Kubernetes Operator

Архитектура

FlowLinkShieldPolicy (CRD) → ShieldOperator → reconciliation loop
                                      ↓
AdmissionWebhook (mutating + validating)
  ├── ValidatingWebhook → deny violations
  └── MutatingWebhook  → inject ShieldSidecar
                              ↓
                     ShieldSidecar (container)
                     connects to FlowLink Relay

CRD: FlowLinkShieldPolicy

apiVersion: shield.flowlink.ai/v1alpha1
kind: FlowLinkShieldPolicy
metadata:
  name: production-shield
  namespace: default
spec:
  mode: enforce          # monitor | enforce
  enabled: true
  rules:
    - name: block-destructive
      action: deny
      patterns:
        - "rm -rf *"
        - "DROP TABLE"
        - "chmod 777"
    - name: require-approval
      action: approval
      patterns:
        - "kubectl delete"
        - "helm uninstall"
  sidecar_image: "flowlink/flowlink-shield:latest"
  relay_url: "https://flowlink.flow-masters.ru"
  watch_namespaces: ["default", "production"]

Деплой

# 1. Apply CRD
kubectl apply -f config/crd.yaml

# 2. Create policy
kubectl apply -f config/policy.yaml

# 3. Build operator
cargo build --release -p flowlink-k8s

# 4. Run operator (connects to relay)
./flowlink-k8s --relay-url https://flowlink.flow-masters.ru/api/v1

# Or via Helm (coming soon)
helm install flowlink-operator ./charts/flowlink-operator \
  --set relay.url=https://flowlink.flow-masters.ru

Компоненты

Статус