diff --git a/docs/development/kits-integration-runbook.md b/docs/development/kits-integration-runbook.md index 5f8b2f9..bade54d 100644 --- a/docs/development/kits-integration-runbook.md +++ b/docs/development/kits-integration-runbook.md @@ -12,7 +12,7 @@ every checked-in kit release and representative multi-kit composition. ## What it proves -- A minimal pack can list, search, and inspect the complete initial 38-kit +- A minimal pack can list, search, and inspect the complete 46-kit collection. - Preview is side-effect free and exposes ordinary files, topology, assumptions, dependencies, and RAES lock changes without parameter values. diff --git a/docs/development/missing-infrastructure-kits-preflight.md b/docs/development/missing-infrastructure-kits-preflight.md new file mode 100644 index 0000000..c03fdb6 --- /dev/null +++ b/docs/development/missing-infrastructure-kits-preflight.md @@ -0,0 +1,110 @@ +# Missing infrastructure kits preflight + +Issue #225 adds eight first-party infrastructure kit releases. This note fixes +their architecture boundary before content is authored; it does not implement +the releases or prescribe an implementation sequence. Existing ADRs +[0009](../decisions/adrs/0009-scenario-packs-subordinate-to-aces.md), +[0035](../decisions/adrs/0035-compose-catalog-kits-through-raes-and-transactional-pack-projections.md), +and [0036](../decisions/adrs/0036-publish-first-party-content-with-env-packs.md) +already govern the change. No new ADR or schema version is needed. + +## Release boundary + +Add exactly eight independently versioned `1.0.0` releases under `kits/`. Use +capability-oriented kit and module identities; the named implementation belongs +in the RAES node `source`, not in another product-specific manifest field. +`concern` remains a discovery aid, not a semantic or deployment classification. + +| Kit identity | RAES source | Existing concern | Domain variation seam | Declared service boundary | +| --- | --- | --- | --- | --- | +| `infrastructure.certificate-authority` | `step-ca` | `identity-domain` | authority name | HTTPS CA API, normally `9000/tcp` for the selected source release | +| `infrastructure.dhcp-ipam-service` | `kea` | `network-shared` | address pool or subnet | server-side DHCP surfaces (`67/udp`, and `547/udp` only when DHCPv6 is declared) | +| `infrastructure.secrets-store` | `openbao` | `policy-operations` | non-secret mount or namespace name | client API `8200/tcp`; cluster `8201/tcp` only if the module actually declares clustering | +| `infrastructure.message-broker` | `rabbitmq` | `data-workflow` | virtual host | AMQP `5672/tcp`; management `15672/tcp` only if that plugin is part of the declared surface | +| `infrastructure.cache-key-value-store` | `valkey` | `data-workflow` | key prefix or cache profile | client service `6379/tcp` | +| `infrastructure.firewall-nat` | `nftables` | `network-shared` | ruleset name | no invented listener; filtering/NAT policy ports are seeded state, not node services | +| `infrastructure.ldap-directory` | `openldap` | `identity-domain` | directory suffix | LDAP `389/tcp`; LDAPS `636/tcp` only when the TLS surface is declared | +| `infrastructure.container-orchestration` | `k3s` | `data-workflow` | cluster name | author-facing API `6443/tcp`; node/overlay ports only when corresponding topology is modeled | + +The numeric surfaces above are guardrails, not permission to copy every port an +upstream deployment might use. Confirm the selected source release and declare +only stable, author-relevant listeners. A RAES node service is a scenario-visible +service, not a Docker host publish, firewall opening, process bind address, or +complete vendor firewall matrix. In particular, `nftables` has no application +listener of its own; adding SSH or a fake management port would misdescribe it. + +Every module retains the collection's established shared parameters +`deployment_profile` and `service_label`, plus the domain seam above. It exports +its node and `content.seed_inventory`, with other RAES declarations only where +the exact RAES 5.0.0 public contract supports the meaning. Generic LDAP must not +copy Active Directory forests, profiles, or controller relationships merely to +look like the existing AD kits. Relationships between DHCP/DNS, CA/consumers, +broker/clients, cache/applications, firewall/protected nodes, LDAP/members, or +k3s/workloads belong at the consuming pack root. + +Seed inventories describe at least three useful, benign objects such as policy +names, pools, queues, exchanges, cache policies, directory containers, or +cluster namespaces. They contain no private keys, bootstrap tokens, unseal +material, RabbitMQ credentials, LDAP bind passwords, kubeconfigs, environment +variable coordinates, signed URLs, or example values that resemble live +secrets. A certificate name or secret-engine mount is acceptable metadata; a +certificate authority private key or stored secret value is not. + +The existing +[`infrastructure.reverse-proxy-api-gateway`](../../kits/infrastructure.reverse-proxy-api-gateway/1.0.0/module.sdl.yaml) +already covers the load-balancer boundary: it declares a Traefik source, +HTTP/HTTPS services, route and upstream-binding seed objects, and an explicit +pack-root upstream relationship. Do not add a duplicate load-balancer kit. +A future demonstrated L4-only or algorithm-specific need should first test +whether it is a compatible new release/parameter of that kit; a product synonym +is not a separate reusable unit. + +## Contracts and cross-cutting layers + +The releases are ordinary inputs to the existing RAES-subordinate pack tooling; +they require no new controller, DTO, service, repository, persistence +store, exception family, logger, catalog registry, or workflow. + +| Layer and canonical incumbent | Required guardrail | +| --- | --- | +| Carrier and schema: `src/raes_env_packs/resources/schemas/kit.schema.yaml`, `validate_kit_document()` | Keep `environment-pack-kit/v1` closed. Reuse its existing concern enum, resources, prerequisites, limitations, license, tests, component inventory, and associated-artifact pointer. Do not add product, port, seed, or runtime fields to the manifest. | +| Semantic authority: exact `raes==5.0.0`, `parse_sdl()`, `canonical_sdl_digest()` | Nodes, sources, services, parameters, exports, accounts, identity declarations, relationships, content and realization constraints are ordinary RAES SDL. Do not restate their schema or accept RAES-invalid vocabulary locally. | +| Infrastructure admission: `_validate_raw_module()` and `_verify_infrastructure_only()` | No agents, actions, behavior, conditions, objectives, injects, events, scripts, stories, workflows, scoring, telemetry, oracle, or runtime lifecycle semantics. Seed names are not a loophole for behavior. | +| Input and filesystem safety: `KitLimits`, strict YAML/JSON readers, `_pack_fs`, `_authoring_safety.admit_members()` | Preserve duplicate-key rejection, bounded nodes/depth/aliases/bytes/members, canonical relative paths, no links or special files, no sensitive filenames, and unchanged-inventory checks. All assets stay below the four safe non-executable destinations. | +| Secret and environment admission: `_secret_shape_violations()`, `_secret_parameter_name()`, `_normalize_parameters()`, `kit_cli._parameters()`, `AuthoringSession.call()` | Keep parameters bounded, public scalars. No secret-shaped names or values and no environment coordinates. Automation continues to pass parameter JSON through stdin, never argv. The loader does not inspect arbitrary module prose or asset values for every secret shape, so authored module descriptions, README, integration, and seed files still need explicit review. | +| Integrity and supply boundary: RAES associated-artifact models, `validate_associated_artifact_manifest()`, `associated_artifact_set_digest()` | Bind the exact release inventory, real byte checksums/sizes, canonical SDL parent digest, manifest id/version, and one immutable set digest. The kit's MIT license covers authored kit content; it does not relabel upstream product licensing. Keep the product source unresolved unless an immutable artifact is actually shipped or pinned. | +| Discovery and persistence: `load_kit_release()`, `build_kit_catalog()`, `inspect_kit()`, `KitRelease`/`KitSource` | Directory identity, manifest identity, module identity/version, and deterministic catalog projection must agree. The checked-in release directory is the source of truth; add no hand-maintained catalog index or database. A consumer's materialization ledger remains inert ownership/provenance, not a second module lock. | +| Materialization: `KitProposal`, `propose_*()`, `apply_proposal()`, `_transactions` | Existing proposal review, static successor validation, ownership conflict handling, concurrent-change checks, and atomic exchange apply unchanged. Kit assets never install validators, tests, hooks, workflows, or backend configuration. | +| Host authorization and write admission: `AuthoringSession`, `create_server()`, `_trusted_root()`, `_admit_tree()` | Discovery and inspection remain limited to host-admitted local source handles. MCP preparation and apply remain separate stored-proposal operations behind `allow_prepare` and `allow_writes`, a dedicated write root, review, and exact-input recapture. The local library adds no authentication or authorization policy; a hosting adapter retains actor authorization and redacted audit responsibility. | +| Errors and observability: `KitError`, `KitRecoveryError`, `Diagnostic`, CLI exits `0/1/2/3`, authoring safe envelopes | Keep failures bounded and value-free. Libraries remain silent; no kit-specific exception or logging layer. CLI/MCP output must not echo parameter values, credentials, parser internals, or upstream responses. | +| Repository gates: `tests/test_published_kits.py`, `tests/test_kits.py`, `.github/workflows/ci.yml`, `AGENTS.md` | The publication count becomes 46; every release must load deterministically, compose with default and materially different domain parameters, contain substantive authoring material, and preserve representative multi-kit composition. Use the repository's full verification commands; do not create a parallel kit validator. | + +`raes-pack-validate --repo .` and `raes-pack-release check --all` remain pack +gates. Checked-in kit release admission is exercised by the unit suite through +`load_kit_release()` and the published-kit tests. Passing a YAML parse alone is +not release validation. + +## Non-goals and anti-patterns + +- Do not change the kit, catalog, materialization, pack, or RAES schemas for this + collection extension, and do not duplicate any of their validation logic. +- Do not add a ninth load-balancer kit, product aliases, an authored catalog + file, kit generator framework, runtime plugin, deployment recipe, container + image, package installation, health probe, or backend capability claim. +- Do not treat a source name/version as an immutable artifact, SBOM, signature, + vulnerability result, runtime readiness claim, or proof that a backend can + realize the node. +- Do not turn OpenBao secret values, step-ca key material, RabbitMQ credentials, + LDAP passwords, or k3s join tokens into parameters or benign seed examples. +- Do not represent nftables policy as a listening daemon, client ports as server + listeners, optional management plugins as mandatory services, or every + intra-cluster port as a public endpoint. +- Do not hand-edit `pyproject.toml` version or `CHANGELOG.md`. Each kit has its + own `1.0.0` identity; repository package release metadata remains owned by + release-please. + +The extension seam is the existing RAES module parameter/export contract. One +reasonable future variation should be expressible by a domain parameter and +pack-root relationship without changing the kit carrier. If it instead needs a +new semantic concept, resolution belongs upstream in RAES; if it needs runtime +realization, it belongs in a backend. diff --git a/kits/infrastructure.cache-key-value-store/1.0.0/README.md b/kits/infrastructure.cache-key-value-store/1.0.0/README.md new file mode 100644 index 0000000..746fabb --- /dev/null +++ b/kits/infrastructure.cache-key-value-store/1.0.0/README.md @@ -0,0 +1,13 @@ +# Cache / key-value store + +Reusable cache / key-value store authoring content using the RAES module `infrastructure/cache-key-value-store` and declared `valkey` source. + +The module exports `nodes.cache` and `content.seed_inventory`. Its `key_prefix` parameter varies the declared inventory without changing those identities. + +Declared service surface: + +- resp: 6379/tcp — RESP client endpoint. + +The seed inventory names keyspace, seed_keys, eviction_policy, persistence_policy. Connect clients at the pack root and choose persistence and access controls in the consuming environment. + +This release is static authoring content. The consuming pack and backend own relationships, credential delivery, launch, configuration, and any runtime evidence. diff --git a/kits/infrastructure.cache-key-value-store/1.0.0/assets/integration.md b/kits/infrastructure.cache-key-value-store/1.0.0/assets/integration.md new file mode 100644 index 0000000..8efe262 --- /dev/null +++ b/kits/infrastructure.cache-key-value-store/1.0.0/assets/integration.md @@ -0,0 +1,14 @@ +# Cache / key-value store integration material + +Author parameter: `key_prefix` (default `lab:`). + +## Exported RAES declarations + +- `nodes.cache` +- `content.seed_inventory` + +## Composition notes + +- Connect clients at the pack root and choose persistence and access controls in the consuming environment. +- Keep credentials, private keys, and runtime-selected endpoints outside kit parameters and seed assets. +- Validate the completed ordinary pack after adding pack-level relationships. diff --git a/kits/infrastructure.cache-key-value-store/1.0.0/assets/seed.yaml b/kits/infrastructure.cache-key-value-store/1.0.0/assets/seed.yaml new file mode 100644 index 0000000..fff3282 --- /dev/null +++ b/kits/infrastructure.cache-key-value-store/1.0.0/assets/seed.yaml @@ -0,0 +1,22 @@ +schema_version: environment-kit-seed/v1 +kit: infrastructure.cache-key-value-store +configuration: + key_prefix: 'lab:' + deployment_profile: standard + service_label: cache-key-value-store +declared_objects: +- id: keyspace + kind: infrastructure-seed + sensitivity: non-secret +- id: seed_keys + kind: infrastructure-seed + sensitivity: non-secret +- id: eviction_policy + kind: infrastructure-seed + sensitivity: non-secret +- id: persistence_policy + kind: infrastructure-seed + sensitivity: non-secret +integration_requirements: +- Connect clients at the pack root and choose persistence and access controls in the consuming + environment. diff --git a/kits/infrastructure.cache-key-value-store/1.0.0/associated-artifacts.json b/kits/infrastructure.cache-key-value-store/1.0.0/associated-artifacts.json new file mode 100644 index 0000000..19dde23 --- /dev/null +++ b/kits/infrastructure.cache-key-value-store/1.0.0/associated-artifacts.json @@ -0,0 +1,113 @@ +{ + "schema_version": "associated-artifact-manifest/v1", + "manifest_id": "infrastructure.cache-key-value-store-associated-artifacts", + "manifest_version": "1.0.0", + "canonicalization_profile": "associated-artifact-set/v1", + "scope": "scenario", + "parent_ref": { + "ref_kind": "scenario-snapshot", + "ref_id": "cache-key-value-store", + "ref_version": null, + "ref_digest": "sha256:049bc9ab36decfd4b7c5f0bd91be421e12a31afd2b5a99a204d56f0c8082b7a3", + "ref_path": null + }, + "artifacts": { + "readme": { + "artifact_id": "readme", + "role": "documentation", + "media_type": "text/markdown", + "uri": "raes-environment-kit:/README.md", + "checksum": { + "algorithm": "sha256", + "value": "4362372dbed803d26bb18b12e7503d81397c926a5ea3442e618d17fba17cce34" + }, + "size_bytes": 749, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.cache-key-value-store@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "integration-material": { + "artifact_id": "integration-material", + "role": "operator-guide", + "media_type": "text/markdown", + "uri": "raes-environment-kit:/assets/integration.md", + "checksum": { + "algorithm": "sha256", + "value": "2807ddee824a3e26cc95423230eb9301f6e4fce7b3e1d1bd0ed0e4a91b099cef" + }, + "size_bytes": 486, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.cache-key-value-store@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "seed-profile": { + "artifact_id": "seed-profile", + "role": "configuration", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/assets/seed.yaml", + "checksum": { + "algorithm": "sha256", + "value": "e0cfb884918e6ccf5832364373d02c5d4e4bd327a56f88fdd04aafe6a74c1393" + }, + "size_bytes": 636, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.cache-key-value-store@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "kit-manifest": { + "artifact_id": "kit-manifest", + "role": "manifest", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/kit.yaml", + "checksum": { + "algorithm": "sha256", + "value": "e1560ef1390d68d820d5b08cf30015c2ce6ca718bea8f998c3370dbb41d1d125" + }, + "size_bytes": 1583, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.cache-key-value-store@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "module": { + "artifact_id": "module", + "role": "configuration", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/module.sdl.yaml", + "checksum": { + "algorithm": "sha256", + "value": "210954d98a8847343c98abe9f64f656099e2ffdf03c9edf7a2a7d1ae81f18c78" + }, + "size_bytes": 2013, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.cache-key-value-store@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "composition-tests": { + "artifact_id": "composition-tests", + "role": "configuration", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/tests/composition.yaml", + "checksum": { + "algorithm": "sha256", + "value": "8abbb7bb9963a9b5a9513111fe4b9028ce0ba8f227c682509ed0f7a614f0a6f1" + }, + "size_bytes": 247, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.cache-key-value-store@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + } + }, + "set_digest": "sha256:6e0532671296ce71cab3cd0f69ca0d3a1654ab3c6b8e241be0ce4a2c69fcecb2" +} diff --git a/kits/infrastructure.cache-key-value-store/1.0.0/kit.yaml b/kits/infrastructure.cache-key-value-store/1.0.0/kit.yaml new file mode 100644 index 0000000..ed8158d --- /dev/null +++ b/kits/infrastructure.cache-key-value-store/1.0.0/kit.yaml @@ -0,0 +1,47 @@ +schema_version: environment-pack-kit/v1 +id: infrastructure.cache-key-value-store +version: 1.0.0 +title: Cache / key-value store +summary: Reusable cache / key-value store with a declared software source, service or policy + surfaces, benign seed inventory, and pack-local integration material. +concern: data-workflow +released_at: '2026-09-20T00:00:00Z' +module: + path: module.sdl.yaml +assets: +- source: assets/integration.md + target: assets/kits/cache-key-value-store/integration.md + visibility: operator + artifact_id: integration-material +- source: assets/seed.yaml + target: assets/kits/cache-key-value-store/seed.yaml + visibility: operator + artifact_id: seed-profile +resources: + cpu_cores: 2 + memory_mib: 2048 + storage_mib: 4096 + notes: Planning estimates only; realization sizing remains backend-owned. +prerequisites: [] +limitations: +- Declares static infrastructure and seeded state only; no launch, readiness, traffic attachment, + or runtime evidence is claimed. +- No cluster bus, live cache contents, or persistence readback is asserted. +license: + expression: MIT + redistribution: open + attribution: OpenRAE contributors +tests: +- path: tests/composition.yaml + kind: validate +- path: tests/composition.yaml + kind: parameter-variation +- path: tests/composition.yaml + kind: multi-kit +component_inventory: +- scope: unresolved + authority: raes-source + ref: /nodes/cache/source + description: RAES carries the declared valkey source; immutable artifact selection remains + unresolved until pack publication. +associated_artifact_manifest: associated-artifacts.json diff --git a/kits/infrastructure.cache-key-value-store/1.0.0/module.sdl.yaml b/kits/infrastructure.cache-key-value-store/1.0.0/module.sdl.yaml new file mode 100644 index 0000000..37ce842 --- /dev/null +++ b/kits/infrastructure.cache-key-value-store/1.0.0/module.sdl.yaml @@ -0,0 +1,83 @@ +name: cache-key-value-store +version: 1.0.0 +description: Reusable static infrastructure for Cache / key-value store. +module: + id: infrastructure/cache-key-value-store + version: 1.0.0 + parameters: + - deployment_profile + - service_label + - key_prefix + exports: + nodes: + - cache + content: + - seed_inventory + description: Composable Cache / key-value store infrastructure module. +variables: + deployment_profile: + type: string + default: standard + allowed_values: + - compact + - standard + service_label: + type: string + default: cache-key-value-store + key_prefix: + type: string + default: 'lab:' +nodes: + cache: + type: compute + description: '${deployment_profile} profile for ${service_label} (Cache / key-value store). + key_prefix: ${key_prefix}.' + source: + name: valkey + version: stable + resources: + cpu: 2 + ram: 2 GiB + services: + - name: resp + port: 6379 + protocol: tcp + description: RESP client endpoint +content: + seed_inventory: + type: dataset + target: cache + description: Benign cache / key-value store seed inventory for ${key_prefix}. + items: + - name: keyspace + display_name: Keyspace + tags: + - infrastructure + - seed + description: Named keyspace convention for consuming applications. + - name: seed_keys + display_name: Seed Keys + tags: + - infrastructure + - seed + description: Benign key-name inventory without private values. + - name: eviction_policy + display_name: Eviction Policy + tags: + - infrastructure + - seed + description: Named cache eviction posture. + - name: persistence_policy + display_name: Persistence Policy + tags: + - infrastructure + - seed + description: Named persistence posture for seeded state. +realization: + constraints: + - field_pointer: /nodes/cache + concern: compute-substrate + posture: exact + domain: + kind: exact + value: virtual-machine diff --git a/kits/infrastructure.cache-key-value-store/1.0.0/tests/composition.yaml b/kits/infrastructure.cache-key-value-store/1.0.0/tests/composition.yaml new file mode 100644 index 0000000..2126cc4 --- /dev/null +++ b/kits/infrastructure.cache-key-value-store/1.0.0/tests/composition.yaml @@ -0,0 +1,9 @@ +default: + deployment_profile: standard + service_label: cache-key-value-store + key_prefix: 'lab:' +variation: + deployment_profile: compact + service_label: cache-key-value-store-alternate + key_prefix: 'exercise:' +multi_kit_group: data-workflow diff --git a/kits/infrastructure.certificate-authority/1.0.0/README.md b/kits/infrastructure.certificate-authority/1.0.0/README.md new file mode 100644 index 0000000..4ed0934 --- /dev/null +++ b/kits/infrastructure.certificate-authority/1.0.0/README.md @@ -0,0 +1,13 @@ +# Certificate authority + +Reusable certificate authority authoring content using the RAES module `infrastructure/certificate-authority` and declared `step-ca` source. + +The module exports `nodes.ca` and `content.seed_inventory`. Its `authority_name` parameter varies the declared inventory without changing those identities. + +Declared service surface: + +- https: 9000/tcp — Certificate authority API. + +The seed inventory names trust_anchor, provisioner, certificate_profile, issuance_policy. Connect consuming services to this authority at the pack root and supply private signing material through the backend. + +This release is static authoring content. The consuming pack and backend own relationships, credential delivery, launch, configuration, and any runtime evidence. diff --git a/kits/infrastructure.certificate-authority/1.0.0/assets/integration.md b/kits/infrastructure.certificate-authority/1.0.0/assets/integration.md new file mode 100644 index 0000000..994f559 --- /dev/null +++ b/kits/infrastructure.certificate-authority/1.0.0/assets/integration.md @@ -0,0 +1,14 @@ +# Certificate authority integration material + +Author parameter: `authority_name` (default `lab-ca`). + +## Exported RAES declarations + +- `nodes.ca` +- `content.seed_inventory` + +## Composition notes + +- Connect consuming services to this authority at the pack root and supply private signing material through the backend. +- Keep credentials, private keys, and runtime-selected endpoints outside kit parameters and seed assets. +- Validate the completed ordinary pack after adding pack-level relationships. diff --git a/kits/infrastructure.certificate-authority/1.0.0/assets/seed.yaml b/kits/infrastructure.certificate-authority/1.0.0/assets/seed.yaml new file mode 100644 index 0000000..c1e3d83 --- /dev/null +++ b/kits/infrastructure.certificate-authority/1.0.0/assets/seed.yaml @@ -0,0 +1,22 @@ +schema_version: environment-kit-seed/v1 +kit: infrastructure.certificate-authority +configuration: + authority_name: lab-ca + deployment_profile: standard + service_label: certificate-authority +declared_objects: +- id: trust_anchor + kind: infrastructure-seed + sensitivity: non-secret +- id: provisioner + kind: infrastructure-seed + sensitivity: non-secret +- id: certificate_profile + kind: infrastructure-seed + sensitivity: non-secret +- id: issuance_policy + kind: infrastructure-seed + sensitivity: non-secret +integration_requirements: +- Connect consuming services to this authority at the pack root and supply private signing + material through the backend. diff --git a/kits/infrastructure.certificate-authority/1.0.0/associated-artifacts.json b/kits/infrastructure.certificate-authority/1.0.0/associated-artifacts.json new file mode 100644 index 0000000..6d812d7 --- /dev/null +++ b/kits/infrastructure.certificate-authority/1.0.0/associated-artifacts.json @@ -0,0 +1,113 @@ +{ + "schema_version": "associated-artifact-manifest/v1", + "manifest_id": "infrastructure.certificate-authority-associated-artifacts", + "manifest_version": "1.0.0", + "canonicalization_profile": "associated-artifact-set/v1", + "scope": "scenario", + "parent_ref": { + "ref_kind": "scenario-snapshot", + "ref_id": "certificate-authority", + "ref_version": null, + "ref_digest": "sha256:0eb3c3508dc686fb8efc02cea8dccb3558c7137f9e92c5c5c1f681897255844a", + "ref_path": null + }, + "artifacts": { + "readme": { + "artifact_id": "readme", + "role": "documentation", + "media_type": "text/markdown", + "uri": "raes-environment-kit:/README.md", + "checksum": { + "algorithm": "sha256", + "value": "e8cd5dadef83577628722fedaeea42ceadc2052c4400e456a5c62304f48583db" + }, + "size_bytes": 773, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.certificate-authority@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "integration-material": { + "artifact_id": "integration-material", + "role": "operator-guide", + "media_type": "text/markdown", + "uri": "raes-environment-kit:/assets/integration.md", + "checksum": { + "algorithm": "sha256", + "value": "5b53afd466f1646e909a3f9a35eee3e4ad9147be2da91d3dd67a7063414ddef2" + }, + "size_bytes": 500, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.certificate-authority@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "seed-profile": { + "artifact_id": "seed-profile", + "role": "configuration", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/assets/seed.yaml", + "checksum": { + "algorithm": "sha256", + "value": "35947acdb11988e66da9c33b65ea3d37f2ee5a026cbcc95ca9db8a0cd4a6f1ec" + }, + "size_bytes": 660, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.certificate-authority@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "kit-manifest": { + "artifact_id": "kit-manifest", + "role": "manifest", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/kit.yaml", + "checksum": { + "algorithm": "sha256", + "value": "1d8e863a9a86ee6b2077ce19db66c6acad15261a60b9b384cbdfe0b6cbff5fb6" + }, + "size_bytes": 1584, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.certificate-authority@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "module": { + "artifact_id": "module", + "role": "configuration", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/module.sdl.yaml", + "checksum": { + "algorithm": "sha256", + "value": "578229e966e6be9e55c7cd69705ff34c8cd13588e7e5856adacc483db346c23f" + }, + "size_bytes": 2070, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.certificate-authority@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "composition-tests": { + "artifact_id": "composition-tests", + "role": "configuration", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/tests/composition.yaml", + "checksum": { + "algorithm": "sha256", + "value": "cbec3b5c14e7f285318bc67eb8a817427ce4545c02e75223a5313ee59abc3b98" + }, + "size_bytes": 257, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.certificate-authority@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + } + }, + "set_digest": "sha256:327794eb9b9b89caabf5c2ab5b85cfa939f66f475ab684f5f952c8e5441664bf" +} diff --git a/kits/infrastructure.certificate-authority/1.0.0/kit.yaml b/kits/infrastructure.certificate-authority/1.0.0/kit.yaml new file mode 100644 index 0000000..3a35c6e --- /dev/null +++ b/kits/infrastructure.certificate-authority/1.0.0/kit.yaml @@ -0,0 +1,47 @@ +schema_version: environment-pack-kit/v1 +id: infrastructure.certificate-authority +version: 1.0.0 +title: Certificate authority +summary: Reusable certificate authority with a declared software source, service or policy + surfaces, benign seed inventory, and pack-local integration material. +concern: identity-domain +released_at: '2026-09-20T00:00:00Z' +module: + path: module.sdl.yaml +assets: +- source: assets/integration.md + target: assets/kits/certificate-authority/integration.md + visibility: operator + artifact_id: integration-material +- source: assets/seed.yaml + target: assets/kits/certificate-authority/seed.yaml + visibility: operator + artifact_id: seed-profile +resources: + cpu_cores: 2 + memory_mib: 2048 + storage_mib: 4096 + notes: Planning estimates only; realization sizing remains backend-owned. +prerequisites: [] +limitations: +- Declares static infrastructure and seeded state only; no launch, readiness, traffic attachment, + or runtime evidence is claimed. +- No CA private key, issued certificate, or live trust establishment is bundled. +license: + expression: MIT + redistribution: open + attribution: OpenRAE contributors +tests: +- path: tests/composition.yaml + kind: validate +- path: tests/composition.yaml + kind: parameter-variation +- path: tests/composition.yaml + kind: multi-kit +component_inventory: +- scope: unresolved + authority: raes-source + ref: /nodes/ca/source + description: RAES carries the declared step-ca source; immutable artifact selection remains + unresolved until pack publication. +associated_artifact_manifest: associated-artifacts.json diff --git a/kits/infrastructure.certificate-authority/1.0.0/module.sdl.yaml b/kits/infrastructure.certificate-authority/1.0.0/module.sdl.yaml new file mode 100644 index 0000000..b34dfa2 --- /dev/null +++ b/kits/infrastructure.certificate-authority/1.0.0/module.sdl.yaml @@ -0,0 +1,83 @@ +name: certificate-authority +version: 1.0.0 +description: Reusable static infrastructure for Certificate authority. +module: + id: infrastructure/certificate-authority + version: 1.0.0 + parameters: + - deployment_profile + - service_label + - authority_name + exports: + nodes: + - ca + content: + - seed_inventory + description: Composable Certificate authority infrastructure module. +variables: + deployment_profile: + type: string + default: standard + allowed_values: + - compact + - standard + service_label: + type: string + default: certificate-authority + authority_name: + type: string + default: lab-ca +nodes: + ca: + type: compute + description: '${deployment_profile} profile for ${service_label} (Certificate authority). + authority_name: ${authority_name}.' + source: + name: step-ca + version: stable + resources: + cpu: 2 + ram: 2 GiB + services: + - name: https + port: 9000 + protocol: tcp + description: Certificate authority API +content: + seed_inventory: + type: dataset + target: ca + description: Benign certificate authority seed inventory for ${authority_name}. + items: + - name: trust_anchor + display_name: Trust Anchor + tags: + - infrastructure + - seed + description: Public trust-anchor identity; no signing key is included. + - name: provisioner + display_name: Provisioner + tags: + - infrastructure + - seed + description: Named issuance provisioner without a credential or token. + - name: certificate_profile + display_name: Certificate Profile + tags: + - infrastructure + - seed + description: Certificate lifetime and subject-profile inventory. + - name: issuance_policy + display_name: Issuance Policy + tags: + - infrastructure + - seed + description: Named issuance policy for consuming services. +realization: + constraints: + - field_pointer: /nodes/ca + concern: compute-substrate + posture: exact + domain: + kind: exact + value: virtual-machine diff --git a/kits/infrastructure.certificate-authority/1.0.0/tests/composition.yaml b/kits/infrastructure.certificate-authority/1.0.0/tests/composition.yaml new file mode 100644 index 0000000..de50ead --- /dev/null +++ b/kits/infrastructure.certificate-authority/1.0.0/tests/composition.yaml @@ -0,0 +1,9 @@ +default: + deployment_profile: standard + service_label: certificate-authority + authority_name: lab-ca +variation: + deployment_profile: compact + service_label: certificate-authority-alternate + authority_name: training-ca +multi_kit_group: identity-domain diff --git a/kits/infrastructure.container-orchestration/1.0.0/README.md b/kits/infrastructure.container-orchestration/1.0.0/README.md new file mode 100644 index 0000000..3850f6c --- /dev/null +++ b/kits/infrastructure.container-orchestration/1.0.0/README.md @@ -0,0 +1,13 @@ +# Container orchestration + +Reusable container orchestration authoring content using the RAES module `infrastructure/container-orchestration` and declared `k3s` source. + +The module exports `nodes.orchestrator` and `content.seed_inventory`. Its `cluster_name` parameter varies the declared inventory without changing those identities. + +Declared service surface: + +- api: 6443/tcp — K3s supervisor and Kubernetes API endpoint. + +The seed inventory names namespace, workload_template, service_account, service_profile. Connect workloads and network services at the pack root; deliver join material outside this kit. + +This release is static authoring content. The consuming pack and backend own relationships, credential delivery, launch, configuration, and any runtime evidence. diff --git a/kits/infrastructure.container-orchestration/1.0.0/assets/integration.md b/kits/infrastructure.container-orchestration/1.0.0/assets/integration.md new file mode 100644 index 0000000..3bc66b9 --- /dev/null +++ b/kits/infrastructure.container-orchestration/1.0.0/assets/integration.md @@ -0,0 +1,14 @@ +# Container orchestration integration material + +Author parameter: `cluster_name` (default `lab-cluster`). + +## Exported RAES declarations + +- `nodes.orchestrator` +- `content.seed_inventory` + +## Composition notes + +- Connect workloads and network services at the pack root; deliver join material outside this kit. +- Keep credentials, private keys, and runtime-selected endpoints outside kit parameters and seed assets. +- Validate the completed ordinary pack after adding pack-level relationships. diff --git a/kits/infrastructure.container-orchestration/1.0.0/assets/seed.yaml b/kits/infrastructure.container-orchestration/1.0.0/assets/seed.yaml new file mode 100644 index 0000000..7f962c0 --- /dev/null +++ b/kits/infrastructure.container-orchestration/1.0.0/assets/seed.yaml @@ -0,0 +1,22 @@ +schema_version: environment-kit-seed/v1 +kit: infrastructure.container-orchestration +configuration: + cluster_name: lab-cluster + deployment_profile: standard + service_label: container-orchestration +declared_objects: +- id: namespace + kind: infrastructure-seed + sensitivity: non-secret +- id: workload_template + kind: infrastructure-seed + sensitivity: non-secret +- id: service_account + kind: infrastructure-seed + sensitivity: non-secret +- id: service_profile + kind: infrastructure-seed + sensitivity: non-secret +integration_requirements: +- Connect workloads and network services at the pack root; deliver join material outside this + kit. diff --git a/kits/infrastructure.container-orchestration/1.0.0/associated-artifacts.json b/kits/infrastructure.container-orchestration/1.0.0/associated-artifacts.json new file mode 100644 index 0000000..6e48460 --- /dev/null +++ b/kits/infrastructure.container-orchestration/1.0.0/associated-artifacts.json @@ -0,0 +1,113 @@ +{ + "schema_version": "associated-artifact-manifest/v1", + "manifest_id": "infrastructure.container-orchestration-associated-artifacts", + "manifest_version": "1.0.0", + "canonicalization_profile": "associated-artifact-set/v1", + "scope": "scenario", + "parent_ref": { + "ref_kind": "scenario-snapshot", + "ref_id": "container-orchestration", + "ref_version": null, + "ref_digest": "sha256:1d08fcb5291389c07ac11e058983bc891c8bf1adabf13335699a77c93e8a32a8", + "ref_path": null + }, + "artifacts": { + "readme": { + "artifact_id": "readme", + "role": "documentation", + "media_type": "text/markdown", + "uri": "raes-environment-kit:/README.md", + "checksum": { + "algorithm": "sha256", + "value": "b327d4fd30521de6aaaa08e474eaadced8308a38e39442ddab2444112d25050d" + }, + "size_bytes": 775, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.container-orchestration@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "integration-material": { + "artifact_id": "integration-material", + "role": "operator-guide", + "media_type": "text/markdown", + "uri": "raes-environment-kit:/assets/integration.md", + "checksum": { + "algorithm": "sha256", + "value": "176d6c200df240d9fb497f6c32fbb35263e2e67c2039f49a0652d6df1515efb4" + }, + "size_bytes": 493, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.container-orchestration@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "seed-profile": { + "artifact_id": "seed-profile", + "role": "configuration", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/assets/seed.yaml", + "checksum": { + "algorithm": "sha256", + "value": "50a76036812c1a7cd14837ce43db282022aa88c4fc77057d88d988893a329e74" + }, + "size_bytes": 644, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.container-orchestration@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "kit-manifest": { + "artifact_id": "kit-manifest", + "role": "manifest", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/kit.yaml", + "checksum": { + "algorithm": "sha256", + "value": "a4ba46cdee51d4f1b0d38114a121d38e3d93c3fc52e9f172592550cedf1433ed" + }, + "size_bytes": 1610, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.container-orchestration@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "module": { + "artifact_id": "module", + "role": "configuration", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/module.sdl.yaml", + "checksum": { + "algorithm": "sha256", + "value": "2535c127b484135179b0ed57c42971cb766ccc2041d7f386188725b120fb8f80" + }, + "size_bytes": 2075, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.container-orchestration@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "composition-tests": { + "artifact_id": "composition-tests", + "role": "configuration", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/tests/composition.yaml", + "checksum": { + "algorithm": "sha256", + "value": "5eb5d65653007c50b29ec9b446e05b94f1d606d31b5b26dcba4638be183d6d90" + }, + "size_bytes": 265, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.container-orchestration@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + } + }, + "set_digest": "sha256:94366a29f8ca170efb2c1aec3b0af717c35b6b82a12fb47aa9423bb411e8cc5c" +} diff --git a/kits/infrastructure.container-orchestration/1.0.0/kit.yaml b/kits/infrastructure.container-orchestration/1.0.0/kit.yaml new file mode 100644 index 0000000..8ce9a64 --- /dev/null +++ b/kits/infrastructure.container-orchestration/1.0.0/kit.yaml @@ -0,0 +1,47 @@ +schema_version: environment-pack-kit/v1 +id: infrastructure.container-orchestration +version: 1.0.0 +title: Container orchestration +summary: Reusable container orchestration with a declared software source, service or policy + surfaces, benign seed inventory, and pack-local integration material. +concern: data-workflow +released_at: '2026-09-20T00:00:00Z' +module: + path: module.sdl.yaml +assets: +- source: assets/integration.md + target: assets/kits/container-orchestration/integration.md + visibility: operator + artifact_id: integration-material +- source: assets/seed.yaml + target: assets/kits/container-orchestration/seed.yaml + visibility: operator + artifact_id: seed-profile +resources: + cpu_cores: 2 + memory_mib: 2048 + storage_mib: 4096 + notes: Planning estimates only; realization sizing remains backend-owned. +prerequisites: [] +limitations: +- Declares static infrastructure and seeded state only; no launch, readiness, traffic attachment, + or runtime evidence is claimed. +- No agent nodes, overlay listener, join token, kubeconfig, or running workload is asserted. +license: + expression: MIT + redistribution: open + attribution: OpenRAE contributors +tests: +- path: tests/composition.yaml + kind: validate +- path: tests/composition.yaml + kind: parameter-variation +- path: tests/composition.yaml + kind: multi-kit +component_inventory: +- scope: unresolved + authority: raes-source + ref: /nodes/orchestrator/source + description: RAES carries the declared k3s source; immutable artifact selection remains + unresolved until pack publication. +associated_artifact_manifest: associated-artifacts.json diff --git a/kits/infrastructure.container-orchestration/1.0.0/module.sdl.yaml b/kits/infrastructure.container-orchestration/1.0.0/module.sdl.yaml new file mode 100644 index 0000000..01f3f14 --- /dev/null +++ b/kits/infrastructure.container-orchestration/1.0.0/module.sdl.yaml @@ -0,0 +1,83 @@ +name: container-orchestration +version: 1.0.0 +description: Reusable static infrastructure for Container orchestration. +module: + id: infrastructure/container-orchestration + version: 1.0.0 + parameters: + - deployment_profile + - service_label + - cluster_name + exports: + nodes: + - orchestrator + content: + - seed_inventory + description: Composable Container orchestration infrastructure module. +variables: + deployment_profile: + type: string + default: standard + allowed_values: + - compact + - standard + service_label: + type: string + default: container-orchestration + cluster_name: + type: string + default: lab-cluster +nodes: + orchestrator: + type: compute + description: '${deployment_profile} profile for ${service_label} (Container orchestration). + cluster_name: ${cluster_name}.' + source: + name: k3s + version: stable + resources: + cpu: 2 + ram: 2 GiB + services: + - name: api + port: 6443 + protocol: tcp + description: K3s supervisor and Kubernetes API endpoint +content: + seed_inventory: + type: dataset + target: orchestrator + description: Benign container orchestration seed inventory for ${cluster_name}. + items: + - name: namespace + display_name: Namespace + tags: + - infrastructure + - seed + description: Named namespace inventory for workloads. + - name: workload_template + display_name: Workload Template + tags: + - infrastructure + - seed + description: Declared workload-template identity. + - name: service_account + display_name: Service Account + tags: + - infrastructure + - seed + description: Service-account name without a token. + - name: service_profile + display_name: Service Profile + tags: + - infrastructure + - seed + description: Named service-exposure intent for workloads. +realization: + constraints: + - field_pointer: /nodes/orchestrator + concern: compute-substrate + posture: exact + domain: + kind: exact + value: virtual-machine diff --git a/kits/infrastructure.container-orchestration/1.0.0/tests/composition.yaml b/kits/infrastructure.container-orchestration/1.0.0/tests/composition.yaml new file mode 100644 index 0000000..bb2fbe8 --- /dev/null +++ b/kits/infrastructure.container-orchestration/1.0.0/tests/composition.yaml @@ -0,0 +1,9 @@ +default: + deployment_profile: standard + service_label: container-orchestration + cluster_name: lab-cluster +variation: + deployment_profile: compact + service_label: container-orchestration-alternate + cluster_name: training-cluster +multi_kit_group: data-workflow diff --git a/kits/infrastructure.dhcp-ipam-service/1.0.0/README.md b/kits/infrastructure.dhcp-ipam-service/1.0.0/README.md new file mode 100644 index 0000000..e3851da --- /dev/null +++ b/kits/infrastructure.dhcp-ipam-service/1.0.0/README.md @@ -0,0 +1,13 @@ +# DHCP / IPAM service + +Reusable dhcp / ipam service authoring content using the RAES module `infrastructure/dhcp-ipam-service` and declared `kea` source. + +The module exports `nodes.dhcp` and `content.seed_inventory`. Its `address_pool` parameter varies the declared inventory without changing those identities. + +Declared service surface: + +- dhcp4: 67/udp — DHCPv4 server endpoint. + +The seed inventory names subnet, address_pool, reservations, lease_policy. Attach this DHCP service to a suitable pack network and connect clients at the pack composition root. + +This release is static authoring content. The consuming pack and backend own relationships, credential delivery, launch, configuration, and any runtime evidence. diff --git a/kits/infrastructure.dhcp-ipam-service/1.0.0/assets/integration.md b/kits/infrastructure.dhcp-ipam-service/1.0.0/assets/integration.md new file mode 100644 index 0000000..7ce5938 --- /dev/null +++ b/kits/infrastructure.dhcp-ipam-service/1.0.0/assets/integration.md @@ -0,0 +1,14 @@ +# DHCP / IPAM service integration material + +Author parameter: `address_pool` (default `10.42.0.0/24`). + +## Exported RAES declarations + +- `nodes.dhcp` +- `content.seed_inventory` + +## Composition notes + +- Attach this DHCP service to a suitable pack network and connect clients at the pack composition root. +- Keep credentials, private keys, and runtime-selected endpoints outside kit parameters and seed assets. +- Validate the completed ordinary pack after adding pack-level relationships. diff --git a/kits/infrastructure.dhcp-ipam-service/1.0.0/assets/seed.yaml b/kits/infrastructure.dhcp-ipam-service/1.0.0/assets/seed.yaml new file mode 100644 index 0000000..6d8f22e --- /dev/null +++ b/kits/infrastructure.dhcp-ipam-service/1.0.0/assets/seed.yaml @@ -0,0 +1,22 @@ +schema_version: environment-kit-seed/v1 +kit: infrastructure.dhcp-ipam-service +configuration: + address_pool: 10.42.0.0/24 + deployment_profile: standard + service_label: dhcp-ipam-service +declared_objects: +- id: subnet + kind: infrastructure-seed + sensitivity: non-secret +- id: address_pool + kind: infrastructure-seed + sensitivity: non-secret +- id: reservations + kind: infrastructure-seed + sensitivity: non-secret +- id: lease_policy + kind: infrastructure-seed + sensitivity: non-secret +integration_requirements: +- Attach this DHCP service to a suitable pack network and connect clients at the pack composition + root. diff --git a/kits/infrastructure.dhcp-ipam-service/1.0.0/associated-artifacts.json b/kits/infrastructure.dhcp-ipam-service/1.0.0/associated-artifacts.json new file mode 100644 index 0000000..cd6e600 --- /dev/null +++ b/kits/infrastructure.dhcp-ipam-service/1.0.0/associated-artifacts.json @@ -0,0 +1,113 @@ +{ + "schema_version": "associated-artifact-manifest/v1", + "manifest_id": "infrastructure.dhcp-ipam-service-associated-artifacts", + "manifest_version": "1.0.0", + "canonicalization_profile": "associated-artifact-set/v1", + "scope": "scenario", + "parent_ref": { + "ref_kind": "scenario-snapshot", + "ref_id": "dhcp-ipam-service", + "ref_version": null, + "ref_digest": "sha256:888f57ac718e1c2a4b0aa047e4d7c7b6cb3934f5359c9821cbbde2ccb0b88e5c", + "ref_path": null + }, + "artifacts": { + "readme": { + "artifact_id": "readme", + "role": "documentation", + "media_type": "text/markdown", + "uri": "raes-environment-kit:/README.md", + "checksum": { + "algorithm": "sha256", + "value": "437ad366faa3d8ac4a4e10cdf1d0de66d5e99f27965c9a743061aa85e43ebb9f" + }, + "size_bytes": 724, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.dhcp-ipam-service@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "integration-material": { + "artifact_id": "integration-material", + "role": "operator-guide", + "media_type": "text/markdown", + "uri": "raes-environment-kit:/assets/integration.md", + "checksum": { + "algorithm": "sha256", + "value": "dc7dbc0013d30fe1b4b2207619c7939eadf33fff255b9dc7ad68ec9ab2d648d8" + }, + "size_bytes": 487, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.dhcp-ipam-service@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "seed-profile": { + "artifact_id": "seed-profile", + "role": "configuration", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/assets/seed.yaml", + "checksum": { + "algorithm": "sha256", + "value": "20ef88bf57385985ea15be01d693bc0f57b882ad184fba29b95ed8ea0da1c8eb" + }, + "size_bytes": 624, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.dhcp-ipam-service@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "kit-manifest": { + "artifact_id": "kit-manifest", + "role": "manifest", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/kit.yaml", + "checksum": { + "algorithm": "sha256", + "value": "5a1277d90305fe69aef77cdfc17bcc8de7753fe5ed21e1d740ebfca332c9b6a1" + }, + "size_bytes": 1573, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.dhcp-ipam-service@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "module": { + "artifact_id": "module", + "role": "configuration", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/module.sdl.yaml", + "checksum": { + "algorithm": "sha256", + "value": "342ddc84213bf26a32f9dc6ea56c25298172072fa41b0b5458d2204b3b103184" + }, + "size_bytes": 1994, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.dhcp-ipam-service@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "composition-tests": { + "artifact_id": "composition-tests", + "role": "configuration", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/tests/composition.yaml", + "checksum": { + "algorithm": "sha256", + "value": "12e91eb64d222d66d5c72529225c865d25480ad7820c3c12a2d96fe59ed65ab5" + }, + "size_bytes": 251, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.dhcp-ipam-service@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + } + }, + "set_digest": "sha256:b62fb0355a1aa42b6b89718839bf98d1712e049a797c42b5cfaaf989f44e15fc" +} diff --git a/kits/infrastructure.dhcp-ipam-service/1.0.0/kit.yaml b/kits/infrastructure.dhcp-ipam-service/1.0.0/kit.yaml new file mode 100644 index 0000000..dc75498 --- /dev/null +++ b/kits/infrastructure.dhcp-ipam-service/1.0.0/kit.yaml @@ -0,0 +1,47 @@ +schema_version: environment-pack-kit/v1 +id: infrastructure.dhcp-ipam-service +version: 1.0.0 +title: DHCP / IPAM service +summary: Reusable dhcp / ipam service with a declared software source, service or policy surfaces, + benign seed inventory, and pack-local integration material. +concern: network-shared +released_at: '2026-09-20T00:00:00Z' +module: + path: module.sdl.yaml +assets: +- source: assets/integration.md + target: assets/kits/dhcp-ipam-service/integration.md + visibility: operator + artifact_id: integration-material +- source: assets/seed.yaml + target: assets/kits/dhcp-ipam-service/seed.yaml + visibility: operator + artifact_id: seed-profile +resources: + cpu_cores: 2 + memory_mib: 2048 + storage_mib: 4096 + notes: Planning estimates only; realization sizing remains backend-owned. +prerequisites: [] +limitations: +- Declares static infrastructure and seeded state only; no launch, readiness, traffic attachment, + or runtime evidence is claimed. +- This release declares DHCPv4 only; DHCPv6 and control-agent listeners are not implied. +license: + expression: MIT + redistribution: open + attribution: OpenRAE contributors +tests: +- path: tests/composition.yaml + kind: validate +- path: tests/composition.yaml + kind: parameter-variation +- path: tests/composition.yaml + kind: multi-kit +component_inventory: +- scope: unresolved + authority: raes-source + ref: /nodes/dhcp/source + description: RAES carries the declared kea source; immutable artifact selection remains + unresolved until pack publication. +associated_artifact_manifest: associated-artifacts.json diff --git a/kits/infrastructure.dhcp-ipam-service/1.0.0/module.sdl.yaml b/kits/infrastructure.dhcp-ipam-service/1.0.0/module.sdl.yaml new file mode 100644 index 0000000..780ae5e --- /dev/null +++ b/kits/infrastructure.dhcp-ipam-service/1.0.0/module.sdl.yaml @@ -0,0 +1,83 @@ +name: dhcp-ipam-service +version: 1.0.0 +description: Reusable static infrastructure for DHCP / IPAM service. +module: + id: infrastructure/dhcp-ipam-service + version: 1.0.0 + parameters: + - deployment_profile + - service_label + - address_pool + exports: + nodes: + - dhcp + content: + - seed_inventory + description: Composable DHCP / IPAM service infrastructure module. +variables: + deployment_profile: + type: string + default: standard + allowed_values: + - compact + - standard + service_label: + type: string + default: dhcp-ipam-service + address_pool: + type: string + default: 10.42.0.0/24 +nodes: + dhcp: + type: compute + description: '${deployment_profile} profile for ${service_label} (DHCP / IPAM service). + address_pool: ${address_pool}.' + source: + name: kea + version: stable + resources: + cpu: 2 + ram: 2 GiB + services: + - name: dhcp4 + port: 67 + protocol: udp + description: DHCPv4 server endpoint +content: + seed_inventory: + type: dataset + target: dhcp + description: Benign dhcp / ipam service seed inventory for ${address_pool}. + items: + - name: subnet + display_name: Subnet + tags: + - infrastructure + - seed + description: Declared subnet associated with the selected address pool. + - name: address_pool + display_name: Address Pool + tags: + - infrastructure + - seed + description: Address allocation pool inventory for DHCPv4. + - name: reservations + display_name: Reservations + tags: + - infrastructure + - seed + description: Named non-secret reservation inventory. + - name: lease_policy + display_name: Lease Policy + tags: + - infrastructure + - seed + description: Lease duration and allocation-policy inventory. +realization: + constraints: + - field_pointer: /nodes/dhcp + concern: compute-substrate + posture: exact + domain: + kind: exact + value: virtual-machine diff --git a/kits/infrastructure.dhcp-ipam-service/1.0.0/tests/composition.yaml b/kits/infrastructure.dhcp-ipam-service/1.0.0/tests/composition.yaml new file mode 100644 index 0000000..56592ea --- /dev/null +++ b/kits/infrastructure.dhcp-ipam-service/1.0.0/tests/composition.yaml @@ -0,0 +1,9 @@ +default: + deployment_profile: standard + service_label: dhcp-ipam-service + address_pool: 10.42.0.0/24 +variation: + deployment_profile: compact + service_label: dhcp-ipam-service-alternate + address_pool: 10.43.0.0/24 +multi_kit_group: network-shared diff --git a/kits/infrastructure.firewall-nat/1.0.0/README.md b/kits/infrastructure.firewall-nat/1.0.0/README.md new file mode 100644 index 0000000..84b5494 --- /dev/null +++ b/kits/infrastructure.firewall-nat/1.0.0/README.md @@ -0,0 +1,13 @@ +# Firewall / NAT + +Reusable firewall / nat authoring content using the RAES module `infrastructure/firewall-nat` and declared `nftables` source. + +The module exports `nodes.firewall` and `content.seed_inventory`. Its `ruleset_name` parameter varies the declared inventory without changing those identities. + +Declared service surface: + +- No node listener. The selected policy ports are seed inventory, not nftables service endpoints. + +The seed inventory names filter_chains, allowed_ports, nat_policy, forwarding_rules. Attach the firewall node to protected networks and specify policy relationships at the pack root. + +This release is static authoring content. The consuming pack and backend own relationships, credential delivery, launch, configuration, and any runtime evidence. diff --git a/kits/infrastructure.firewall-nat/1.0.0/assets/integration.md b/kits/infrastructure.firewall-nat/1.0.0/assets/integration.md new file mode 100644 index 0000000..475dbad --- /dev/null +++ b/kits/infrastructure.firewall-nat/1.0.0/assets/integration.md @@ -0,0 +1,14 @@ +# Firewall / NAT integration material + +Author parameter: `ruleset_name` (default `edge-filter`). + +## Exported RAES declarations + +- `nodes.firewall` +- `content.seed_inventory` + +## Composition notes + +- Attach the firewall node to protected networks and specify policy relationships at the pack root. +- Keep credentials, private keys, and runtime-selected endpoints outside kit parameters and seed assets. +- Validate the completed ordinary pack after adding pack-level relationships. diff --git a/kits/infrastructure.firewall-nat/1.0.0/assets/seed.yaml b/kits/infrastructure.firewall-nat/1.0.0/assets/seed.yaml new file mode 100644 index 0000000..92e9841 --- /dev/null +++ b/kits/infrastructure.firewall-nat/1.0.0/assets/seed.yaml @@ -0,0 +1,25 @@ +schema_version: environment-kit-seed/v1 +kit: infrastructure.firewall-nat +configuration: + ruleset_name: edge-filter + deployment_profile: standard + service_label: firewall-nat + policy_ports: + - 80 + - 443 +declared_objects: +- id: filter_chains + kind: infrastructure-seed + sensitivity: non-secret +- id: allowed_ports + kind: infrastructure-seed + sensitivity: non-secret +- id: nat_policy + kind: infrastructure-seed + sensitivity: non-secret +- id: forwarding_rules + kind: infrastructure-seed + sensitivity: non-secret +integration_requirements: +- Attach the firewall node to protected networks and specify policy relationships at the pack + root. diff --git a/kits/infrastructure.firewall-nat/1.0.0/associated-artifacts.json b/kits/infrastructure.firewall-nat/1.0.0/associated-artifacts.json new file mode 100644 index 0000000..d611ce4 --- /dev/null +++ b/kits/infrastructure.firewall-nat/1.0.0/associated-artifacts.json @@ -0,0 +1,113 @@ +{ + "schema_version": "associated-artifact-manifest/v1", + "manifest_id": "infrastructure.firewall-nat-associated-artifacts", + "manifest_version": "1.0.0", + "canonicalization_profile": "associated-artifact-set/v1", + "scope": "scenario", + "parent_ref": { + "ref_kind": "scenario-snapshot", + "ref_id": "firewall-nat", + "ref_version": null, + "ref_digest": "sha256:0a96c2f5a046906f474547926c25d84bcb0438ccb85b892ba2a985a2dc726724", + "ref_path": null + }, + "artifacts": { + "readme": { + "artifact_id": "readme", + "role": "documentation", + "media_type": "text/markdown", + "uri": "raes-environment-kit:/README.md", + "checksum": { + "algorithm": "sha256", + "value": "776f88f854ca6bb2d3e09766ad4e44f25a63ab0dc378bfd715e2370a138033c3" + }, + "size_bytes": 778, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.firewall-nat@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "integration-material": { + "artifact_id": "integration-material", + "role": "operator-guide", + "media_type": "text/markdown", + "uri": "raes-environment-kit:/assets/integration.md", + "checksum": { + "algorithm": "sha256", + "value": "0313806f040fdef775325d8df7b226bd2e8e1e9378056659d9649bc6afcb8da6" + }, + "size_bytes": 481, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.firewall-nat@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "seed-profile": { + "artifact_id": "seed-profile", + "role": "configuration", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/assets/seed.yaml", + "checksum": { + "algorithm": "sha256", + "value": "457e5d8588cc7b89a4be915dac26a547d12d258755bead4988c27d6012bfd8fb" + }, + "size_bytes": 650, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.firewall-nat@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "kit-manifest": { + "artifact_id": "kit-manifest", + "role": "manifest", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/kit.yaml", + "checksum": { + "algorithm": "sha256", + "value": "e4b683ab4c213ffeeedff92e86768115fe52a78de8dfd9a2dc0e725a8e606804" + }, + "size_bytes": 1565, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.firewall-nat@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "module": { + "artifact_id": "module", + "role": "configuration", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/module.sdl.yaml", + "checksum": { + "algorithm": "sha256", + "value": "d9cc8bfb0f9e9a5e1ee95f0128cd3a71a854c96cbff82c89c0f3d0b70525ddd9" + }, + "size_bytes": 1904, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.firewall-nat@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "composition-tests": { + "artifact_id": "composition-tests", + "role": "configuration", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/tests/composition.yaml", + "checksum": { + "algorithm": "sha256", + "value": "a2d234a64f700281c0ec2fd4848045ba6e745151042a8edb73907a7d7064ef36" + }, + "size_bytes": 243, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.firewall-nat@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + } + }, + "set_digest": "sha256:fb57793928b9fe578792ca406451d8c667de3bfca8cf5d9648f0bec27a27a19d" +} diff --git a/kits/infrastructure.firewall-nat/1.0.0/kit.yaml b/kits/infrastructure.firewall-nat/1.0.0/kit.yaml new file mode 100644 index 0000000..f53de57 --- /dev/null +++ b/kits/infrastructure.firewall-nat/1.0.0/kit.yaml @@ -0,0 +1,47 @@ +schema_version: environment-pack-kit/v1 +id: infrastructure.firewall-nat +version: 1.0.0 +title: Firewall / NAT +summary: Reusable firewall / nat with a declared software source, service or policy surfaces, + benign seed inventory, and pack-local integration material. +concern: network-shared +released_at: '2026-09-20T00:00:00Z' +module: + path: module.sdl.yaml +assets: +- source: assets/integration.md + target: assets/kits/firewall-nat/integration.md + visibility: operator + artifact_id: integration-material +- source: assets/seed.yaml + target: assets/kits/firewall-nat/seed.yaml + visibility: operator + artifact_id: seed-profile +resources: + cpu_cores: 2 + memory_mib: 2048 + storage_mib: 4096 + notes: Planning estimates only; realization sizing remains backend-owned. +prerequisites: [] +limitations: +- Declares static infrastructure and seeded state only; no launch, readiness, traffic attachment, + or runtime evidence is claimed. +- nftables has no application listener; policy ports do not claim forwarding or NAT enforcement. +license: + expression: MIT + redistribution: open + attribution: OpenRAE contributors +tests: +- path: tests/composition.yaml + kind: validate +- path: tests/composition.yaml + kind: parameter-variation +- path: tests/composition.yaml + kind: multi-kit +component_inventory: +- scope: unresolved + authority: raes-source + ref: /nodes/firewall/source + description: RAES carries the declared nftables source; immutable artifact selection remains + unresolved until pack publication. +associated_artifact_manifest: associated-artifacts.json diff --git a/kits/infrastructure.firewall-nat/1.0.0/module.sdl.yaml b/kits/infrastructure.firewall-nat/1.0.0/module.sdl.yaml new file mode 100644 index 0000000..fe5110b --- /dev/null +++ b/kits/infrastructure.firewall-nat/1.0.0/module.sdl.yaml @@ -0,0 +1,78 @@ +name: firewall-nat +version: 1.0.0 +description: Reusable static infrastructure for Firewall / NAT. +module: + id: infrastructure/firewall-nat + version: 1.0.0 + parameters: + - deployment_profile + - service_label + - ruleset_name + exports: + nodes: + - firewall + content: + - seed_inventory + description: Composable Firewall / NAT infrastructure module. +variables: + deployment_profile: + type: string + default: standard + allowed_values: + - compact + - standard + service_label: + type: string + default: firewall-nat + ruleset_name: + type: string + default: edge-filter +nodes: + firewall: + type: compute + description: '${deployment_profile} profile for ${service_label} (Firewall / NAT). ruleset_name: + ${ruleset_name}.' + source: + name: nftables + version: stable + resources: + cpu: 2 + ram: 2 GiB +content: + seed_inventory: + type: dataset + target: firewall + description: Benign firewall / nat seed inventory for ${ruleset_name}. + items: + - name: filter_chains + display_name: Filter Chains + tags: + - infrastructure + - seed + description: Named packet-filter chain inventory. + - name: allowed_ports + display_name: Allowed Ports + tags: + - infrastructure + - seed + description: Example TCP policy ports 80 and 443; these are not daemon listeners. + - name: nat_policy + display_name: Nat Policy + tags: + - infrastructure + - seed + description: Named address-translation policy inventory. + - name: forwarding_rules + display_name: Forwarding Rules + tags: + - infrastructure + - seed + description: Named forwarding-rule inventory for a consuming network. +realization: + constraints: + - field_pointer: /nodes/firewall + concern: compute-substrate + posture: exact + domain: + kind: exact + value: virtual-machine diff --git a/kits/infrastructure.firewall-nat/1.0.0/tests/composition.yaml b/kits/infrastructure.firewall-nat/1.0.0/tests/composition.yaml new file mode 100644 index 0000000..eacd91b --- /dev/null +++ b/kits/infrastructure.firewall-nat/1.0.0/tests/composition.yaml @@ -0,0 +1,9 @@ +default: + deployment_profile: standard + service_label: firewall-nat + ruleset_name: edge-filter +variation: + deployment_profile: compact + service_label: firewall-nat-alternate + ruleset_name: internal-filter +multi_kit_group: network-shared diff --git a/kits/infrastructure.ldap-directory/1.0.0/README.md b/kits/infrastructure.ldap-directory/1.0.0/README.md new file mode 100644 index 0000000..1ece1f4 --- /dev/null +++ b/kits/infrastructure.ldap-directory/1.0.0/README.md @@ -0,0 +1,13 @@ +# LDAP directory + +Reusable ldap directory authoring content using the RAES module `infrastructure/ldap-directory` and declared `openldap` source. + +The module exports `nodes.directory` and `content.seed_inventory`. Its `directory_suffix` parameter varies the declared inventory without changing those identities. + +Declared service surface: + +- ldap: 389/tcp — LDAP client endpoint. + +The seed inventory names base_dn, organizational_units, groups, entries. Connect non-AD directory consumers at the pack root and provide bind credentials separately. + +This release is static authoring content. The consuming pack and backend own relationships, credential delivery, launch, configuration, and any runtime evidence. diff --git a/kits/infrastructure.ldap-directory/1.0.0/assets/integration.md b/kits/infrastructure.ldap-directory/1.0.0/assets/integration.md new file mode 100644 index 0000000..fa8ef52 --- /dev/null +++ b/kits/infrastructure.ldap-directory/1.0.0/assets/integration.md @@ -0,0 +1,14 @@ +# LDAP directory integration material + +Author parameter: `directory_suffix` (default `dc=example,dc=test`). + +## Exported RAES declarations + +- `nodes.directory` +- `content.seed_inventory` + +## Composition notes + +- Connect non-AD directory consumers at the pack root and provide bind credentials separately. +- Keep credentials, private keys, and runtime-selected endpoints outside kit parameters and seed assets. +- Validate the completed ordinary pack after adding pack-level relationships. diff --git a/kits/infrastructure.ldap-directory/1.0.0/assets/seed.yaml b/kits/infrastructure.ldap-directory/1.0.0/assets/seed.yaml new file mode 100644 index 0000000..cbc83eb --- /dev/null +++ b/kits/infrastructure.ldap-directory/1.0.0/assets/seed.yaml @@ -0,0 +1,21 @@ +schema_version: environment-kit-seed/v1 +kit: infrastructure.ldap-directory +configuration: + directory_suffix: dc=example,dc=test + deployment_profile: standard + service_label: ldap-directory +declared_objects: +- id: base_dn + kind: infrastructure-seed + sensitivity: non-secret +- id: organizational_units + kind: infrastructure-seed + sensitivity: non-secret +- id: groups + kind: infrastructure-seed + sensitivity: non-secret +- id: entries + kind: infrastructure-seed + sensitivity: non-secret +integration_requirements: +- Connect non-AD directory consumers at the pack root and provide bind credentials separately. diff --git a/kits/infrastructure.ldap-directory/1.0.0/associated-artifacts.json b/kits/infrastructure.ldap-directory/1.0.0/associated-artifacts.json new file mode 100644 index 0000000..d05fc39 --- /dev/null +++ b/kits/infrastructure.ldap-directory/1.0.0/associated-artifacts.json @@ -0,0 +1,113 @@ +{ + "schema_version": "associated-artifact-manifest/v1", + "manifest_id": "infrastructure.ldap-directory-associated-artifacts", + "manifest_version": "1.0.0", + "canonicalization_profile": "associated-artifact-set/v1", + "scope": "scenario", + "parent_ref": { + "ref_kind": "scenario-snapshot", + "ref_id": "ldap-directory", + "ref_version": null, + "ref_digest": "sha256:5f90a8d299b5c03676d824651e63cd47e3f1622cd98c9ec5d1510580857b962e", + "ref_path": null + }, + "artifacts": { + "readme": { + "artifact_id": "readme", + "role": "documentation", + "media_type": "text/markdown", + "uri": "raes-environment-kit:/README.md", + "checksum": { + "algorithm": "sha256", + "value": "03b1ec6e2b9f02f696c687ce0b770c54f053346a3ec5340c16589f2df8129be7" + }, + "size_bytes": 712, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.ldap-directory@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "integration-material": { + "artifact_id": "integration-material", + "role": "operator-guide", + "media_type": "text/markdown", + "uri": "raes-environment-kit:/assets/integration.md", + "checksum": { + "algorithm": "sha256", + "value": "492dc39c7b9ed97ee3626d982677e229c75afa9279c859d5e9084dbe2eb836de" + }, + "size_bytes": 488, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.ldap-directory@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "seed-profile": { + "artifact_id": "seed-profile", + "role": "configuration", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/assets/seed.yaml", + "checksum": { + "algorithm": "sha256", + "value": "11e87ca53d3021bf332b0ec3a2ad00febcbc1c3fa916a46795fe6630fb0163a4" + }, + "size_bytes": 615, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.ldap-directory@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "kit-manifest": { + "artifact_id": "kit-manifest", + "role": "manifest", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/kit.yaml", + "checksum": { + "algorithm": "sha256", + "value": "b47782ee500a6d642617b4e5c72f58286c396e874275889e882053880f0768fa" + }, + "size_bytes": 1573, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.ldap-directory@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "module": { + "artifact_id": "module", + "role": "configuration", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/module.sdl.yaml", + "checksum": { + "algorithm": "sha256", + "value": "542f1de6d32bf41f493f9648aebab286700a8ca40d33bb46e77024c320cc1b8c" + }, + "size_bytes": 1986, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.ldap-directory@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "composition-tests": { + "artifact_id": "composition-tests", + "role": "configuration", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/tests/composition.yaml", + "checksum": { + "algorithm": "sha256", + "value": "27d25bdb17be9f68dd40645e2d20fc54df25220db8de2a92d0922c34528955a5" + }, + "size_bytes": 267, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.ldap-directory@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + } + }, + "set_digest": "sha256:60da28a7817996fce02b45a31678a9d30bdcdcd427c866d54a2314ed60df02d8" +} diff --git a/kits/infrastructure.ldap-directory/1.0.0/kit.yaml b/kits/infrastructure.ldap-directory/1.0.0/kit.yaml new file mode 100644 index 0000000..78f6904 --- /dev/null +++ b/kits/infrastructure.ldap-directory/1.0.0/kit.yaml @@ -0,0 +1,47 @@ +schema_version: environment-pack-kit/v1 +id: infrastructure.ldap-directory +version: 1.0.0 +title: LDAP directory +summary: Reusable ldap directory with a declared software source, service or policy surfaces, + benign seed inventory, and pack-local integration material. +concern: identity-domain +released_at: '2026-09-20T00:00:00Z' +module: + path: module.sdl.yaml +assets: +- source: assets/integration.md + target: assets/kits/ldap-directory/integration.md + visibility: operator + artifact_id: integration-material +- source: assets/seed.yaml + target: assets/kits/ldap-directory/seed.yaml + visibility: operator + artifact_id: seed-profile +resources: + cpu_cores: 2 + memory_mib: 2048 + storage_mib: 4096 + notes: Planning estimates only; realization sizing remains backend-owned. +prerequisites: [] +limitations: +- Declares static infrastructure and seeded state only; no launch, readiness, traffic attachment, + or runtime evidence is claimed. +- No Active Directory forest/controller semantics, bind passwords, or LDAPS listener is implied. +license: + expression: MIT + redistribution: open + attribution: OpenRAE contributors +tests: +- path: tests/composition.yaml + kind: validate +- path: tests/composition.yaml + kind: parameter-variation +- path: tests/composition.yaml + kind: multi-kit +component_inventory: +- scope: unresolved + authority: raes-source + ref: /nodes/directory/source + description: RAES carries the declared openldap source; immutable artifact selection remains + unresolved until pack publication. +associated_artifact_manifest: associated-artifacts.json diff --git a/kits/infrastructure.ldap-directory/1.0.0/module.sdl.yaml b/kits/infrastructure.ldap-directory/1.0.0/module.sdl.yaml new file mode 100644 index 0000000..bd5a8d9 --- /dev/null +++ b/kits/infrastructure.ldap-directory/1.0.0/module.sdl.yaml @@ -0,0 +1,83 @@ +name: ldap-directory +version: 1.0.0 +description: Reusable static infrastructure for LDAP directory. +module: + id: infrastructure/ldap-directory + version: 1.0.0 + parameters: + - deployment_profile + - service_label + - directory_suffix + exports: + nodes: + - directory + content: + - seed_inventory + description: Composable LDAP directory infrastructure module. +variables: + deployment_profile: + type: string + default: standard + allowed_values: + - compact + - standard + service_label: + type: string + default: ldap-directory + directory_suffix: + type: string + default: dc=example,dc=test +nodes: + directory: + type: compute + description: '${deployment_profile} profile for ${service_label} (LDAP directory). directory_suffix: + ${directory_suffix}.' + source: + name: openldap + version: stable + resources: + cpu: 2 + ram: 2 GiB + services: + - name: ldap + port: 389 + protocol: tcp + description: LDAP client endpoint +content: + seed_inventory: + type: dataset + target: directory + description: Benign ldap directory seed inventory for ${directory_suffix}. + items: + - name: base_dn + display_name: Base Dn + tags: + - infrastructure + - seed + description: Directory suffix and base distinguished-name inventory. + - name: organizational_units + display_name: Organizational Units + tags: + - infrastructure + - seed + description: Named organizational unit inventory. + - name: groups + display_name: Groups + tags: + - infrastructure + - seed + description: Non-secret group-name inventory. + - name: entries + display_name: Entries + tags: + - infrastructure + - seed + description: Benign directory-entry identity inventory. +realization: + constraints: + - field_pointer: /nodes/directory + concern: compute-substrate + posture: exact + domain: + kind: exact + value: virtual-machine diff --git a/kits/infrastructure.ldap-directory/1.0.0/tests/composition.yaml b/kits/infrastructure.ldap-directory/1.0.0/tests/composition.yaml new file mode 100644 index 0000000..0a99f4c --- /dev/null +++ b/kits/infrastructure.ldap-directory/1.0.0/tests/composition.yaml @@ -0,0 +1,9 @@ +default: + deployment_profile: standard + service_label: ldap-directory + directory_suffix: dc=example,dc=test +variation: + deployment_profile: compact + service_label: ldap-directory-alternate + directory_suffix: dc=training,dc=test +multi_kit_group: identity-domain diff --git a/kits/infrastructure.message-broker/1.0.0/README.md b/kits/infrastructure.message-broker/1.0.0/README.md new file mode 100644 index 0000000..dc6d2c7 --- /dev/null +++ b/kits/infrastructure.message-broker/1.0.0/README.md @@ -0,0 +1,13 @@ +# Message broker + +Reusable message broker authoring content using the RAES module `infrastructure/message-broker` and declared `rabbitmq` source. + +The module exports `nodes.broker` and `content.seed_inventory`. Its `virtual_host` parameter varies the declared inventory without changing those identities. + +Declared service surface: + +- amqp: 5672/tcp — AMQP client endpoint. + +The seed inventory names virtual_host, exchange, queue, binding. Connect publishers and consumers to the broker at the pack root; provide credentials separately. + +This release is static authoring content. The consuming pack and backend own relationships, credential delivery, launch, configuration, and any runtime evidence. diff --git a/kits/infrastructure.message-broker/1.0.0/assets/integration.md b/kits/infrastructure.message-broker/1.0.0/assets/integration.md new file mode 100644 index 0000000..d550bf9 --- /dev/null +++ b/kits/infrastructure.message-broker/1.0.0/assets/integration.md @@ -0,0 +1,14 @@ +# Message broker integration material + +Author parameter: `virtual_host` (default `lab`). + +## Exported RAES declarations + +- `nodes.broker` +- `content.seed_inventory` + +## Composition notes + +- Connect publishers and consumers to the broker at the pack root; provide credentials separately. +- Keep credentials, private keys, and runtime-selected endpoints outside kit parameters and seed assets. +- Validate the completed ordinary pack after adding pack-level relationships. diff --git a/kits/infrastructure.message-broker/1.0.0/assets/seed.yaml b/kits/infrastructure.message-broker/1.0.0/assets/seed.yaml new file mode 100644 index 0000000..eb4b77b --- /dev/null +++ b/kits/infrastructure.message-broker/1.0.0/assets/seed.yaml @@ -0,0 +1,21 @@ +schema_version: environment-kit-seed/v1 +kit: infrastructure.message-broker +configuration: + virtual_host: lab + deployment_profile: standard + service_label: message-broker +declared_objects: +- id: virtual_host + kind: infrastructure-seed + sensitivity: non-secret +- id: exchange + kind: infrastructure-seed + sensitivity: non-secret +- id: queue + kind: infrastructure-seed + sensitivity: non-secret +- id: binding + kind: infrastructure-seed + sensitivity: non-secret +integration_requirements: +- Connect publishers and consumers to the broker at the pack root; provide credentials separately. diff --git a/kits/infrastructure.message-broker/1.0.0/associated-artifacts.json b/kits/infrastructure.message-broker/1.0.0/associated-artifacts.json new file mode 100644 index 0000000..cebf577 --- /dev/null +++ b/kits/infrastructure.message-broker/1.0.0/associated-artifacts.json @@ -0,0 +1,113 @@ +{ + "schema_version": "associated-artifact-manifest/v1", + "manifest_id": "infrastructure.message-broker-associated-artifacts", + "manifest_version": "1.0.0", + "canonicalization_profile": "associated-artifact-set/v1", + "scope": "scenario", + "parent_ref": { + "ref_kind": "scenario-snapshot", + "ref_id": "message-broker", + "ref_version": null, + "ref_digest": "sha256:81bf0b8e831b64ddbbc056b7e65c372415eafd6da700ca908975026fc7d528f5", + "ref_path": null + }, + "artifacts": { + "readme": { + "artifact_id": "readme", + "role": "documentation", + "media_type": "text/markdown", + "uri": "raes-environment-kit:/README.md", + "checksum": { + "algorithm": "sha256", + "value": "405cdc30e541ae6e518edd5e77ad1f6465261e450c3dc5a26ab5300aa3fe07d4" + }, + "size_bytes": 702, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.message-broker@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "integration-material": { + "artifact_id": "integration-material", + "role": "operator-guide", + "media_type": "text/markdown", + "uri": "raes-environment-kit:/assets/integration.md", + "checksum": { + "algorithm": "sha256", + "value": "63dbf27ff2af8263b374d17227e053594eb22b319e6b143d4efa0ea0715b4e0e" + }, + "size_bytes": 470, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.message-broker@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "seed-profile": { + "artifact_id": "seed-profile", + "role": "configuration", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/assets/seed.yaml", + "checksum": { + "algorithm": "sha256", + "value": "fc2ad27d3989f07d3aa4cc94d09228582d995b282f45a4d85489967cb72e2dd1" + }, + "size_bytes": 592, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.message-broker@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "kit-manifest": { + "artifact_id": "kit-manifest", + "role": "manifest", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/kit.yaml", + "checksum": { + "algorithm": "sha256", + "value": "0a9db21d74a6e7f8ba2e4d3dd580f09862211ceb2cf105eb7de25061bf23499b" + }, + "size_bytes": 1543, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.message-broker@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "module": { + "artifact_id": "module", + "role": "configuration", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/module.sdl.yaml", + "checksum": { + "algorithm": "sha256", + "value": "7b1836e4a80485dc54dd63d0cb4769e196f65eb5b54289ac2ec27afa541b4554" + }, + "size_bytes": 1904, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.message-broker@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "composition-tests": { + "artifact_id": "composition-tests", + "role": "configuration", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/tests/composition.yaml", + "checksum": { + "algorithm": "sha256", + "value": "3d4836cc3ea18fed74d968a4318e1cb17be98e40fff2590347297b55238b585f" + }, + "size_bytes": 231, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.message-broker@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + } + }, + "set_digest": "sha256:4da9c2b67d60d5cff619dfc20fe9f9d84717b3d533b77fc3eaee32def935ab27" +} diff --git a/kits/infrastructure.message-broker/1.0.0/kit.yaml b/kits/infrastructure.message-broker/1.0.0/kit.yaml new file mode 100644 index 0000000..de6dd32 --- /dev/null +++ b/kits/infrastructure.message-broker/1.0.0/kit.yaml @@ -0,0 +1,47 @@ +schema_version: environment-pack-kit/v1 +id: infrastructure.message-broker +version: 1.0.0 +title: Message broker +summary: Reusable message broker with a declared software source, service or policy surfaces, + benign seed inventory, and pack-local integration material. +concern: data-workflow +released_at: '2026-09-20T00:00:00Z' +module: + path: module.sdl.yaml +assets: +- source: assets/integration.md + target: assets/kits/message-broker/integration.md + visibility: operator + artifact_id: integration-material +- source: assets/seed.yaml + target: assets/kits/message-broker/seed.yaml + visibility: operator + artifact_id: seed-profile +resources: + cpu_cores: 2 + memory_mib: 2048 + storage_mib: 4096 + notes: Planning estimates only; realization sizing remains backend-owned. +prerequisites: [] +limitations: +- Declares static infrastructure and seeded state only; no launch, readiness, traffic attachment, + or runtime evidence is claimed. +- Management plugin, clustering, and message delivery are not asserted. +license: + expression: MIT + redistribution: open + attribution: OpenRAE contributors +tests: +- path: tests/composition.yaml + kind: validate +- path: tests/composition.yaml + kind: parameter-variation +- path: tests/composition.yaml + kind: multi-kit +component_inventory: +- scope: unresolved + authority: raes-source + ref: /nodes/broker/source + description: RAES carries the declared rabbitmq source; immutable artifact selection remains + unresolved until pack publication. +associated_artifact_manifest: associated-artifacts.json diff --git a/kits/infrastructure.message-broker/1.0.0/module.sdl.yaml b/kits/infrastructure.message-broker/1.0.0/module.sdl.yaml new file mode 100644 index 0000000..722f675 --- /dev/null +++ b/kits/infrastructure.message-broker/1.0.0/module.sdl.yaml @@ -0,0 +1,83 @@ +name: message-broker +version: 1.0.0 +description: Reusable static infrastructure for Message broker. +module: + id: infrastructure/message-broker + version: 1.0.0 + parameters: + - deployment_profile + - service_label + - virtual_host + exports: + nodes: + - broker + content: + - seed_inventory + description: Composable Message broker infrastructure module. +variables: + deployment_profile: + type: string + default: standard + allowed_values: + - compact + - standard + service_label: + type: string + default: message-broker + virtual_host: + type: string + default: lab +nodes: + broker: + type: compute + description: '${deployment_profile} profile for ${service_label} (Message broker). virtual_host: + ${virtual_host}.' + source: + name: rabbitmq + version: stable + resources: + cpu: 2 + ram: 2 GiB + services: + - name: amqp + port: 5672 + protocol: tcp + description: AMQP client endpoint +content: + seed_inventory: + type: dataset + target: broker + description: Benign message broker seed inventory for ${virtual_host}. + items: + - name: virtual_host + display_name: Virtual Host + tags: + - infrastructure + - seed + description: Named virtual host for broker isolation. + - name: exchange + display_name: Exchange + tags: + - infrastructure + - seed + description: Declared exchange-name inventory. + - name: queue + display_name: Queue + tags: + - infrastructure + - seed + description: Declared queue-name inventory. + - name: binding + display_name: Binding + tags: + - infrastructure + - seed + description: Named exchange-to-queue binding inventory. +realization: + constraints: + - field_pointer: /nodes/broker + concern: compute-substrate + posture: exact + domain: + kind: exact + value: virtual-machine diff --git a/kits/infrastructure.message-broker/1.0.0/tests/composition.yaml b/kits/infrastructure.message-broker/1.0.0/tests/composition.yaml new file mode 100644 index 0000000..b963578 --- /dev/null +++ b/kits/infrastructure.message-broker/1.0.0/tests/composition.yaml @@ -0,0 +1,9 @@ +default: + deployment_profile: standard + service_label: message-broker + virtual_host: lab +variation: + deployment_profile: compact + service_label: message-broker-alternate + virtual_host: training +multi_kit_group: data-workflow diff --git a/kits/infrastructure.secrets-store/1.0.0/README.md b/kits/infrastructure.secrets-store/1.0.0/README.md new file mode 100644 index 0000000..07ec63e --- /dev/null +++ b/kits/infrastructure.secrets-store/1.0.0/README.md @@ -0,0 +1,13 @@ +# Secrets store + +Reusable secrets store authoring content using the RAES module `infrastructure/secrets-store` and declared `openbao` source. + +The module exports `nodes.secrets_store` and `content.seed_inventory`. Its `mount_path` parameter varies the declared inventory without changing those identities. + +Declared service surface: + +- api: 8200/tcp — OpenBao client API endpoint. + +The seed inventory names secret_engine_mount, access_policy, auth_method, audit_profile. Bind applications and identities at the pack root; provide unseal material and credentials outside this kit. + +This release is static authoring content. The consuming pack and backend own relationships, credential delivery, launch, configuration, and any runtime evidence. diff --git a/kits/infrastructure.secrets-store/1.0.0/assets/integration.md b/kits/infrastructure.secrets-store/1.0.0/assets/integration.md new file mode 100644 index 0000000..88db55d --- /dev/null +++ b/kits/infrastructure.secrets-store/1.0.0/assets/integration.md @@ -0,0 +1,14 @@ +# Secrets store integration material + +Author parameter: `mount_path` (default `kv`). + +## Exported RAES declarations + +- `nodes.secrets_store` +- `content.seed_inventory` + +## Composition notes + +- Bind applications and identities at the pack root; provide unseal material and credentials outside this kit. +- Keep credentials, private keys, and runtime-selected endpoints outside kit parameters and seed assets. +- Validate the completed ordinary pack after adding pack-level relationships. diff --git a/kits/infrastructure.secrets-store/1.0.0/assets/seed.yaml b/kits/infrastructure.secrets-store/1.0.0/assets/seed.yaml new file mode 100644 index 0000000..8bc2d89 --- /dev/null +++ b/kits/infrastructure.secrets-store/1.0.0/assets/seed.yaml @@ -0,0 +1,22 @@ +schema_version: environment-kit-seed/v1 +kit: infrastructure.secrets-store +configuration: + mount_path: kv + deployment_profile: standard + service_label: secrets-store +declared_objects: +- id: secret_engine_mount + kind: infrastructure-seed + sensitivity: non-secret +- id: access_policy + kind: infrastructure-seed + sensitivity: non-secret +- id: auth_method + kind: infrastructure-seed + sensitivity: non-secret +- id: audit_profile + kind: infrastructure-seed + sensitivity: non-secret +integration_requirements: +- Bind applications and identities at the pack root; provide unseal material and credentials + outside this kit. diff --git a/kits/infrastructure.secrets-store/1.0.0/associated-artifacts.json b/kits/infrastructure.secrets-store/1.0.0/associated-artifacts.json new file mode 100644 index 0000000..5bc8612 --- /dev/null +++ b/kits/infrastructure.secrets-store/1.0.0/associated-artifacts.json @@ -0,0 +1,113 @@ +{ + "schema_version": "associated-artifact-manifest/v1", + "manifest_id": "infrastructure.secrets-store-associated-artifacts", + "manifest_version": "1.0.0", + "canonicalization_profile": "associated-artifact-set/v1", + "scope": "scenario", + "parent_ref": { + "ref_kind": "scenario-snapshot", + "ref_id": "secrets-store", + "ref_version": null, + "ref_digest": "sha256:d27e1141a41408b858165ae28eb2b82ce5f2b69af6b1e3afaef41522b8b70979", + "ref_path": null + }, + "artifacts": { + "readme": { + "artifact_id": "readme", + "role": "documentation", + "media_type": "text/markdown", + "uri": "raes-environment-kit:/README.md", + "checksum": { + "algorithm": "sha256", + "value": "672eef6a378c4540ed4c1971a75eac580c0f97927938c2bde5176b8338a491af" + }, + "size_bytes": 745, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.secrets-store@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "integration-material": { + "artifact_id": "integration-material", + "role": "operator-guide", + "media_type": "text/markdown", + "uri": "raes-environment-kit:/assets/integration.md", + "checksum": { + "algorithm": "sha256", + "value": "7f478ace4d3ae57e5b029801d830666926ba690dcadd935e0817d1bd8effea7e" + }, + "size_bytes": 485, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.secrets-store@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "seed-profile": { + "artifact_id": "seed-profile", + "role": "configuration", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/assets/seed.yaml", + "checksum": { + "algorithm": "sha256", + "value": "2bf4dd47fa3c8c0541f636671f021ae240dab64e9e44c6e8ee59b0703122f93e" + }, + "size_bytes": 625, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.secrets-store@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "kit-manifest": { + "artifact_id": "kit-manifest", + "role": "manifest", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/kit.yaml", + "checksum": { + "algorithm": "sha256", + "value": "bd7965ac117848ef62fbbe37ce33ad7b562a3376a253b3d03338be0f5d9a87f9" + }, + "size_bytes": 1570, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.secrets-store@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "module": { + "artifact_id": "module", + "role": "configuration", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/module.sdl.yaml", + "checksum": { + "algorithm": "sha256", + "value": "e1c6ecc7aa002159f3679e5a60580a9be613b9747fa6cf27fd3c6e6b78859b50" + }, + "size_bytes": 2040, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.secrets-store@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + }, + "composition-tests": { + "artifact_id": "composition-tests", + "role": "configuration", + "media_type": "application/yaml", + "uri": "raes-environment-kit:/tests/composition.yaml", + "checksum": { + "algorithm": "sha256", + "value": "daddad33a4a088d2c95debcd9cddb8e9d85d87119b9ce9903cb0b4f5e451209f" + }, + "size_bytes": 232, + "created_at": "2026-09-20T00:00:00Z", + "source": "infrastructure.secrets-store@1.0.0", + "satisfies_refs": [], + "sensitivity": "public", + "description": null + } + }, + "set_digest": "sha256:f16a460b7419ffc9f17900591bf8b6f4c7af393b187e45ccc1a0407b897918b3" +} diff --git a/kits/infrastructure.secrets-store/1.0.0/kit.yaml b/kits/infrastructure.secrets-store/1.0.0/kit.yaml new file mode 100644 index 0000000..a7345a6 --- /dev/null +++ b/kits/infrastructure.secrets-store/1.0.0/kit.yaml @@ -0,0 +1,47 @@ +schema_version: environment-pack-kit/v1 +id: infrastructure.secrets-store +version: 1.0.0 +title: Secrets store +summary: Reusable secrets store with a declared software source, service or policy surfaces, + benign seed inventory, and pack-local integration material. +concern: policy-operations +released_at: '2026-09-20T00:00:00Z' +module: + path: module.sdl.yaml +assets: +- source: assets/integration.md + target: assets/kits/secrets-store/integration.md + visibility: operator + artifact_id: integration-material +- source: assets/seed.yaml + target: assets/kits/secrets-store/seed.yaml + visibility: operator + artifact_id: seed-profile +resources: + cpu_cores: 2 + memory_mib: 2048 + storage_mib: 4096 + notes: Planning estimates only; realization sizing remains backend-owned. +prerequisites: [] +limitations: +- Declares static infrastructure and seeded state only; no launch, readiness, traffic attachment, + or runtime evidence is claimed. +- No stored secret value, unseal material, bootstrap token, or cluster membership is bundled. +license: + expression: MIT + redistribution: open + attribution: OpenRAE contributors +tests: +- path: tests/composition.yaml + kind: validate +- path: tests/composition.yaml + kind: parameter-variation +- path: tests/composition.yaml + kind: multi-kit +component_inventory: +- scope: unresolved + authority: raes-source + ref: /nodes/secrets_store/source + description: RAES carries the declared openbao source; immutable artifact selection remains + unresolved until pack publication. +associated_artifact_manifest: associated-artifacts.json diff --git a/kits/infrastructure.secrets-store/1.0.0/module.sdl.yaml b/kits/infrastructure.secrets-store/1.0.0/module.sdl.yaml new file mode 100644 index 0000000..9d11cd1 --- /dev/null +++ b/kits/infrastructure.secrets-store/1.0.0/module.sdl.yaml @@ -0,0 +1,83 @@ +name: secrets-store +version: 1.0.0 +description: Reusable static infrastructure for Secrets store. +module: + id: infrastructure/secrets-store + version: 1.0.0 + parameters: + - deployment_profile + - service_label + - mount_path + exports: + nodes: + - secrets_store + content: + - seed_inventory + description: Composable Secrets store infrastructure module. +variables: + deployment_profile: + type: string + default: standard + allowed_values: + - compact + - standard + service_label: + type: string + default: secrets-store + mount_path: + type: string + default: kv +nodes: + secrets_store: + type: compute + description: '${deployment_profile} profile for ${service_label} (Secrets store). mount_path: + ${mount_path}.' + source: + name: openbao + version: stable + resources: + cpu: 2 + ram: 2 GiB + services: + - name: api + port: 8200 + protocol: tcp + description: OpenBao client API endpoint +content: + seed_inventory: + type: dataset + target: secrets_store + description: Benign secrets store seed inventory for ${mount_path}. + items: + - name: secret_engine_mount + display_name: Secret Engine Mount + tags: + - infrastructure + - seed + description: Named secret-engine mount, without stored secret values. + - name: access_policy + display_name: Access Policy + tags: + - infrastructure + - seed + description: Policy-name inventory for intended consumers. + - name: auth_method + display_name: Auth Method + tags: + - infrastructure + - seed + description: Authentication-method identity without bootstrap credentials. + - name: audit_profile + display_name: Audit Profile + tags: + - infrastructure + - seed + description: Audit-device selection inventory without emitted events. +realization: + constraints: + - field_pointer: /nodes/secrets_store + concern: compute-substrate + posture: exact + domain: + kind: exact + value: virtual-machine diff --git a/kits/infrastructure.secrets-store/1.0.0/tests/composition.yaml b/kits/infrastructure.secrets-store/1.0.0/tests/composition.yaml new file mode 100644 index 0000000..1cf162d --- /dev/null +++ b/kits/infrastructure.secrets-store/1.0.0/tests/composition.yaml @@ -0,0 +1,9 @@ +default: + deployment_profile: standard + service_label: secrets-store + mount_path: kv +variation: + deployment_profile: compact + service_label: secrets-store-alternate + mount_path: applications +multi_kit_group: policy-operations diff --git a/tests/test_published_kits.py b/tests/test_published_kits.py index 45441d8..25f30cc 100644 --- a/tests/test_published_kits.py +++ b/tests/test_published_kits.py @@ -14,10 +14,82 @@ ROOT = Path(__file__).resolve().parents[1] -EXPECTED_KIT_COUNT = 38 +EXPECTED_KIT_COUNT = 46 + +ISSUE_225_KITS = { + "certificate-authority": ( + "ca", "step-ca", "authority_name", ("https", 9000, "tcp"), "provisioner" + ), + "dhcp-ipam-service": ( + "dhcp", "kea", "address_pool", ("dhcp4", 67, "udp"), "address_pool" + ), + "secrets-store": ( + "secrets_store", "openbao", "mount_path", ("api", 8200, "tcp"), + "secret_engine_mount", + ), + "message-broker": ( + "broker", "rabbitmq", "virtual_host", ("amqp", 5672, "tcp"), "exchange" + ), + "cache-key-value-store": ( + "cache", "valkey", "key_prefix", ("resp", 6379, "tcp"), + "eviction_policy", + ), + "firewall-nat": ("firewall", "nftables", "ruleset_name", None, "allowed_ports"), + "ldap-directory": ( + "directory", "openldap", "directory_suffix", ("ldap", 389, "tcp"), + "organizational_units", + ), + "container-orchestration": ( + "orchestrator", "k3s", "cluster_name", ("api", 6443, "tcp"), + "namespace", + ), +} class PublishedKitTests(unittest.TestCase): + def test_issue_225_kits_have_accurate_static_surfaces(self) -> None: + for slug, facts in ISSUE_225_KITS.items(): + node_id, source, parameter, listener, seed_item = facts + kit_id = f"infrastructure.{slug}" + with self.subTest(kit=kit_id): + root = ROOT / "kits" / kit_id / "1.0.0" + release = load_kit_release(root) + module = yaml.safe_load( + (root / "module.sdl.yaml").read_text(encoding="utf-8") + ) + self.assertEqual(release.id, kit_id) + self.assertEqual(module["nodes"][node_id]["source"]["name"], source) + self.assertIn(parameter, module["module"]["parameters"]) + self.assertEqual(module["content"]["seed_inventory"]["target"], node_id) + self.assertIn( + seed_item, + {item["name"] for item in module["content"]["seed_inventory"]["items"]}, + ) + services = module["nodes"][node_id].get("services", []) + actual = {(item["name"], item["port"], item["protocol"]) for item in services} + if listener is None: + self.assertFalse(actual, "nftables policy ports are not daemon listeners") + seed = yaml.safe_load( + (root / "assets/seed.yaml").read_text(encoding="utf-8") + ) + self.assertEqual(seed["configuration"]["policy_ports"], [80, 443]) + else: + self.assertIn(listener, actual) + + proxy = yaml.safe_load( + (ROOT / "kits/infrastructure.reverse-proxy-api-gateway/1.0.0/module.sdl.yaml") + .read_text(encoding="utf-8") + ) + self.assertEqual(proxy["nodes"]["gateway"]["source"]["name"], "traefik") + self.assertEqual( + {item["port"] for item in proxy["nodes"]["gateway"]["services"]}, + {80, 443}, + ) + self.assertIn( + "upstream_bindings", + {item["name"] for item in proxy["content"]["seed_inventory"]["items"]}, + ) + def test_all_releases_are_discoverable_and_deterministic(self) -> None: source = KitSource( id="openrae-env-packs", @@ -106,6 +178,7 @@ def test_representative_multi_kit_environment_composes(self) -> None: "infrastructure.postgresql-database", "infrastructure.wazuh-security-monitoring-stack", "infrastructure.telemetry-collector", + *(f"infrastructure.{slug}" for slug in ISSUE_225_KITS), ] with tempfile.TemporaryDirectory() as tmp: root = Path(tmp) @@ -135,7 +208,7 @@ def test_representative_multi_kit_environment_composes(self) -> None: scenario = parse_sdl_file( root / "scenario.sdl.yaml", migration_policy="accept" ) - self.assertGreaterEqual(len(scenario.nodes), 9) + self.assertGreaterEqual(len(scenario.nodes), 17) if __name__ == "__main__": diff --git a/tests_integration/kit_author_walkthrough.py b/tests_integration/kit_author_walkthrough.py index 91a1c14..96cd0ec 100644 --- a/tests_integration/kit_author_walkthrough.py +++ b/tests_integration/kit_author_walkthrough.py @@ -130,7 +130,7 @@ def _walk(result: Result, catalog: Path, revision: str, workspace: Path) -> None listed = _kit(["list", *_source(catalog, revision), "--json"]) result.command("catalog listed", listed) entries = _json(listed) - result.check("all initial releases are discoverable", isinstance(entries, list) and len(entries) == 38) + result.check("all releases are discoverable", isinstance(entries, list) and len(entries) == 46) searched = _kit(["search", *_source(catalog, revision), "domain controller", "--json"]) result.command("catalog searched", searched) result.check("search returns identity infrastructure", bool(_json(searched)))