185 lines
7.2 KiB
JSON
185 lines
7.2 KiB
JSON
{
|
|
"artifact": "teleo_gcp_service_communication_contract",
|
|
"schema_version": 1,
|
|
"project": "teleo-501523",
|
|
"region": "europe-west6",
|
|
"network": "teleo-staging-net",
|
|
"global_invariants": {
|
|
"no_public_database_ip": true,
|
|
"no_broad_ssh_or_rdp": true,
|
|
"no_default_compute_service_accounts": true,
|
|
"secret_values_not_stored_in_contract": true,
|
|
"database_connections_encrypted_only": true
|
|
},
|
|
"allowed_paths": [
|
|
{
|
|
"name": "github_actions_to_artifact_registry",
|
|
"purpose": "Build, smoke-run, and push Teleo staging Docker image.",
|
|
"source": {
|
|
"type": "github_actions_wif",
|
|
"repository": "living-ip/teleo-infrastructure"
|
|
},
|
|
"identity": "sa-artifact-builder@teleo-501523.iam.gserviceaccount.com",
|
|
"target": {
|
|
"type": "artifact_registry",
|
|
"repository": "projects/teleo-501523/locations/europe-west6/repositories/teleo"
|
|
},
|
|
"protocol": "https",
|
|
"ports": [443],
|
|
"network_path": "google_apis",
|
|
"encryption": "tls",
|
|
"allowed_by": [".github/workflows/gcp-artifact.yml", "roles/artifactregistry.writer"],
|
|
"forbidden": ["cloudsql.editor", "secretmanager.secretAccessor", "compute.admin"]
|
|
},
|
|
{
|
|
"name": "github_actions_to_readiness_probe",
|
|
"purpose": "Read-only GCP readiness probe with retained artifacts.",
|
|
"source": {
|
|
"type": "github_actions_wif",
|
|
"repository": "living-ip/teleo-infrastructure"
|
|
},
|
|
"identity": "sa-teleo-readiness@teleo-501523.iam.gserviceaccount.com",
|
|
"target": {
|
|
"type": "gcp_control_plane",
|
|
"resources": ["artifact_registry", "compute_metadata", "cloudsql_metadata", "secret_metadata", "storage_metadata"]
|
|
},
|
|
"protocol": "https",
|
|
"ports": [443],
|
|
"network_path": "google_apis",
|
|
"encryption": "tls",
|
|
"allowed_by": [".github/workflows/gcp-readiness.yml", "ops/plan_gcp_iam_split.py"],
|
|
"forbidden": ["artifactregistry.writer", "cloudsql.editor", "secretmanager.secretAccessor"]
|
|
},
|
|
{
|
|
"name": "operator_ssh_to_teleo_vms",
|
|
"purpose": "Emergency/operator shell access only from one retained operator IPv4 /32.",
|
|
"source": {
|
|
"type": "operator_ip",
|
|
"cidrs": ["<operator-ip>/32"]
|
|
},
|
|
"identity": "oslogin_operator",
|
|
"target": {
|
|
"type": "compute_instance_tags",
|
|
"tags": ["teleo-prod-ssh", "teleo-staging-ssh"]
|
|
},
|
|
"protocol": "tcp",
|
|
"ports": [22],
|
|
"network_path": "vpc_firewall",
|
|
"encryption": "ssh",
|
|
"allowed_by": ["ops/apply_gcp_runtime_baseline.py", "ops/check_gcp_infra_readiness.py"],
|
|
"forbidden": ["broad_ipv4_ingress", "broad_ipv6_ingress", "tcp:3389"]
|
|
},
|
|
{
|
|
"name": "teleo_vms_to_artifact_registry",
|
|
"purpose": "Runtime pulls immutable images from Artifact Registry over Private Google Access.",
|
|
"source": {
|
|
"type": "compute_service_accounts",
|
|
"service_accounts": [
|
|
"sa-teleo-prod-vm@teleo-501523.iam.gserviceaccount.com",
|
|
"sa-teleo-staging-vm@teleo-501523.iam.gserviceaccount.com"
|
|
]
|
|
},
|
|
"identity": "dedicated_vm_service_accounts",
|
|
"target": {
|
|
"type": "artifact_registry",
|
|
"repository": "projects/teleo-501523/locations/europe-west6/repositories/teleo"
|
|
},
|
|
"protocol": "https",
|
|
"ports": [443],
|
|
"network_path": "private_google_access",
|
|
"encryption": "tls",
|
|
"allowed_by": ["roles/artifactregistry.reader", "ops/apply_gcp_runtime_baseline.py"],
|
|
"forbidden": ["default_compute_service_account", "public_image_registry_required"]
|
|
},
|
|
{
|
|
"name": "teleo_vms_to_cloudsql_private",
|
|
"purpose": "Application and restore readback connections to the private Cloud SQL standby.",
|
|
"source": {
|
|
"type": "compute_service_accounts",
|
|
"service_accounts": [
|
|
"sa-teleo-prod-vm@teleo-501523.iam.gserviceaccount.com",
|
|
"sa-teleo-staging-vm@teleo-501523.iam.gserviceaccount.com"
|
|
]
|
|
},
|
|
"identity": "dedicated_vm_service_accounts",
|
|
"target": {
|
|
"type": "cloudsql_postgres",
|
|
"instance": "teleo-pgvector-standby",
|
|
"database": "teleo_kb",
|
|
"private_network": "projects/teleo-501523/global/networks/teleo-staging-net",
|
|
"public_ip": false
|
|
},
|
|
"protocol": "postgres",
|
|
"ports": [5432],
|
|
"network_path": "private_vpc",
|
|
"encryption": "encrypted_only",
|
|
"allowed_by": ["ops/apply_gcp_runtime_baseline.py", "ops/check_gcp_infra_readiness.py"],
|
|
"forbidden": ["public_ip", "ssl_disabled", "authorized_networks_public"]
|
|
},
|
|
{
|
|
"name": "cloudsql_import_from_backup_bucket",
|
|
"purpose": "Cloud SQL import operation reads generated restore SQL from the versioned backup bucket.",
|
|
"source": {
|
|
"type": "cloudsql_instance_service_account",
|
|
"discovered_by": "gcloud sql instances describe teleo-pgvector-standby --format=value(serviceAccountEmailAddress)"
|
|
},
|
|
"identity": "cloudsql_instance_service_account",
|
|
"target": {
|
|
"type": "gcs_bucket",
|
|
"bucket": "gs://teleo-501523-prod-backups",
|
|
"prefix": "kb-dumps/cloudsql-restore-drills/"
|
|
},
|
|
"protocol": "https",
|
|
"ports": [443],
|
|
"network_path": "google_apis",
|
|
"encryption": "tls",
|
|
"allowed_by": ["roles/storage.objectAdmin", "ops/apply_gcp_iam_split.py"],
|
|
"forbidden": ["allUsers", "allAuthenticatedUsers", "publicAccessPreventionDisabled"]
|
|
},
|
|
{
|
|
"name": "restore_drill_operator_to_cloudsql_admin",
|
|
"purpose": "Operator-triggered Cloud SQL import drill and post-import readback.",
|
|
"source": {
|
|
"type": "operator_or_ci_with_explicit_auth",
|
|
"requires_retained_execute_proof": true
|
|
},
|
|
"identity": "sa-teleo-restore-drill@teleo-501523.iam.gserviceaccount.com",
|
|
"target": {
|
|
"type": "cloudsql_admin_api",
|
|
"instance": "teleo-pgvector-standby"
|
|
},
|
|
"protocol": "https",
|
|
"ports": [443],
|
|
"network_path": "google_apis",
|
|
"encryption": "tls",
|
|
"allowed_by": ["roles/cloudsql.editor", "ops/run_gcp_cloudsql_restore_drill.sh"],
|
|
"forbidden": ["unretained_execute", "raw_password_in_logs"]
|
|
},
|
|
{
|
|
"name": "vps_backup_to_gcs_bucket",
|
|
"purpose": "Source backup artifacts are uploaded to versioned GCS only through an approved backup identity.",
|
|
"source": {
|
|
"type": "hetzner_vps_or_operator_export",
|
|
"host": "teleo@77.42.65.182"
|
|
},
|
|
"identity": "approved_backup_writer_or_operator_session",
|
|
"target": {
|
|
"type": "gcs_bucket",
|
|
"bucket": "gs://teleo-501523-prod-backups",
|
|
"prefix": "kb-dumps/"
|
|
},
|
|
"protocol": "https",
|
|
"ports": [443],
|
|
"network_path": "google_apis",
|
|
"encryption": "tls",
|
|
"allowed_by": ["ops/backup_vps_sqlite_kb.sh", "ops/run_gcp_cloudsql_restore_drill.sh"],
|
|
"forbidden": ["raw_private_key_in_contract", "database_public_ingress", "unversioned_bucket"]
|
|
}
|
|
],
|
|
"not_proven_by_this_contract": [
|
|
"that GCP resources currently exist",
|
|
"that firewall rules are currently applied",
|
|
"that Cloud SQL import/readback has succeeded",
|
|
"that production Telegram/Leo traffic has cut over to GCP"
|
|
]
|
|
}
|