test(ql3): prove Kubernetes secret binding projection

scripts/ql3-plugin-package-secret-binding-kubernetes-live-audit.cjs

@@ -0,0 +1,259 @@
+#!/usr/bin/env node
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const FIXTURE = 'qinglong/plugin-package-secret-binding-kubernetes-live@v1';
+const SHA256 = /^sha256:[a-f0-9]{64}$/;
+const FORBIDDEN_KEY =
+  /(secretRef|secretValue|material|assertion|jwt|password|dsn|privateKey|certificate|kubeconfig|podUid|nodeUid|podName|nodeName)/i;
+const REQUIRED_GATES = Object.freeze([
+  'realThreeNodeKubernetes',
+  'twoManagementReplicasOnDistinctNodes',
+  'formalHttpsClientCommands',
+  'planReplayedAcrossReplicas',
+  'separationOfDutyDecision',
+  'authorizedInspection',
+  'realExecutorJob',
+  'projectedSecretMetadataAccepted',
+  'bindingPublishedExactlyOnce',
+  'managementCannotReadSecrets',
+  'managementDoesNotMountPackageValues',
+  'executorCannotReadSecrets',
+  'executorHasNoServiceAccountToken',
+  'executorProjectionReadOnly',
+  'databaseContainsNoSensitiveValue',
+  'passed',
+]);
+
+function exact(value, keys) {
+  return Boolean(
+    value &&
+      typeof value === 'object' &&
+      !Array.isArray(value) &&
+      JSON.stringify(Object.keys(value).sort()) ===
+        JSON.stringify([...keys].sort()),
+  );
+}
+
+function scan(value, findings, location = 'report') {
+  if (Array.isArray(value)) {
+    value.forEach((entry, index) =>
+      scan(entry, findings, `${location}[${index}]`),
+    );
+    return;
+  }
+  if (!value || typeof value !== 'object') return;
+  for (const [key, entry] of Object.entries(value)) {
+    if (FORBIDDEN_KEY.test(key))
+      findings.push(`${location}.${key} is forbidden`);
+    if (
+      typeof entry === 'string' &&
+      /(qlsecret:v1:|-----BEGIN |postgres(?:ql)?:\/\/|eyJ[A-Za-z0-9_-]+\.)/.test(
+        entry,
+      )
+    ) {
+      findings.push(`${location}.${key} contains sensitive material`);
+    }
+    scan(entry, findings, `${location}.${key}`);
+  }
+}
+
+function validatePluginPackageSecretBindingKubernetesLiveReport(report) {
+  const findings = [];
+  if (
+    !exact(report, [
+      'schemaVersion',
+      'fixture',
+      'observedAtMs',
+      'platform',
+      'management',
+      'review',
+      'executor',
+      'persistence',
+      'gates',
+      'limitations',
+    ]) ||
+    report.schemaVersion !== 1 ||
+    report.fixture !== FIXTURE ||
+    !Number.isSafeInteger(report.observedAtMs) ||
+    report.observedAtMs < 1
+  ) {
+    findings.push('report envelope is invalid');
+  }
+  if (
+    !exact(report.platform, [
+      'architecture',
+      'kubernetesVersion',
+      'nodeCount',
+      'postgresVersionNumber',
+      'adminImageId',
+    ]) ||
+    !['amd64', 'arm64'].includes(report.platform?.architecture) ||
+    typeof report.platform?.kubernetesVersion !== 'string' ||
+    report.platform?.nodeCount !== 3 ||
+    report.platform?.postgresVersionNumber !== 180004 ||
+    !SHA256.test(report.platform?.adminImageId ?? '')
+  ) {
+    findings.push('platform evidence is invalid');
+  }
+  if (
+    !exact(report.management, [
+      'replicas',
+      'distinctNodeHashes',
+      'serviceAccountTokenMounted',
+      'packageValueVolumeMounted',
+      'canGetSecrets',
+      'canListSecrets',
+    ]) ||
+    report.management?.replicas !== 2 ||
+    !Array.isArray(report.management?.distinctNodeHashes) ||
+    report.management.distinctNodeHashes.length !== 2 ||
+    new Set(report.management.distinctNodeHashes).size !== 2 ||
+    !report.management.distinctNodeHashes.every((value) =>
+      SHA256.test(value),
+    ) ||
+    report.management.serviceAccountTokenMounted !== false ||
+    report.management.packageValueVolumeMounted !== false ||
+    report.management.canGetSecrets !== false ||
+    report.management.canListSecrets !== false
+  ) {
+    findings.push('management isolation evidence is invalid');
+  }
+  if (
+    !exact(report.review, [
+      'commands',
+      'requesterSubjectHash',
+      'reviewerSubjectHash',
+      'distinctUsers',
+      'planStatus',
+      'replayStatus',
+      'decisionStatus',
+      'inspectionStale',
+      'actionDigest',
+      'planDigest',
+    ]) ||
+    JSON.stringify(report.review?.commands) !==
+      JSON.stringify([
+        'plugin-package.secret-binding.plan',
+        'plugin-package.secret-binding.plan',
+        'plugin-package.secret-binding.propose',
+        'plugin-package.secret-binding.decide',
+        'plugin-package.secret-binding.inspect',
+      ]) ||
+    !SHA256.test(report.review?.requesterSubjectHash ?? '') ||
+    !SHA256.test(report.review?.reviewerSubjectHash ?? '') ||
+    report.review?.requesterSubjectHash ===
+      report.review?.reviewerSubjectHash ||
+    report.review?.distinctUsers !== true ||
+    report.review?.planStatus !== 'created' ||
+    report.review?.replayStatus !== 'existing' ||
+    report.review?.decisionStatus !== 'decided' ||
+    report.review?.inspectionStale !== false ||
+    !SHA256.test(`sha256:${report.review?.actionDigest ?? ''}`) ||
+    !SHA256.test(`sha256:${report.review?.planDigest ?? ''}`)
+  ) {
+    findings.push('review ceremony evidence is invalid');
+  }
+  if (
+    !exact(report.executor, [
+      'jobSucceeded',
+      'serviceAccountTokenMounted',
+      'canGetSecrets',
+      'canListSecrets',
+      'projectionReadOnly',
+      'projectionFileCount',
+      'projectionKeyHash',
+      'outputSensitiveFree',
+    ]) ||
+    report.executor?.jobSucceeded !== true ||
+    report.executor?.serviceAccountTokenMounted !== false ||
+    report.executor?.canGetSecrets !== false ||
+    report.executor?.canListSecrets !== false ||
+    report.executor?.projectionReadOnly !== true ||
+    report.executor?.projectionFileCount !== 1 ||
+    !SHA256.test(report.executor?.projectionKeyHash ?? '') ||
+    report.executor?.outputSensitiveFree !== true
+  ) {
+    findings.push('executor projection evidence is invalid');
+  }
+  if (
+    !exact(report.persistence, [
+      'bindingCount',
+      'authorityKind',
+      'evidenceDigest',
+      'entryCount',
+      'approvalConsumed',
+      'executionSucceeded',
+      'sensitiveMatchCount',
+    ]) ||
+    report.persistence?.bindingCount !== 1 ||
+    report.persistence?.authorityKind !== 'approved-action-execution' ||
+    !SHA256.test(`sha256:${report.persistence?.evidenceDigest ?? ''}`) ||
+    report.persistence?.entryCount !== 1 ||
+    report.persistence?.approvalConsumed !== true ||
+    report.persistence?.executionSucceeded !== true ||
+    report.persistence?.sensitiveMatchCount !== 0
+  ) {
+    findings.push('durable binding evidence is invalid');
+  }
+  if (
+    !exact(report.gates, REQUIRED_GATES) ||
+    REQUIRED_GATES.some((gate) => report.gates?.[gate] !== true)
+  ) {
+    findings.push('one or more required gates are false or missing');
+  }
+  if (
+    !Array.isArray(report.limitations) ||
+    report.limitations.length !== 2 ||
+    report.limitations.some(
+      (value) =>
+        typeof value !== 'string' || value.length < 16 || value.length > 512,
+    )
+  ) {
+    findings.push('limitations are invalid');
+  }
+  scan(report, findings);
+  return Object.freeze({
+    schemaVersion: 1,
+    fixture: FIXTURE,
+    findings: Object.freeze(findings),
+    compatible: findings.length === 0,
+  });
+}
+
+function main(argv) {
+  if (argv.length !== 1 || !argv[0].startsWith('--report=/')) {
+    throw new Error(
+      'usage: ql3-plugin-package-secret-binding-kubernetes-live-audit --report=/absolute/report.json',
+    );
+  }
+  const reportPath = argv[0].slice('--report='.length);
+  if (path.resolve(reportPath) !== reportPath)
+    throw new Error('report path is invalid');
+  const report = JSON.parse(fs.readFileSync(reportPath, 'utf8'));
+  const result = validatePluginPackageSecretBindingKubernetesLiveReport(report);
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+  if (!result.compatible) process.exitCode = 1;
+}
+
+if (require.main === module) {
+  try {
+    main(process.argv.slice(2));
+  } catch (error) {
+    process.stderr.write(
+      `QL3 Secret binding Kubernetes live audit failed: ${
+        error instanceof Error ? error.message : String(error)
+      }\n`,
+    );
+    process.exitCode = 1;
+  }
+}
+
+module.exports = {
+  FIXTURE,
+  REQUIRED_GATES,
+  validatePluginPackageSecretBindingKubernetesLiveReport,
+};