diff --git a/schemas/crd/platform.nanohype.dev_platforms.yaml b/schemas/crd/platform.nanohype.dev_platforms.yaml index a0649b2..6a888fc 100644 --- a/schemas/crd/platform.nanohype.dev_platforms.yaml +++ b/schemas/crd/platform.nanohype.dev_platforms.yaml @@ -109,15 +109,20 @@ spec: - name type: object compliance: - description: Compliance flags drive stricter defaults across the Platform. + description: |- + Compliance is the posture this Platform declares, audited by + `cloudgov platform audit` rather than enforced by this operator. properties: hipaa: description: |- - HIPAA: object-lock compliance mode, no cross-region inference, PII detect - required on Guardrails. + HIPAA marks the Platform as handling PHI. One audited invariant: a + Platform whose Tenant sets hipaa must set it too. type: boolean soc2: - description: 'SOC2: invocation logging required, kill-switch enabled.' + description: |- + SOC2 marks the Platform as in SOC 2 audit scope. Two audited invariants: + the referenced BudgetPolicy must have killSwitchEnabled, and a Platform + whose Tenant sets soc2 must set it too. type: boolean type: object datastores: @@ -170,14 +175,31 @@ spec: deletionPolicy: default: Retain description: |- - DeletionPolicy governs the underlying AWS resource when this datastore is - removed from spec or the Platform is deleted (T2). - Retain (default): the resource is orphaned, tagged - platform.nanohype.dev/owned-by and platform.nanohype.dev/released-at, - so a `kubectl delete platform` never takes the data with it. - Delete: the resource is torn down with the declaration. - Independent of the per-kind deletion_protection backstop, which defaults on - for relational and cache — two gates, both defaulting closed. + DeletionPolicy declares whether this datastore's AWS resource should + survive a teardown of the substrate that provisioned it. + + It does NOT govern `kubectl delete platform`. The operator holds no delete + permission on any datastore, so deleting the CR orphans every store + regardless of this field — the isolation boundary is enforced by + permission, not by policy. This field reaches only the tenant-substrate + module's destroy path. + + What it means is per-kind, because the same word cannot name the same + mechanism across services that offer different ones: + keyValue: Retain arms DynamoDB deletion protection, which refuses the + delete outright and leaves no cost behind. The clean case. + relational: Retain takes a final Aurora snapshot; Delete skips it. The + snapshot outlives the cluster and begins billing per GB-month once it + falls outside backupRetentionDays, so Retain here is durability with a + cost tail, not free protection. Aurora's own deletionProtection is a + separate and independent gate: Delete alone will not drop a protected + cluster, both must open. + objectStore, queue, cache, stream: no effect. S3 has no deletion + protection (force_destroy governs emptying a bucket, not deleting an + empty one), and SQS, ElastiCache and MSK offer no retain lever at all. + Cache is derived data by design and is deliberately unprotected. + + The operator's substrate-wide teardown lever overrides this in every case. enum: - Retain - Delete diff --git a/schemas/crd/platform.nanohype.dev_tenants.yaml b/schemas/crd/platform.nanohype.dev_tenants.yaml index ce47721..16bb922 100644 --- a/schemas/crd/platform.nanohype.dev_tenants.yaml +++ b/schemas/crd/platform.nanohype.dev_tenants.yaml @@ -79,16 +79,21 @@ spec: type: string compliance: description: |- - Compliance baseline applied to every Platform owned by this Tenant - unless the Platform itself sets a stricter value. + Compliance is the posture expected of every Platform this Tenant owns. A + Platform may declare more than its Tenant, never less: `cloudgov platform + audit` reports a Platform declaring less than its Tenant as a finding. + Nothing copies this value down — each Platform declares its own. properties: hipaa: description: |- - HIPAA: object-lock compliance mode, no cross-region inference, PII detect - required on Guardrails. + HIPAA marks the Platform as handling PHI. One audited invariant: a + Platform whose Tenant sets hipaa must set it too. type: boolean soc2: - description: 'SOC2: invocation logging required, kill-switch enabled.' + description: |- + SOC2 marks the Platform as in SOC 2 audit scope. Two audited invariants: + the referenced BudgetPolicy must have killSwitchEnabled, and a Platform + whose Tenant sets soc2 must set it too. type: boolean type: object contact: diff --git a/schemas/crd/source.json b/schemas/crd/source.json index 1457ebe..2b0c91a 100644 --- a/schemas/crd/source.json +++ b/schemas/crd/source.json @@ -3,17 +3,17 @@ "upstream": { "repository": "nanohype/eks-agent-platform", "path": "operators/config/crd/bases", - "ref": "e2d944831db73d596eb1bc8faa9547bf4aac9208" + "ref": "2f3f29c57f97925d0ec7771beda5ef94a3c7663c" }, "generator": "controller-gen v0.21.0", "files": [ { "file": "platform.nanohype.dev_tenants.yaml", - "sha256": "09314d9c472917b3b20fe64e99bcd46d323b7684932fcdedbb923ff2f539fcbc" + "sha256": "f0c193e7b127368bbc1e77458d8e46a5bcbc8d35752c0d6ee45fa7bd58c4fd12" }, { "file": "platform.nanohype.dev_platforms.yaml", - "sha256": "9750f11ab6f1161dac4dd3883bd1971a88434ce9cffc4fd8232696c18b8e0377" + "sha256": "1e93097f112db6933b301685d38736014613d6a626244729c47f456677e1b991" }, { "file": "governance.nanohype.dev_budgetpolicies.yaml",