MAQPNADocs

SovereigntyPolicy

SovereigntyPolicy (maqpna.com/v1alpha1): every field, type, default and validation rule, generated from the CRD schema.

SovereigntyPolicy is a cluster-scoped data-sovereignty policy. The operator enforces the one named "default".

At a glance#

Property Value
API version maqpna.com/v1alpha1
Kind SovereigntyPolicy
Scope Cluster
Plural sovereigntypolicies
Short names sovpol, sp
Categories maqpna
Status subresource yes 
kubectl get sovereigntypolicies
kubectl get sovpol <name> -o yaml
kubectl explain sovereigntypolicies.spec

Columns in kubectl get#

Column Type From
Jurisdiction string .spec.jurisdiction
Enforcement string .spec.enforcement
Violations integer .status.violations
Age date .metadata.creationTimestamp

Example#

From config/samples/sovereigntypolicy-eu.yaml:

apiVersion: maqpna.com/v1alpha1
kind: SovereigntyPolicy
metadata:
  # The operator enforces the policy named "default".
  name: default
spec:
  jurisdiction: EU
  allowedJurisdictions: ["EU"]        # admits EU, EU-DE, EU-FR, ...
  allowedRegistries:
  - registry.acme.eu/
  allowedEgressHosts:
  - "*.svc"
  - "*.svc.cluster.local"
  - "*.acme.eu"
  allowedEgressCIDRs:
  - 10.0.0.0/8
  requireAttestationFor: ["confidential"]
  keyCustody: kms
  telemetry: "off"
  auditRetentionDays: 365
  enforcement: enforce

Spec fields#

SovereigntyPolicySpec defines cluster-wide data-sovereignty constraints.

Field Type Required Description
allowedEgressCIDRs []string allowedEgressCIDRs permit literal-IP endpoints inside these CIDRs.
allowedEgressHosts []string allowedEgressHosts are host globs (e.g. ".svc", ".acme.eu") that Agent.spec.model.endpoint and tools[].upstreamURL hosts must match.
allowedJurisdictions []string allowedJurisdictions that TrustTier.spec.jurisdiction must be in.
allowedRegistries []string allowedRegistries are image reference prefixes (e.g. "registry.acme.eu/").
auditRetentionDays integer (int32) Minimum: 0.
enforcement string EnforcementMode selects whether violations block (enforce) or are only reported (audit). One of: enforce, audit. Default: "enforce".
jurisdiction string jurisdiction of this installation (e.g. "EU").
keyCustody string KeyCustody is where signing / encryption keys are held. One of: file, pkcs11, kms.
requireAttestationFor []string requireAttestationFor lists isolation classes (gvisor|microvm|confidential) whose sessions require attestation-gated token release.
telemetry string TelemetryMode controls outbound vendor telemetry. Only "off" is permitted. One of: off. Default: "off".

Status fields#

SovereigntyPolicyStatus is the observed state of a SovereigntyPolicy.

The operator writes status; do not set it yourself.

Field Type Required Description
conditions []object
conditions[].lastTransitionTime string (date-time) yes lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
conditions[].message string yes message is a human readable message indicating details about the transition. This may be an empty string. Max length: 32768.
conditions[].observedGeneration integer (int64) observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. Minimum: 0.
conditions[].reason string yes reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. Min length: 1. Max length: 1024. Pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$.
conditions[].status string yes status of the condition, one of True, False, Unknown. One of: True, False, Unknown.
conditions[].type string yes type of condition in CamelCase or in foo.example.com/CamelCase. Max length: 316. Pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$.
lastEvaluated string (date-time)
violations integer (int32) violations is the number of Agents currently violating the policy.