Jon Chery
51c3edf458
SSM path /acdl/{env}/{contractId}/{output} → /nova/... across
core/output_publisher + contract resolver + consumer docs. New
scripts/migrate_ssm_paths.py (copy/verify/delete, dry-run default).
AWS tag keys acdl:owner|environment|contract|cost-center|ref → nova:*
across terraform tagging + ABAC session policies (iam:ResourceTag/acdl:*
→ iam:ResourceTag/nova:*). nova_tagging.py hard mode (D-109 warn→hard).
tagging-standard.json tag-key values → nova:*. New
scripts/untag_acdl_keys.py (remove old acdl:* tags, dry-run default).
Test fixtures updated; pytest + run_ci.sh PASS.
---ci---
project: acdl
phase: 3
milestone: v1.15
status: execute
---/ci---
40 lines
1.0 KiB
JSON
40 lines
1.0 KiB
JSON
{
|
|
"apiVersion": "wgpolicyk8s.io/v1alpha1",
|
|
"kind": "PolicyReport",
|
|
"metadata": {
|
|
"name": "acdl-policy-report",
|
|
"namespace": "default"
|
|
},
|
|
"results": [
|
|
{
|
|
"policy": "disallow-privileged-containers",
|
|
"severity": "high",
|
|
"result": "pass",
|
|
"message": "Pod spec is compliant (no privileged container).",
|
|
"resource": "default/Pod/acdl-app",
|
|
"namespace": "default",
|
|
"kind": "Pod",
|
|
"name": "acdl-app"
|
|
},
|
|
{
|
|
"policy": "require-resource-labels",
|
|
"severity": "medium",
|
|
"result": "fail",
|
|
"message": "Pod missing required label nova:owner.",
|
|
"resource": "default/Pod/acdl-bad-app",
|
|
"namespace": "default",
|
|
"kind": "Pod",
|
|
"name": "acdl-bad-app"
|
|
},
|
|
{
|
|
"policy": "require-image-digests",
|
|
"severity": "high",
|
|
"result": "warn",
|
|
"message": "Container image uses a mutable tag; consider pinning to a digest.",
|
|
"resource": "default/Pod/acdl-app",
|
|
"namespace": "default",
|
|
"kind": "Pod",
|
|
"name": "acdl-app"
|
|
}
|
|
]
|
|
} |