Repository navigation
feat(examples): add OpenShift agent security evaluation - #84
Draft
kevincogan wants to merge 15 commits into
Draft
kevincogan wants to merge 15 commits into
kevincogan wants to merge 15 commits into
Conversation
Add OpenShift deployment templates, locked build inputs and the OpenShell patches for certificate-bound delegation. Signed-off-by: Kevin Cogan <kevin.s.cogan@gmail.com>
Add identity and authorization enforcement, exact-action approval, credential mediation, warm-pool preparation and browser/CLI workflows. Keep required runtime helpers and their regression tests together. Signed-off-by: Kevin Cogan <kevin.s.cogan@gmail.com>
Add customer setup and operations guides, configuration checks, offline test entry points and the complete source hash inventory. Signed-off-by: Kevin Cogan <kevin.s.cogan@gmail.com>
Introduce the example from the project overview and distinguish its OpenShift prerequisites from the single-server deployment. Signed-off-by: Kevin Cogan <kevin.s.cogan@gmail.com>
Separate reusable connector contracts from Jira request and result rules. Bind persisted runs and exact approvals to the reviewed connector while retaining legacy Jira history. Introduce fingerprinted execution profiles and atomic run allocation. Share compatible Triage capacity while preserving single-use identities, original deadlines, workload permissions and the managed-context limit. Signed-off-by: Kevin Cogan <kevin.s.cogan@gmail.com>
Add owned cluster build helpers, pinned Linux installer tools and an immutable installer image built from the reviewed source bundle. Keep native compilation offline and verify the packaged binary and tool versions. Record build ownership, private checkpoints and publication digests. Support approved pinned builder mirrors without copying workstation credentials into build Pods. Signed-off-by: Kevin Cogan <kevin.s.cogan@gmail.com>
Add a thin oc launcher around the existing guarded setup helpers. Use one versioned configuration and separate administrator, build and application handoffs with rotating ServiceAccount tokens and durable leases. Verify exact prerequisite receipts, admission boundaries and rollout readiness before activation. Stop uncertain stages without replay, support installations without fixture seeds, and retire installer-only grants including gateway access. Signed-off-by: Kevin Cogan <kevin.s.cogan@gmail.com>
Verify trust propagation, replacement certificate loading and worker readiness through guarded idle maintenance. Keep TLS and scope checks strict and report network-isolation limits accurately. Bind disposable scratch to its original pool reservation and verify exact PVC absence during retirement and reconciliation. Preserve audit history, consumed identities, quarantine and uncertain-write stops. Signed-off-by: Kevin Cogan <kevin.s.cogan@gmail.com>
Keep README, Setup and Operations as the customer path, with six installation stages and concise task-based instructions. Move detailed administrator, connector-onboarding and recovery procedures into the optional reference. Record verified workflows, profile pooling, renewal, migration and cleanup outcomes with their acceptance limits and external release gates. Refresh the complete source inventory for the reviewed code and documentation. Signed-off-by: Kevin Cogan <kevin.s.cogan@gmail.com>
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true |
kevincogan
marked this pull request as draft
October 25, 2026 15:25
kevincogan
marked this pull request as ready for review
October 27, 2026 10:39
Preserve upstream documentation updates and resolve the README conflict. Describe the OpenShift agent-security evaluation alongside the example workflows, with its own prerequisites and setup instructions. Signed-off-by: Kevin Cogan <kevin.s.cogan@gmail.com>
kevincogan
marked this pull request as draft
October 29, 2026 16:28
Signed-off-by: Kevin Cogan <kevin.s.cogan@gmail.com>
…nt reuse Signed-off-by: Kevin Cogan <kevin.s.cogan@gmail.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add a self-contained OpenShift example demonstrating how authenticated users and attested agents can perform enterprise actions under enforced permissions, exact-action approval and correlated audit.
This complements the existing single-server examples with an alternative deployment and separate prerequisites. CVE triage, Incident triage and Remediation change requests demonstrate the controls using synthetic data and Jira.
What’s included
oclauncher and pinned cluster builds.Implementation, configuration, tests and documentation are contained in
examples/openshift-agent-security/. The only change outside that directory is a short root README link. Existing harnesses and CI workflows are unchanged.Validation
Evaluation boundary
This is a connected synthetic evaluation, not production certification or disconnected delivery. CVE assessment uses frozen input; Incident and Remediation use actual model inference.
Pinned OpenShell evaluation patches are included for review. Independent installation acceptance, native/vendor support, artifact distribution rights and security/licensing approvals remain explicit gates. Final-installer qualification used reviewed checkpoint recovery; an unassisted walkthrough remains outstanding.
Hosted CI results should be reviewed separately.