generated from coulomb/repo-seed
82 lines
1.9 KiB
Markdown
82 lines
1.9 KiB
Markdown
---
|
|
id: ITC-WP-0010
|
|
type: workplan
|
|
title: "CARING Kubernetes RBAC Benchmark"
|
|
repo: info-tech-canon
|
|
status: planned
|
|
priority: medium
|
|
created: "2026-05-23"
|
|
updated: "2026-05-23"
|
|
depends_on_workplans:
|
|
- ITC-WP-0003
|
|
- ITC-WP-0005
|
|
---
|
|
|
|
# ITC-WP-0010 - CARING Kubernetes RBAC Benchmark
|
|
|
|
## Goal
|
|
|
|
Create a distinct benchmark workplan for analyzing Kubernetes RBAC through
|
|
CARING and the wider InfoTechCanon kernel.
|
|
|
|
## Intent
|
|
|
|
This is deliberately separate from the small SaaS proof. The benchmark is more
|
|
ambitious and should stress orthogonality across Access Control, Organization,
|
|
Governance, Security, Network, DevSecOps, Observability, Task, and Tagging.
|
|
|
|
## Tasks
|
|
|
|
### T01 - Benchmark workspace
|
|
|
|
```task
|
|
id: ITC-WP-0010-T01
|
|
status: planned
|
|
priority: high
|
|
```
|
|
|
|
- Create `infospace/standards/caring/benchmarks/kubernetes-rbac/`.
|
|
- Define source corpus, cases, expected outputs, and review criteria.
|
|
|
|
### T02 - RBAC assimilation
|
|
|
|
```task
|
|
id: ITC-WP-0010-T02
|
|
status: planned
|
|
priority: high
|
|
```
|
|
|
|
- Map Kubernetes Role, ClusterRole, RoleBinding, ClusterRoleBinding,
|
|
ServiceAccount, Namespace, verbs, resources, and scopes.
|
|
- Preserve the warning that Namespace is not automatically a tenant boundary.
|
|
|
|
### T03 - CARING access descriptors
|
|
|
|
```task
|
|
id: ITC-WP-0010-T03
|
|
status: planned
|
|
priority: high
|
|
```
|
|
|
|
- Express benchmark cases as CARING access descriptors.
|
|
- Distinguish declared access, effective access, derived capability, and
|
|
induced access.
|
|
|
|
### T04 - Findings and canon pressure
|
|
|
|
```task
|
|
id: ITC-WP-0010-T04
|
|
status: planned
|
|
priority: medium
|
|
```
|
|
|
|
- Produce gaps, conflicts, mappings, and proposed canon changes.
|
|
- Feed stable findings back into models and standards through explicit tasks.
|
|
|
|
## Acceptance
|
|
|
|
- Kubernetes RBAC is analyzed as a benchmark, not as a shortcut profile.
|
|
- CARING descriptor shape is tested with practical examples.
|
|
- Benchmark findings produce explicit canon change proposals.
|
|
|