|
|
ece81f651c
|
feat: full kubeclaw operator — CRDs, controllers, deploy manifests, Helm chart
- 7 CRDs (Agent, AgentConfig, AgentGroup, Channel, Provider, WorkflowTemplate, CompliancePolicy)
- 3 controllers (Agent, WorkflowTemplate, CompliancePolicy)
- Generated deepcopy methods (controller-gen v0.16.5)
- Dockerfile (multi-stage Go build)
- Nix build-image.nix (dockerTools.streamLayeredImage)
- Helm chart with RBAC, deployment, service account
- Deploy manifests (RBAC + controller deployment)
- Sample manifests for all 7 CRDs
- Quickstart script
- Successfully deployed to k3s on n97-mini:
- Controller running and reconciling
- All 7 CRDs registered
- Agent CR creates Pod (ErrImagePull expected — no agent image yet)
- Controller logs show reconciliation working
|
2026-05-12 17:08:31 -07:00 |
|
|
|
7607086664
|
Security redesign: template-only tool surface + compliance judge
BREAKING: Complete CRD redesign per security-first architecture.
Removed:
- ToolBinding CRD (replaced by WorkflowTemplate + CompliancePolicy)
- JudgePolicy CRD (replaced by CompliancePolicy)
- AgentJudgeConfig, JudgeTiers types (no longer needed)
Added:
- WorkflowTemplate CRD: cluster-scoped, defines pre-approved workflow
steps, parameter schemas, output schemas, and compliance requirements.
These are the ONLY thing agents can invoke.
- CompliancePolicy CRD: cluster-scoped, defines security/regulatory rules
that the judge evaluates each workflow instantiation against.
Supports SOC2, HIPAA, GDPR, and custom frameworks with rule-level
severity and escalation paths.
Changed:
- Agent: stripped judge/toolbinding fields, added template whitelist,
allowed data sources/destinations, compliance policy refs
- AgentGroup: same pattern, removes judge ref + toolbinding refs
- AgentStatus: removed judge audit tracking, added activeTemplate and
lastWorkflow
Design:
- Agents expose exactly 1 tool: template_workflow(template, params)
- Judge evaluates each call against WorkflowTemplate spec + CompliancePolicy
- Per-action authorization becomes per-workflow authorization
- Every invocation is a structured, auditable record
|
2026-05-11 21:18:40 -07:00 |
|
|
|
4bc4e0e442
|
CRDs: Provider, Channel, ToolBinding, AgentConfig + resource refs
- Provider CRD: cluster-scoped, API key from Secrets, model lists with pricing
- Channel CRD: Discord/Slack/Telegram bindings with bot token refs
- ToolBinding CRD: per-tool risk tiers with pattern escalation for exec-like tools
- AgentConfig CRD: reusable config templates mirroring agents.defaults.*
- Agent: now references AgentConfig, ToolBinding, Channel, Provider by name
- AgentGroup: same resource refs + shared config inheritance
|
2026-05-11 21:13:26 -07:00 |
|
|
|
1a831bdfe5
|
Initial scaffold: project structure, CRDs, Makefile
- Agent CRD: deployment spec, workspace config, channels, judge integration
- AgentGroup CRD: multi-agent orchestration with shared configs
- JudgePolicy CRD: cluster-scoped authorization policies with per-agent overrides
- Makefile: build, generate, install, test, helm targets
- Go module: controller-runtime + apimachinery dependencies
|
2026-05-11 20:54:10 -07:00 |
|
