From aebd73679e2e3a5cacb0d75b7aa105e59ec46c37 Mon Sep 17 00:00:00 2001 From: stxkxs <139715017+stxkxs@users.noreply.github.com> Date: Wed, 5 Aug 2026 22:31:42 -0700 Subject: [PATCH] chore: re-vendor the CRD schemas at the current upstream MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Moves the `schemas/crd/source.json` pin to nanohype/eks-agent-platform@2f3f29c and rewrites the vendored copies and their digests from it. Two descriptions move. `spec.compliance` on both Platform and Tenant now says what the flags do: they declare which regime a workload is in scope for, and `cloudgov platform audit` checks the rest of the declaration is consistent with that posture. They previously named controls the flags do not reach — Object Lock on the artifacts bucket, cross-region inference suppression, PII detection on Guardrails, invocation logging. `spec.datastores[].deletionPolicy` picks up its per-kind description: what Retain means differs by service, and the field reaches the substrate module's destroy path rather than `kubectl delete platform`, which orphans every store regardless because the operator holds no delete permission. Schema shape is unchanged, so nothing this repo renders or validates differs. `schemas:check` verifies the copies are byte-identical to upstream at the pinned ref, and platform.yaml still validates against them. --- .../crd/platform.nanohype.dev_platforms.yaml | 46 ++++++++++++++----- .../crd/platform.nanohype.dev_tenants.yaml | 15 ++++-- schemas/crd/source.json | 6 +-- 3 files changed, 47 insertions(+), 20 deletions(-) diff --git a/schemas/crd/platform.nanohype.dev_platforms.yaml b/schemas/crd/platform.nanohype.dev_platforms.yaml index a0649b2..6a888fc 100644 --- a/schemas/crd/platform.nanohype.dev_platforms.yaml +++ b/schemas/crd/platform.nanohype.dev_platforms.yaml @@ -109,15 +109,20 @@ spec: - name type: object compliance: - description: Compliance flags drive stricter defaults across the Platform. + description: |- + Compliance is the posture this Platform declares, audited by + `cloudgov platform audit` rather than enforced by this operator. properties: hipaa: description: |- - HIPAA: object-lock compliance mode, no cross-region inference, PII detect - required on Guardrails. + HIPAA marks the Platform as handling PHI. One audited invariant: a + Platform whose Tenant sets hipaa must set it too. type: boolean soc2: - description: 'SOC2: invocation logging required, kill-switch enabled.' + description: |- + SOC2 marks the Platform as in SOC 2 audit scope. Two audited invariants: + the referenced BudgetPolicy must have killSwitchEnabled, and a Platform + whose Tenant sets soc2 must set it too. type: boolean type: object datastores: @@ -170,14 +175,31 @@ spec: deletionPolicy: default: Retain description: |- - DeletionPolicy governs the underlying AWS resource when this datastore is - removed from spec or the Platform is deleted (T2). - Retain (default): the resource is orphaned, tagged - platform.nanohype.dev/owned-by and platform.nanohype.dev/released-at, - so a `kubectl delete platform` never takes the data with it. - Delete: the resource is torn down with the declaration. - Independent of the per-kind deletion_protection backstop, which defaults on - for relational and cache — two gates, both defaulting closed. + DeletionPolicy declares whether this datastore's AWS resource should + survive a teardown of the substrate that provisioned it. + + It does NOT govern `kubectl delete platform`. The operator holds no delete + permission on any datastore, so deleting the CR orphans every store + regardless of this field — the isolation boundary is enforced by + permission, not by policy. This field reaches only the tenant-substrate + module's destroy path. + + What it means is per-kind, because the same word cannot name the same + mechanism across services that offer different ones: + keyValue: Retain arms DynamoDB deletion protection, which refuses the + delete outright and leaves no cost behind. The clean case. + relational: Retain takes a final Aurora snapshot; Delete skips it. The + snapshot outlives the cluster and begins billing per GB-month once it + falls outside backupRetentionDays, so Retain here is durability with a + cost tail, not free protection. Aurora's own deletionProtection is a + separate and independent gate: Delete alone will not drop a protected + cluster, both must open. + objectStore, queue, cache, stream: no effect. S3 has no deletion + protection (force_destroy governs emptying a bucket, not deleting an + empty one), and SQS, ElastiCache and MSK offer no retain lever at all. + Cache is derived data by design and is deliberately unprotected. + + The operator's substrate-wide teardown lever overrides this in every case. enum: - Retain - Delete diff --git a/schemas/crd/platform.nanohype.dev_tenants.yaml b/schemas/crd/platform.nanohype.dev_tenants.yaml index ce47721..16bb922 100644 --- a/schemas/crd/platform.nanohype.dev_tenants.yaml +++ b/schemas/crd/platform.nanohype.dev_tenants.yaml @@ -79,16 +79,21 @@ spec: type: string compliance: description: |- - Compliance baseline applied to every Platform owned by this Tenant - unless the Platform itself sets a stricter value. + Compliance is the posture expected of every Platform this Tenant owns. A + Platform may declare more than its Tenant, never less: `cloudgov platform + audit` reports a Platform declaring less than its Tenant as a finding. + Nothing copies this value down — each Platform declares its own. properties: hipaa: description: |- - HIPAA: object-lock compliance mode, no cross-region inference, PII detect - required on Guardrails. + HIPAA marks the Platform as handling PHI. One audited invariant: a + Platform whose Tenant sets hipaa must set it too. type: boolean soc2: - description: 'SOC2: invocation logging required, kill-switch enabled.' + description: |- + SOC2 marks the Platform as in SOC 2 audit scope. Two audited invariants: + the referenced BudgetPolicy must have killSwitchEnabled, and a Platform + whose Tenant sets soc2 must set it too. type: boolean type: object contact: diff --git a/schemas/crd/source.json b/schemas/crd/source.json index 1457ebe..2b0c91a 100644 --- a/schemas/crd/source.json +++ b/schemas/crd/source.json @@ -3,17 +3,17 @@ "upstream": { "repository": "nanohype/eks-agent-platform", "path": "operators/config/crd/bases", - "ref": "e2d944831db73d596eb1bc8faa9547bf4aac9208" + "ref": "2f3f29c57f97925d0ec7771beda5ef94a3c7663c" }, "generator": "controller-gen v0.21.0", "files": [ { "file": "platform.nanohype.dev_tenants.yaml", - "sha256": "09314d9c472917b3b20fe64e99bcd46d323b7684932fcdedbb923ff2f539fcbc" + "sha256": "f0c193e7b127368bbc1e77458d8e46a5bcbc8d35752c0d6ee45fa7bd58c4fd12" }, { "file": "platform.nanohype.dev_platforms.yaml", - "sha256": "9750f11ab6f1161dac4dd3883bd1971a88434ce9cffc4fd8232696c18b8e0377" + "sha256": "1e93097f112db6933b301685d38736014613d6a626244729c47f456677e1b991" }, { "file": "governance.nanohype.dev_budgetpolicies.yaml",