mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
70 lines
1.9 KiB
Markdown
70 lines
1.9 KiB
Markdown
# Network Policy Design Template
|
|
|
|
## Application Traffic Flow Matrix
|
|
|
|
| Source | Destination | Port | Protocol | Justification |
|
|
|--------|-------------|------|----------|---------------|
|
|
| frontend | backend-api | 8080 | TCP | REST API calls |
|
|
| backend-api | postgres-db | 5432 | TCP | Database queries |
|
|
| backend-api | redis-cache | 6379 | TCP | Session caching |
|
|
| all pods | kube-dns | 53 | UDP/TCP | DNS resolution |
|
|
| ingress-nginx | frontend | 80 | TCP | External traffic |
|
|
| prometheus | all pods | 9090 | TCP | Metrics scraping |
|
|
|
|
## Namespace Policy Checklist
|
|
|
|
### Per Namespace
|
|
- [ ] Default deny ingress applied
|
|
- [ ] Default deny egress applied
|
|
- [ ] DNS egress allowed
|
|
- [ ] Required ingress rules created per traffic flow
|
|
- [ ] Required egress rules created per traffic flow
|
|
- [ ] Cross-namespace policies documented
|
|
- [ ] Policies tested with connectivity checks
|
|
|
|
### Cluster-Wide (GlobalNetworkPolicy)
|
|
- [ ] Block external access to non-ingress namespaces
|
|
- [ ] Allow monitoring namespace to scrape metrics
|
|
- [ ] Allow kube-system health checks
|
|
- [ ] Emergency isolation policy prepared
|
|
|
|
## Policy Naming Convention
|
|
|
|
```
|
|
{action}-{source}-to-{destination}-{port}
|
|
```
|
|
|
|
Examples:
|
|
- `allow-frontend-to-backend-8080`
|
|
- `deny-external-to-database-5432`
|
|
- `allow-monitoring-to-all-9090`
|
|
|
|
## Emergency Isolation Policy
|
|
|
|
```yaml
|
|
# Apply this to immediately isolate a compromised namespace
|
|
apiVersion: projectcalico.org/v3
|
|
kind: GlobalNetworkPolicy
|
|
metadata:
|
|
name: emergency-isolate-NAMESPACE
|
|
spec:
|
|
order: 1
|
|
selector: "projectcalico.org/namespace == 'NAMESPACE'"
|
|
types:
|
|
- Ingress
|
|
- Egress
|
|
ingress:
|
|
- action: Deny
|
|
egress:
|
|
- action: Deny
|
|
```
|
|
|
|
## Review Schedule
|
|
|
|
| Review Type | Frequency | Owner |
|
|
|-------------|-----------|-------|
|
|
| Policy audit | Monthly | Security Team |
|
|
| Traffic flow validation | After each deployment | DevOps |
|
|
| Compliance check | Quarterly | GRC Team |
|
|
| Emergency drill | Semi-annually | Security + SRE |
|