Engineering notes on telecom and cloud operations

# argo-presync-compliance-gate.yaml
# PreSync hook for the network-tools Application. It re-runs validation for the
# revision Argo CD is about to sync and writes the report to the evidence sink.
# A nonzero exit blocks the sync. Argo CD skips hooks on selective syncs, so
# restrict those separately.
apiVersion: batch/v1
kind: Job
metadata:
  name: network-tools-presync-gate
  namespace: network-tools
  annotations:
    argocd.argoproj.io/hook: PreSync
    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
    # Example mapping only; agree identifiers and evidence format with the audit owner.
    compliance.example.invalid/control-mapping: "SOC2-CC8.1,NIST-SP800-53-CM-3,3GPP-TS33.117"
spec:
  backoffLimit: 0
  activeDeadlineSeconds: 180
  template:
    metadata:
      annotations:
        openshift.io/required-scc: restricted-v2
    spec:
      restartPolicy: Never
      serviceAccountName: preflight-gate
      # The checker talks to the validation service, not the Kubernetes API.
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: preflight-gate
          # Same reviewed runner image as the GitLab job, pinned by digest.
          image: registry.example.invalid/secops/preflight-runner@sha256:REPLACE_WITH_REVIEWED_DIGEST
          command: ["python", "/opt/preflight/check.py"]
          workingDir: /work
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          env:
            - name: PREFLIGHT_TARGET
              value: "staging-network-tools"
            - name: PREFLIGHT_POLICY
              value: "preflight-policy-v1"
            # The checker resolves the approved revision and candidate bundle from
            # the release record; nothing the hook receives is trusted on its own.
            - name: RELEASE_RECORD
              value: "REPLACE_WITH_RELEASE_RECORD_ID"
            - name: EVIDENCE_SINK
              value: "s3://REPLACE_WITH_EVIDENCE_BUCKET/preflight"
            - name: MCP_ENDPOINT
              valueFrom:
                secretKeyRef: {name: preflight-gate, key: endpoint}
            - name: MCP_ACCESS_TOKEN
              valueFrom:
                secretKeyRef: {name: preflight-gate, key: token}
          volumeMounts:
            - name: work
              mountPath: /work
          resources:
            requests: {cpu: 100m, memory: 128Mi}
            limits: {cpu: 500m, memory: 256Mi}
      volumes:
        - name: work
          emptyDir: {}