mirror of
https://github.com/vee1e/krply.git
synced 2026-09-01 09:49:51 +00:00
lakshit verma
9f4b6c2c5a
Audit: correlation event_ids include stage and response code so the multi-stage lines of one request no longer collapse under dedup; match scans are bounded to a time window and a page instead of the object's full history. Web: dry-run results are read from dry_run_result (nested) so the verdict is rendered correctly and conflicts/errors/skipped are shown; the plans view no longer POSTs an unsolicited plan on page load; coverage and streams surface API errors instead of showing a misleading empty state and follow cursor pagination so they are not stuck on the oldest page; the diff path tokenizer handles backslash-escaped dotted keys. Deploy/CI: the chart no longer grants the query server a cluster-wide read ClusterRole, runs as non-root with a read-only root filesystem, adds liveness/readiness probes, wires the ConfigMap as env (STORE_PATH, LISTEN_ADDR), defaults the journal to a PVC instead of an ephemeral emptyDir, and adds imagePullSecrets; the replay ClusterRole drops the unused update verb; a Dockerfile builds a static distroless image; GitHub actions are pinned by commit SHA, jobs set least-privilege permissions, the Vercel deploy skips fork PRs, CI passes the Makefile test timeouts, and make lint runs a real web syntax check. Docs: event-schema/consistency no longer describe an ingest_sequence field, an observed-time-based event_id, or restart-from-checkpoint; the threat model documents the unauthenticated HTTP API surface and the chart's RBAC change; replay-safety matches the enforced dry-run gate.
41 lines
1.4 KiB
YAML
41 lines
1.4 KiB
YAML
# Replay ClusterRole: create/patch access for the replay identity.
|
|
#
|
|
# Used by `krply replay apply` against a disposable TARGET cluster only. It can
|
|
# only create and update the declarative roots krply replays (namespaces,
|
|
# configmaps, services, deployments, statefulsets, daemonsets); it cannot
|
|
# delete and has no access to Secrets, Pods, or other kinds. get/list are
|
|
# granted for the dry-run phase and to verify the plan target.
|
|
#
|
|
# This role is intentionally NOT cluster-admin. Never grant the replay identity
|
|
# write access to a production/source cluster.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: krply-replay
|
|
labels:
|
|
app.kubernetes.io/name: krply
|
|
app.kubernetes.io/component: replay
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["namespaces", "configmaps", "services"]
|
|
verbs: ["create", "patch", "get", "list"]
|
|
- apiGroups: ["apps"]
|
|
resources: ["deployments", "statefulsets", "daemonsets"]
|
|
verbs: ["create", "patch", "get", "list"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: krply-replay
|
|
labels:
|
|
app.kubernetes.io/name: krply
|
|
app.kubernetes.io/component: replay
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: krply-replay
|
|
subjects:
|
|
# Replace with the ServiceAccount that runs replay in the target cluster.
|
|
- kind: ServiceAccount
|
|
name: krply-replay
|
|
namespace: krply
|