Cloud-native und Kubernetes

# Illustrative reference example: the inference workloads can reach the model# endpoint, the domain's proposal intake and DNS, and nothing else. The records# database sits in the same namespace as the intake, and no rule here opens a# route to it: selecting the intake pods and port is what keeps it closed.# Enforced only by a network plugin that implements NetworkPolicy, and only as an# addition: the application boundary is still required, and this replaces none of it.apiVersion: networking.k8s.io/v1kind: NetworkPolicymetadata:  name: inference-egress  namespace: inferencespec:  podSelector: {}  # every pod in this namespace  policyTypes:    - Egress  egress:    - to:        - namespaceSelector:            matchLabels:              kubernetes.io/metadata.name: model-serving      ports:        - protocol: TCP          port: 8080    - to:        - namespaceSelector:            matchLabels:              kubernetes.io/metadata.name: records          podSelector:  # same list item: this namespace AND these pods            matchLabels:              app: proposal-intake      ports:        - protocol: TCP          port: 8443    - to:        - namespaceSelector:            matchLabels:              kubernetes.io/metadata.name: kube-system          podSelector:            matchLabels:              k8s-app: kube-dns      ports:        - protocol: UDP          port: 53        - protocol: TCP          port: 53

# Illustrative reference example: a Deployment is admitted only if every image# reference ends in a well-formed sha256 digest and the object names, in a# non-empty annotation, the configuration revision it was rendered from.# Admission sees API objects; it never sees application data.apiVersion: admissionregistration.k8s.io/v1kind: ValidatingAdmissionPolicymetadata:  name: deployments-declare-provenancespec:  failurePolicy: Fail  matchConstraints:    resourceRules:      - apiGroups: ["apps"]        apiVersions: ["v1"]        operations: ["CREATE", "UPDATE"]        resources: ["deployments"]  validations:    - expression: >-        object.spec.template.spec.containers.all(c,          c.image.matches('^[^@]+@sha256:[0-9a-f]{64}$')) &&        (!has(object.spec.template.spec.initContainers) ||          object.spec.template.spec.initContainers.all(c,            c.image.matches('^[^@]+@sha256:[0-9a-f]{64}$')))      message: "every container image must end in a sha256 digest of 64 hex characters"    - expression: >-        has(object.metadata.annotations) &&        'refapp.example/config-revision' in object.metadata.annotations &&        object.metadata.annotations['refapp.example/config-revision'].matches('^[A-Za-z0-9._-]+$')      message: "the Deployment must name, in a non-empty annotation, the configuration revision it was rendered from"---apiVersion: admissionregistration.k8s.io/v1kind: ValidatingAdmissionPolicyBindingmetadata:  name: deployments-declare-provenancespec:  policyName: deployments-declare-provenance  validationActions: ["Deny"]  matchResources:    namespaceSelector:      matchLabels:        refapp.example/provenance-required: "true"

# Illustrative reference example: configuration provenance you can read off a# running pod. The revision is in the object, in the pod template and in the# name of the immutable ConfigMap, so a new revision is a new rollout and no# pod runs a configuration it cannot name.apiVersion: v1kind: ConfigMapmetadata:  name: prompt-templates-3f9c2d1  namespace: inferenceimmutable: truedata:  service-report.txt: |    Read the service report and propose next_service_due and component_class.---apiVersion: apps/v1kind: Deploymentmetadata:  name: report-extraction  namespace: inference  annotations:    refapp.example/config-revision: "3f9c2d1"spec:  replicas: 2  selector:    matchLabels:      app: report-extraction  template:    metadata:      labels:        app: report-extraction      annotations:        refapp.example/config-revision: "3f9c2d1"    spec:      automountServiceAccountToken: false      containers:        - name: worker          image: registry.example/refapp/extraction@sha256:3f9c2d1e3f9c2d1e3f9c2d1e3f9c2d1e3f9c2d1e3f9c2d1e3f9c2d1e3f9c2d1e          env:            - name: OTEL_SERVICE_NAME              value: report-extraction            - name: OTEL_RESOURCE_ATTRIBUTES              value: service.version=3f9c2d1          volumeMounts:            - name: prompts              mountPath: /etc/refapp/prompts              readOnly: true      volumes:        - name: prompts          configMap:            name: prompt-templates-3f9c2d1

# Illustrative reference example: an OpenTelemetry Collector pipeline for# traces. Sampling is legitimate here, and it is exactly why this pipeline is# not the audit trail: audit entries are written to their own append-only# store by the application, and never pass through this configuration.receivers:  otlp:    protocols:      grpc: {}      http: {} processors:  memory_limiter:    check_interval: 1s    limit_percentage: ${env:MEMORY_LIMIT_PERCENTAGE}  probabilistic_sampler:    sampling_percentage: ${env:TRACE_SAMPLE_PERCENTAGE}  batch: {} exporters:  otlp:    endpoint: tracing-backend.observability:4317 service:  pipelines:    traces:      receivers: [otlp]      processors: [memory_limiter, probabilistic_sampler, batch]      exporters: [otlp]

# Illustrative reference example: fences that stop a release, and one summary# check that cannot turn green by being skipped. Making it a REQUIRED check is a# repository setting (branch protection or a ruleset), not part of this file.name: releaseon:  pull_request:  push:    branches: [main] jobs:  architecture:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v7      - uses: actions/setup-python@v7        with:          python-version: "3.12"      - run: pip install -r requirements.txt      - run: lint-imports   tests:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v7      - uses: actions/setup-python@v7        with:          python-version: "3.12"      - run: pip install -r requirements.txt      - run: pytest -q   publication:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v7      - run: make site  # writes the public build to build/      - name: Fence the built output        env:          PATTERNS: ${{ secrets.PUBLICATION_PATTERNS }}        run: |          printf '%s\n' "$PATTERNS" > "$RUNNER_TEMP/patterns.txt"          python -m refapp.fence build/ "$RUNNER_TEMP/patterns.txt"   # The one job branch protection requires. A skipped job reports success,  # so this job runs whatever happened above and fails unless all passed.  fences:    if: ${{ always() }}    needs: [architecture, tests, publication]    runs-on: ubuntu-latest    steps:      - if: >-          contains(needs.*.result, 'failure') ||          contains(needs.*.result, 'cancelled') ||          contains(needs.*.result, 'skipped')        run: exit 1   release:    if: github.event_name == 'push'    needs: fences  # never `if: always()` here: that would release after a failed fence    runs-on: ubuntu-latest    environment: production    steps:      - run: echo "promote the artifact built from ${{ github.sha }}"