Repository navigation
docs: the installation is cluster-wide, and there is no narrower mode (ADR 0055) - #90
Merged
Merged
Conversation
… (ADR 0055)
`security.md` has offered a namespace-scoped installation since the first commit
that created the file. No ADR decided it, nothing was built behind it, and
ADR 0032 then twice asserted that the mode "remains available", giving
speculative prose the standing of a decision.
The description was also false in the direction that matters. It promised
"requests-vs-usage findings for the permitted namespaces only"; the agent reads
every kubelet through `get nodes/proxy`, which is cluster-scoped, so without a
ClusterRole there is no usage collection at all. What the document called a mode
of this product is a different and much weaker one.
The section is replaced by a statement of the single installation shape and its
reason. ADR 0032's body is immutable, so its two sentences stand as written and
ADR 0055 is their forwarding address.
No code, no chart, no RBAC change.
go test ./... && make lint # green
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011YRKuL97KRndaopfpixrhp
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
security.mdhas offered a "namespace-scoped [planned]" installation — Roleand RoleBinding in listed namespaces, no ClusterRole — since the first commit
that created the file (
d8943a3). No ADR ever decided it. Nothing was everbuilt behind it. ADR 0032 then twice asserted the mode "remains available", which
gave a sentence of speculative prose the standing of a decision.
The description was also false, in the direction that matters. It said the
mode "reports requests-vs-usage findings for the permitted namespaces only". The
agent reads every kubelet through
get nodes/proxy, which is cluster-scoped, sowithout a ClusterRole there is no usage collection at all — not reduced,
absent. What the document described as a mode of this product is a different and
much weaker product, offered to a reader who would find out after installing it.
Why filters are the answer and not a fallback. The argument for API-server
enforcement is that the customer need not trust the agent's own filtering. That
does not survive contact with the rest of the product: the same customer is
already trusting agent-side filtering for the symbol allow-list that governs what
leaves a profile, for the drop of
env/args/commandbefore the informercache, and for the redaction in every node report — and under the
inventoryandebpfprofiles the agent runs withhostPIDandCAP_SYS_PTRACE, which nonamespace-scoped RBAC bounds. The boundary would look like a guarantee exactly
where it is not one.
Since ADR 0054 the four controls are also checkable from what the backend
receives rather than only from what was configured, which is the property the
unbuilt mode was supposed to supply.
ADR 0032's body is immutable, so its two sentences stand as written and ADR 0055
is their forwarding address (
Amended by: 0055). The only remaining occurrencesof the phrase in the repository are those two and the ADR that voids them.
No code, no chart, no RBAC change. One fewer
[planned]marker;security.mdloses 8 lines.
🤖 Generated with Claude Code
https://claude.ai/code/session_011YRKuL97KRndaopfpixrhp