feat(k8s): generate NetworkPolicies and per-module ServiceAccounts (#75)

CHANGELOG.md

@@ -8,6 +8,34 @@ The format is based on Keep a Changelog.
 
 ### Added
 
+- **Breaking (for existing `--target helm` deployments):** Added
+  NetworkPolicy and ServiceAccount generation to the `helm` render target,
+  completing the Kubernetes production resources (issue #75): every
+  module's chart now ships a default-deny NetworkPolicy whose allow
+  rules are derived from the plan's contract bindings (consumer-to-
+  provider egress and matching provider ingress on the contract port,
+  same-module traffic, and cluster DNS egress; NodePort/LoadBalancer
+  services open ingress on exactly their exposed ports), and every
+  workload runs under a dedicated per-module ServiceAccount with opt-in
+  least-privilege RBAC via the new
+  `implementation.kubernetes.serviceAccount.rbac` rules — no rules means
+  no Role, no RoleBinding, and no mounted API token (malformed rules fail
+  closed with E148). Custom allow rules for destinations no binding can
+  name — an external API or database a job reads from, a cross-namespace
+  ingress controller — are opt-in via
+  `implementation.kubernetes.networkPolicy.ingress`/`egress`, rendered
+  verbatim after the binding-derived rules (malformed shapes fail closed
+  with E149), and the contract's Service-facing port is mapped through the
+  provider's Service `targetPort` so a port remap cannot silently break a
+  rule. Extended the Kubernetes security scan with CDS-K8S-006 (wildcard
+  RBAC grants), CDS-K8S-007 (NodePort/LoadBalancer ingress exposure), and
+  CDS-K8S-008 (external-egress passthrough rules), and added a W128
+  warning when a binding carries no port evidence and its egress rule
+  cannot be port-scoped; documented the network-isolation baseline in
+  `docs/kubernetes.md`. Charts rendered before this change will deny
+  external and cross-namespace traffic on their next render until the new
+  `networkPolicy` rules are declared (see the "When the baseline denies
+  something you need" section of `docs/kubernetes.md`).
 - Added a `Kubernetes E2E` GitHub Actions workflow that runs the existing
   k3d harness (`make k3d-build` and `make k3d-e2e`) against the example
   profile on pull requests and pushes touching the chart, CLI, images, harness

README.md

@@ -795,6 +795,9 @@ Common errors from `cds validate`, `cds plan`, and `cds render`, and how to fix
 | `[E137] ... accepts unauthenticated clients` | A production profile runs a `cache-service` provider that does not advertise `authentication: required` (no password credential configured). | Supply a cache password through a `secrets.<alias>` reference (e.g. keydb `config.passwordFrom`), declared `required: true` in `spec.secrets.values`. |
 | `[E138] ... Credential field ... must reference a secret alias` / `... is empty` / `... uses a ${CDS_*} profile input` / `... contains a plaintext value` | A credential-named config field of a production database/cache provider is not a `secrets.<alias>` reference, or its alias is not declared `required: true` (issue #206). | Supply the credential through a secret reference declared `required: true` so a missing value fails closed at startup. |
 | `[W105] ... legacy md5 host authentication` | A production `sql-database` provider advertises `md5`, which validates but is a deprecated password method. | Prefer `scram-sha-256` for production profiles. |
+| `[E148] ... RBAC rule ... must be a mapping with non-empty "apiGroups", "resources", and "verbs" lists` / `... The "serviceAccount" block ... must be a mapping ...` | A module's `implementation.kubernetes.serviceAccount` block (or one of its `rbac` rules) is malformed -- a plan loaded from a file bypasses the module schema, so the Helm renderer fails closed instead of shipping a broken Role (#75). | Fix the `serviceAccount`/`rbac` shape in the module (or the saved plan). |
+| `[E149] ... The "networkPolicy"/... block ... must be a mapping with optional "ingress"/"egress" lists ...` | A module's custom NetworkPolicy allow rules are malformed (plan-file bypass of the module schema) (#75). | Fix the `networkPolicy` shape; each rule must be a mapping. |
+| `[W128] ... carries no numeric port and provider module ... advertises no service ports ...` | A contract binding carries no port evidence, so its generated NetworkPolicy egress rule allows all ports to the provider (#75). | Declare the port in the contract so the rule stays port-scoped. |
 | `[W097] ... config.image.tag is "latest" with config.image.source "registry"` | `config.image.tag: latest` under `source: registry` still validates, but drifts silently between deploys instead of pinning a reproducible version. | Pin an explicit tag from `publish-images.yml`'s output (or `tests/fixtures/signed-images.json`) instead of `latest`. |
 | `[E127] ... Unknown confinement key ...` / `... must be 'default', 'unconfined' or 'file:<path>' ...` / `... Invalid SELinux label(s) ...` | A `security.runtime.confinement` block (or a module instance's confinement) is malformed: an unsupported key, an invalid `seccomp`/`apparmor`/`selinux` value, or a `file:` seccomp profile path that is missing or resolves outside the profile directory. | Use `seccomp: default`/`unconfined`/`file:<relative path inside the profile directory>`, `apparmor: runtime/default`/`unconfined`/`<host profile name>`, and `selinux: disable` or a `label: value` list; see `docs/runtime-confinement.md`. |
 | `[W071] ... has kind "docker-compose" but no "compose" definition` | A module implementation declares the `docker-compose` kind without an `implementation.compose` block, so the renderer skips the module. | Add the `implementation.compose` block (services, volumes) to the module's `module.yaml`, or set a supported implementation `kind`. |