolio:atlas   # no
go test ./... -run TestRedact -v
go test ./... -run TestRBAC -v
go test ./... -run TestSnapshot -v

Next: 03-phase2-topology.md