Skip to content

chore: re-vendor the CRD schemas at the current upstream #59

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stxkxs merged 1 commit into from
Aug 6, 2026
Merged

chore: re-vendor the CRD schemas at the current upstream #59

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 34 additions & 12 deletions schemas/crd/platform.nanohype.dev_platforms.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,15 +109,20 @@ spec:
- name
type: object
compliance:
description: Compliance flags drive stricter defaults across the Platform.
description: |-
Compliance is the posture this Platform declares, audited by
`cloudgov platform audit` rather than enforced by this operator.
properties:
hipaa:
description: |-
HIPAA: object-lock compliance mode, no cross-region inference, PII detect
required on Guardrails.
HIPAA marks the Platform as handling PHI. One audited invariant: a
Platform whose Tenant sets hipaa must set it too.
type: boolean
soc2:
description: 'SOC2: invocation logging required, kill-switch enabled.'
description: |-
SOC2 marks the Platform as in SOC 2 audit scope. Two audited invariants:
the referenced BudgetPolicy must have killSwitchEnabled, and a Platform
whose Tenant sets soc2 must set it too.
type: boolean
type: object
datastores:
Expand Down Expand Up @@ -170,14 +175,31 @@ spec:
deletionPolicy:
default: Retain
description: |-
DeletionPolicy governs the underlying AWS resource when this datastore is
removed from spec or the Platform is deleted (T2).
Retain (default): the resource is orphaned, tagged
platform.nanohype.dev/owned-by and platform.nanohype.dev/released-at,
so a `kubectl delete platform` never takes the data with it.
Delete: the resource is torn down with the declaration.
Independent of the per-kind deletion_protection backstop, which defaults on
for relational and cache — two gates, both defaulting closed.
DeletionPolicy declares whether this datastore's AWS resource should
survive a teardown of the substrate that provisioned it.

It does NOT govern `kubectl delete platform`. The operator holds no delete
permission on any datastore, so deleting the CR orphans every store
regardless of this field — the isolation boundary is enforced by
permission, not by policy. This field reaches only the tenant-substrate
module's destroy path.

What it means is per-kind, because the same word cannot name the same
mechanism across services that offer different ones:
keyValue: Retain arms DynamoDB deletion protection, which refuses the
delete outright and leaves no cost behind. The clean case.
relational: Retain takes a final Aurora snapshot; Delete skips it. The
snapshot outlives the cluster and begins billing per GB-month once it
falls outside backupRetentionDays, so Retain here is durability with a
cost tail, not free protection. Aurora's own deletionProtection is a
separate and independent gate: Delete alone will not drop a protected
cluster, both must open.
objectStore, queue, cache, stream: no effect. S3 has no deletion
protection (force_destroy governs emptying a bucket, not deleting an
empty one), and SQS, ElastiCache and MSK offer no retain lever at all.
Cache is derived data by design and is deliberately unprotected.

The operator's substrate-wide teardown lever overrides this in every case.
enum:
- Retain
- Delete
Expand Down
15 changes: 10 additions & 5 deletions schemas/crd/platform.nanohype.dev_tenants.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,16 +79,21 @@ spec:
type: string
compliance:
description: |-
Compliance baseline applied to every Platform owned by this Tenant
unless the Platform itself sets a stricter value.
Compliance is the posture expected of every Platform this Tenant owns. A
Platform may declare more than its Tenant, never less: `cloudgov platform
audit` reports a Platform declaring less than its Tenant as a finding.
Nothing copies this value down — each Platform declares its own.
properties:
hipaa:
description: |-
HIPAA: object-lock compliance mode, no cross-region inference, PII detect
required on Guardrails.
HIPAA marks the Platform as handling PHI. One audited invariant: a
Platform whose Tenant sets hipaa must set it too.
type: boolean
soc2:
description: 'SOC2: invocation logging required, kill-switch enabled.'
description: |-
SOC2 marks the Platform as in SOC 2 audit scope. Two audited invariants:
the referenced BudgetPolicy must have killSwitchEnabled, and a Platform
whose Tenant sets soc2 must set it too.
type: boolean
type: object
contact:
Expand Down
6 changes: 3 additions & 3 deletions schemas/crd/source.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,17 +3,17 @@
"upstream": {
"repository": "nanohype/eks-agent-platform",
"path": "operators/config/crd/bases",
"ref": "e2d944831db73d596eb1bc8faa9547bf4aac9208"
"ref": "2f3f29c57f97925d0ec7771beda5ef94a3c7663c"
},
"generator": "controller-gen v0.21.0",
"files": [
{
"file": "platform.nanohype.dev_tenants.yaml",
"sha256": "09314d9c472917b3b20fe64e99bcd46d323b7684932fcdedbb923ff2f539fcbc"
"sha256": "f0c193e7b127368bbc1e77458d8e46a5bcbc8d35752c0d6ee45fa7bd58c4fd12"
},
{
"file": "platform.nanohype.dev_platforms.yaml",
"sha256": "9750f11ab6f1161dac4dd3883bd1971a88434ce9cffc4fd8232696c18b8e0377"
"sha256": "1e93097f112db6933b301685d38736014613d6a626244729c47f456677e1b991"
},
{
"file": "governance.nanohype.dev_budgetpolicies.yaml",
Expand Down
Loading