Kubernetes/Velero audit provider and checks (0.1.16)

[Trifunovich]

Implement the next RestoreGuard core release: optional Kubernetes-cluster audit through SSH plus a configurable kubectl command prefix. It must assess Velero backup health and enabled cluster workload posture without any writes to audited systems.

The feature is config-file-only in v1. Its public behavior must be explicit: an omitted Velero namespace defaults to velero; an explicit null namespace disables Velero rules; checkWorkloads: false issues neither workload commands nor workload RBAC probes.

Acceptance criteria

• kubernetesClusters is an optional multi-cluster config surface with validated unique names, alias, kubectl prefix, namespace semantics, positive backup age, and backward-compatible defaults.
• Provider commands are read-only; each enabled surface is tracked in the audit progress ticker. Missing Velero API resources become a visible coverage finding only through a narrow, tested classifier; malformed output, transport, authentication, RBAC, and other failures leave a partial report.
• The audit produces deterministic Kubernetes service, backup, and provider-state data. It evaluates backup coverage/freshness/failure/schedule, PVC binding and data-protection evidence, deployment availability, and node readiness with stable finding identities that suppress correctly.
• Backup data protection is not inferred from a Backup CR alone: enabled PVC coverage has evidence from the appropriate Velero volume-backup or CSI-snapshot resource. A real restore of the test PVC is part of live acceptance.
• Doctor checks the command and permission shape for every enabled query, including a negative can-i response; disabled surfaces are not probed.
• The complete feature-surface checklist is satisfied: parser/check/config/runner/doctor tests; sanitized fixtures; docs; both identical samples; README; CHANGELOG; no wizard surface in v1 with that n/a decision documented.
• Live verification captures the no-Velero baseline before installation, then verifies a correctly configured Velero backup and restored token PVC after installation. Publishing remains owner-go only.

[Trifunovich]

Implementation is in PR #17 (feat: audit Kubernetes Velero backups).

• Per-PVC protection now requires either a completed mapped PodVolumeBackup or a Ready CSI VolumeSnapshot from the latest completed backup; Backup CR status alone is never evidence.
• Read-only provider, config validation, Doctor coverage/RBAC preflight, progress reporting, samples, docs, fixtures, and tests are included.
• Release build and tests pass: 274 tests.
• Independent reviews found no merge blockers after the protection/error-handling corrections.

The card remains In Progress: the documented real-cluster gate is outstanding (no-Velero baseline, successful backup, and token-PVC restore). This workstation does not have the configured lab99 SSH alias/key, and the deployed lab configuration was left unchanged.

[Trifunovich]

Implementation is in PR #17 (feat: audit Kubernetes Velero backups).

• Per-PVC protection now requires either a completed mapped PodVolumeBackup or a Ready CSI VolumeSnapshot from the latest completed backup; Backup CR status alone is never evidence.
• Read-only provider, config validation, Doctor coverage/RBAC preflight, progress reporting, samples, docs, fixtures, and tests are included.
• Release build and tests pass: 274 tests.
• Independent reviews found no merge blockers after the protection/error-handling corrections.

Live Doctor passed all nine Kubernetes requirements through the documented K3s path. The read-only audit completed without provider errors and found the current lab state: latest Velero backup daily-backup-20260825030009 is PartiallyFailed, no Completed backup exists, and email-digest/email-digest is degraded.

The card remains In Progress pending recovery of the backup path, a Completed-backup audit, and the token-PVC restore proof. The deployed lab configuration was left unchanged.

[Trifunovich]

PR #17 is merged.

• Release tests: 274/274 passed.
• Live Doctor passed all nine Kubernetes requirements with no provider errors.
• A corrected Velero filesystem backup completed and an isolated token-PVC backup/restore proof completed.
• The live audit is read-only and correctly reports explicitly excluded rebuildable/external volumes and separate storage designs as coverage follow-up; it does not silently claim them protected.

Durable operational evidence and the remediation record are in the private homelab documentation.