feat(deploy): add hardened Kubernetes reference deployment by seonghobae · Pull Request #79 · ContextualWisdomLab/Orgmetra

seonghobae · 2026-08-22T09:05:19Z

Scope

Adds an Orgmetra-only hardened Kubernetes reference for the People API. It is deployment intent, not a published image, live cluster change, release authorization, or cross-service database access.

Current exact-head evidence

PR head: 3f8a2826396aceb51fb78e14bf12dde713f99b0c
Base: develop@9e3e4847510e1e612b48474ba42b177b8ed824df
Local validation at this head: Kubernetes reference contract 8/8 passed; npm run validate passed foundation validation plus 55 Node tests; git diff --check passed.
Hosted Check snapshot for this exact head: 45 completed runs (37 success, 8 skipped), with no terminal failure. The dedicated deployment contract, OpenCode, Noema, Strix, SAST, dependency, security, recovery, and PostgreSQL checks are terminal GREEN where applicable.
Commit statuses for this exact head: Devin Review successful/completed and CodeRabbit successful with review rate limited.
PR is open and non-draft, reported mergeable, but GitHub reports mergeable_state=blocked.
No qualifying independent approval exists; all current review threads are resolved.

Assurance boundary

The reference uses restricted-intent pod settings, non-root execution, read-only root filesystem with /tmp scratch, separate health probes, bounded resources/disruption, default-deny networking, explicit probe-source and service flows, and immutable image-digest intent. The image remains a deliberate sentinel requiring operator replacement with a verified digest. Target-cluster admission/dry-run, registry/secret delivery, TLS/metrics/SLOs, migration/rollback/recovery, and final release authorization remain separate controls.

Ready-for-review and GREEN checks do not authorize merge. Keep this PR unmerged until qualifying independent approval and all live protected rules are satisfied; never self-approve, bypass protection, or reuse predecessor evidence.

coderabbitai · 2026-08-22T09:16:58Z

📝 Walkthrough

Walkthrough

Kubernetes People API 참조 배포 매니페스트, 보안·네트워크 계약 테스트, 운영 문서와 추적성 문서를 추가했습니다. 고정 커밋에서 이를 실행하는 GitHub Actions 품질 워크플로와 필수 파일·매니페스트 검증 항목도 추가했습니다.

Changes

Kubernetes 참조 배포

Layer / File(s)	Summary
참조 리소스 구성 `infrastructure/kubernetes/people-api-reference.json`	Restricted Pod Security 라벨이 있는 네임스페이스, 토큰 자동 마운트를 비활성화한 ServiceAccount, 2개 레플리카 Deployment, ClusterIP Service 및 PDB를 추가했습니다.
네트워크 격리 계약 `infrastructure/kubernetes/people-api-reference.json`, `infrastructure/kubernetes/README.md`, `tests/kubernetes-reference.test.mjs`	Ingress와 Egress 기본 거부 정책을 추가했습니다. People API 클라이언트, kubelet 프로브, PostgreSQL 및 kube-dns 트래픽의 허용 범위를 정의하고 검증합니다.
참조 계약 테스트 `tests/kubernetes-reference.test.mjs`	리소스 수, 보안 컨텍스트, `/tmp` 볼륨, 프로브, 리소스 제한, 롤링 업데이트, PDB 및 문서의 배포 조건을 검증합니다.
배포 운영 근거 `docs/doctoring/kubernetes-reference-deployment-references.md`, `docs/traceability/kubernetes-reference-deployment.md`, `infrastructure/kubernetes/README.md`	설계 근거, 요구사항 추적성, 이미지 다이제스트 교체 조건, 환경별 네트워크 조정, 서버 드라이런 및 릴리스 경계를 문서화합니다.
CI 품질 게이트 `.github/workflows/kubernetes-reference-quality.yml`, `scripts/foundation-contract-core.mjs`, `tests/validate_repository.py`, `manifest.json`	Kubernetes 관련 산출물을 필수 파일과 매니페스트에 등록합니다. 워크플로는 후보 SHA를 검증한 뒤 Node.js 24 테스트, 저장소 검증 및 작업 트리 상태 검사를 실행합니다.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: 🔵 Low · up to d4750

The deployment reference is otherwise mergeable, but its manifest and validation metadata identify the wrong source branch, which can weaken traceability and allow incorrect provenance information to pass checks. Update both values together before merging.

Sequence Diagram(s)

sequenceDiagram
  participant Workflow as GitHub Actions Workflow
  participant Git as Git Checkout
  participant Tests as Kubernetes Contract Tests
  participant Validator as Repository Validator

  Workflow->>Git: 후보 커밋의 고정 SHA 체크아웃
  Git-->>Workflow: 실제 HEAD SHA 반환
  Workflow->>Tests: Node.js 24에서 Kubernetes 참조 테스트 실행
  Tests-->>Workflow: 계약 테스트 결과 반환
  Workflow->>Validator: npm run validate 실행
  Validator-->>Workflow: 필수 파일 및 저장소 검증 결과 반환
  Workflow->>Git: diff 및 porcelain 상태 검사
  Git-->>Workflow: 깨끗한 작업 트리 상태 반환

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 3 files. (6 skipped: 6 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 People API를 위한 hardened Kubernetes reference deployment 추가라는 주요 변경 사항을 정확하고 간결하게 설명합니다.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 3 files. (6 skipped: 6 unsupported.)

Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/kubernetes-reference-deployment

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai · 2026-08-22T09:19:39Z

Caution

Review failed

An error occurred during the review process. Please try again later.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai · 2026-08-22T09:20:44Z

Caution

Review failed

An error occurred during the review process. Please try again later.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai · 2026-08-22T09:20:58Z

Caution

Review failed

An error occurred during the review process. Please try again later.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai · 2026-08-22T09:21:04Z

Caution

Review failed

An error occurred during the review process. Please try again later.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

seonghobae · 2026-08-24T17:16:57Z

@opencode-agent Please review the current unchanged head against protected develop. Local exact-head verification: all owned package suites pass at 100% statement/branch coverage.

…rity Add the quality workflow, README, manifest, doctoring, traceability and test files to both the Python and Node required-artifact sets and reseal manifest.json so their digests are validated by npm run validate. Complements the concurrent probe/scratch repair on this branch; resolves the remaining Devin observation on PR #79.

devin-ai-integration

Devin Review found 2 new potential issues.

generated_for_branch recorded a predecessor lane; the manifest and both validator expectations now name feat/kubernetes-reference-deployment so provenance metadata matches the live PR origin.

seonghobae added 6 commits August 22, 2026 02:04

test(deploy): define hardened Kubernetes reference contract

f68c85d

test(deploy): add exact-head Kubernetes reference quality gate

1877894

feat(deploy): implement hardened People API Kubernetes reference

d687825

docs(deploy): define fail-closed Kubernetes adaptation steps

8a7aa4d

docs(deploy): record Kubernetes primary-source evidence

1e127ec

docs(deploy): trace reference deployment assurance boundary

7879fb8

seonghobae marked this pull request as ready for review August 22, 2026 09:10

This comment was marked as resolved.

Sign in to view

fix(deploy): permit kubelet probes and provide tmp scratch volume

31b623a

This comment was marked as resolved.

Sign in to view

devin-ai-integration Bot reviewed Aug 25, 2026

View reviewed changes

Comment thread manifest.json

Comment thread infrastructure/kubernetes/people-api-reference.json

This comment was marked as resolved.

Sign in to view

fix(deploy): align manifest provenance with the active generation branch

3f8a282

generated_for_branch recorded a predecessor lane; the manifest and both validator expectations now name feat/kubernetes-reference-deployment so provenance metadata matches the live PR origin.

seonghobae mentioned this pull request Aug 29, 2026

docs: add product-technical gap baseline with current PR heads #100

Draft

Uh oh!

Conversation

seonghobae commented Aug 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Scope

Current exact-head evidence

Assurance boundary

Uh oh!

This comment was marked as resolved.

Uh oh!

coderabbitai Bot commented Aug 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot commented Aug 22, 2026

Review failed

Uh oh!

coderabbitai Bot commented Aug 22, 2026

Review failed

Uh oh!

coderabbitai Bot commented Aug 22, 2026

Review failed

Uh oh!

coderabbitai Bot commented Aug 22, 2026

Review failed

Uh oh!

seonghobae commented Aug 24, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

seonghobae commented Aug 22, 2026 •

edited

Loading

coderabbitai Bot commented Aug 22, 2026 •

edited

Loading