apiVersion: v1
kind: Pod
metadata:
  name: grc-claw-gateway
  labels:
    app.kubernetes.io/name: grc-claw
    app.kubernetes.io/component: gateway
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 65534
    runAsGroup: 65534
    fsGroup: 65534
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: gateway
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop: ["ALL"]
      privileged: false
    resources:
      requests:
        memory: "256Mi"
        cpu: "250m"
      limits:
        memory: "512Mi"
        cpu: "1000m"
    volumeMounts:
    - name: tmp
      mountPath: /tmp
  volumes:
  - name: tmp
    emptyDir:
      sizeLimit: 64Mi

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: grc-claw-role
  namespace: grc-claw
rules:
- apiGroups: [""]
  resources: ["configmaps", "secrets"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["events"]
  verbs: ["create", "patch"]
# No verbs: create/delete deployments, services, or cluster-wide resources
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: grc-claw-binding
  namespace: grc-claw
subjects:
- kind: ServiceAccount
  name: grc-claw-sa
  namespace: grc-claw
roleRef:
  kind: Role
  name: grc-claw-role
  apiGroup: rbac.authorization.k8s.io

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: grc-claw
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-gateway-ingress
  namespace: grc-claw
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/component: gateway
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: ingress-nginx
    ports:
    - protocol: TCP
      port: 3000
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-gateway-to-evidence-store
  namespace: grc-claw
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/component: gateway
  policyTypes:
  - Egress
  egress:
  - to:
    - podSelector:
        matchLabels:
          app.kubernetes.io/name: supabase-db
    ports:
    - protocol: TCP
      port: 5432

# Kyverno policy: enforce image signing and scan results
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: grc-claw-admission
spec:
  validationFailureAction: Enforce
  background: false
  rules:
  - name: verify-image-signature
    match:
      any:
      - resources:
          kinds: ["Pod"]
          selector:
            matchLabels:
              app.kubernetes.io/name: grc-claw
    verifyImages:
    - imageReferences:
      - "ghcr.io/grc-claw/*"
      attestors:
      - entries:
        - keys:
            publicKeys: |-
              -----BEGIN PUBLIC KEY-----
              ...
              -----END PUBLIC KEY-----
          rekor:
            url: https://rekor.sigstore.dev
  - name: require-scan-pass
    match:
      any:
      - resources:
          kinds: ["Pod"]
    validate:
      message: "Trivy scan must show no HIGH/CRITICAL vulnerabilities"
      deny:
        conditions:
          any:
          - key: "{{ images.configmaps.data.trivy-scan-result }}"
            operator: Equals
            value: "FAIL"

# GitHub Actions workflow snippet
- name: Sign image with Cosign
  uses: sigstore/cosign-installer@v3
  
- name: Sign container image
  run: |
    cosign sign --yes \
      --predicate attestation.json \
      --type slsaprovenance \
      ghcr.io/grc-claw/gateway:${{ github.sha }}
    
    cosign attach sbom \
      --sbom SBOM.json \
      ghcr.io/grc-claw/gateway:${{ github.sha }}

# Custom Falco rules for GRC_Claw
- rule: Unexpected Process in Gateway Container
  desc: Detect unexpected process execution in gateway pods
  condition: >
    container and container_name=gateway and
    spawned_process and
    not proc.name in (node, npm, gateway) and
    not proc.name in (container_privileged_procs)
  output: >
    Unexpected process in gateway (user=%user.name command=%proc.cmdline
    container=%container.id image=%container.image.repository)
  priority: CRITICAL
  tags: [container, gateway, GRC_Claw]

- rule: Evidence Chain Tampering
  desc: Detect write attempts to evidence graph outside normal flow
  condition: >
    container and container_name=evidence-writer and
    open_write and
    fd.name startswith /data/evidence and
    not proc.name in (node, postgres)
  output: >
    Evidence chain write outside normal flow (file=%fd.name
    process=%proc.name container=%container.id)
  priority: CRITICAL
  tags: [evidence, tampering, GRC_Claw]

- rule: Anomalous Outbound Connection
  desc: Detect unexpected outbound network connections from SOC pods
  condition: >
    container and
    outbound and
    not fd.sip.name in (allowed_destinations) and
    container_namespace=grc-claw
  output: >
    Anomalous outbound connection (dest=%fd.rip container=%container.id
    process=%proc.name)
  priority: HIGH
  tags: [network, anomaly, GRC_Claw]