GitOps

1  Git Push
2       │
3       ▼
4  Webhook  (GitHub / GitLab)
5       │
6       ▼
7  FlowLink валидирует
8       │
9       ▼
10  PR комментарий с diff
11  ├── Риск-оценка
12  ├── Compliance проверка
13  └── Статус одобрения
14       │
15       ▼
16  Merge
17       │
18       ▼
19  Auto-apply к агентам

1flowlink-policies/
2├── policies/           # Политики Shield и Relay
3│   ├── shield/
4│   │   ├── prompt-injection.yaml
5│   │   └── pii-filter.yaml
6│   └── relay/
7│       ├── rate-limit.yaml
8│       └── content-filter.yaml
9├── config/             # Конфигурация агентов и сервисов
10│   ├── relay.yaml
11│   ├── shield.yaml
12│   └── alerts.yaml
13├── agents/             # Специфичные настройки агентов
14│   ├── agent-prod.yaml
15│   └── agent-staging.yaml
16└── secrets/            # Зашифрованные секреты (SOPS/GPG)
17    ├── api-keys.enc.yaml
18    └── tls-certs.enc.yaml

1# policies/shield/prompt-injection.yaml
2apiVersion: flowlink.ai/v1
3kind: ShieldPolicy
4metadata:
5  name: prompt-injection
6  version: "1.2.0"
7  description: "Блокировка prompt-injection атак"
8  author: security-team
9  created: "2026-01-15"
10
11spec:
12  mode: enforce          # enforce | monitor | dry-run
13  severity: critical
14  rules:
15    - id: injection-pattern-1
16      pattern: "ignore previous instructions"
17      action: block
18      confidence: 0.95
19    - id: injection-pattern-2
20      pattern: "you are now"
21      action: block
22      confidence: 0.90
23  response:
24    block_message: "Запрос заблокирован: обнаружена попытка prompt-injection"
25    log: true
26    alert: true

1# config/relay.yaml
2apiVersion: flowlink.ai/v1
3kind: RelayConfig
4metadata:
5  name: relay-prod
6spec:
7  listen: "0.0.0.0:8080"
8  tls:
9    enabled: true
10    cert_secret: "secrets/tls-certs.enc.yaml"
11  rate_limits:
12    requests_per_minute: 1000
13    burst: 50
14  backends:
15    - name: gpt4
16      endpoint: "https://api.openai.com/v1"
17      model: "gpt-4"
18      timeout: 30s
19
20---
21# config/shield.yaml
22apiVersion: flowlink.ai/v1
23kind: ShieldConfig
24metadata:
25  name: shield-prod
26spec:
27  default_mode: enforce
28  scan_body: true
29  max_request_size: "1MB"
30  policies:
31    - "policies/shield/prompt-injection.yaml"
32    - "policies/shield/pii-filter.yaml"
33
34---
35# config/alerts.yaml
36apiVersion: flowlink.ai/v1
37kind: AlertConfig
38metadata:
39  name: alerts-prod
40spec:
41  channels:
42    - type: slack
43      webhook_url_secret: "secrets/slack-webhook.enc.yaml"
44      severity: [critical, high]
45    - type: pagerduty
46      integration_key_secret: "secrets/pagerduty.enc.yaml"
47      severity: [critical]
48  rules:
49    - event: policy_violation
50      severity: high
51      threshold: 10
52      window: 5m

1# Настройка GitHub webhook
2gh api repos/${ORG}/${REPO}/hooks \
3  --input - <<'EOF'
4{
5  "name": "web",
6  "active": true,
7  "events": ["push", "pull_request"],
8  "config": {
9    "url": "https://flowlink.example.com/api/v1/gitops/webhook",
10    "content_type": "json",
11    "secret": "YOUR_WEBHOOK_SECRET"
12  }
13}
14EOF

1# Настройка GitLab webhook
2# Settings -> Webhooks -> Add new webhook
3# URL:        https://flowlink.example.com/api/v1/gitops/webhook
4# Secret:     YOUR_WEBHOOK_SECRET
5# Triggers:   Push events, Merge request events

1# config/gitops.yaml
2apiVersion: flowlink.ai/v1
3kind: GitOpsConfig
4metadata:
5  name: gitops
6spec:
7  apply_mode: auto          # auto | manual | staged
8
9  # Ручное одобрение
10  # apply_mode: manual
11  # Требует подтверждения через UI или API
12
13  # Поэтапное применение
14  # apply_mode: staged
15  # staged_rollout:
16  #   steps:
17  #     - agents: 10%
18  #       wait: 5m
19  #     - agents: 50%
20  #       wait: 10m
21  #     - agents: 100%
22
23  auto_rollback: true        # Автоматический откат при ошибках
24  rollback_timeout: 300s     # Таймаут перед откатом

1# Откат через git revert - FlowLink обнаружит и применит автоматически
2git revert HEAD
3git push origin main
4
5# Или ручной откат через API
6curl -X POST https://flowlink.example.com/api/v1/gitops/rollback \
7  -H "Authorization: Bearer $TOKEN" \
8  -d '{"version": "1.1.0", "reason": "rollback due to false positives"}'

1# Пример: проверка статуса
2curl -s https://flowlink.example.com/api/v1/gitops/status \
3  -H "Authorization: Bearer $TOKEN" | jq .
4
5# Пример: история применений
6curl -s "https://flowlink.example.com/api/v1/gitops/history?limit=10" \
7  -H "Authorization: Bearer $TOKEN" | jq .