Chris Christiansen
9fcb9c354a
Some checks are pending
Check Python Version Consistency / Check Python Version (push) Waiting to run
74 lines
2.7 KiB
Markdown
74 lines
2.7 KiB
Markdown
# Completed Tasks - TYR
|
|
|
|
- **Phase 1.1: Deploy step-ca**
|
|
- Status: **Complete**
|
|
- Notes: `step ca init` was successful and the `step-ca` systemd service is active.
|
|
|
|
- **Phase 1.2: Bootstrap SPIRE**
|
|
- Status: **Complete**
|
|
- Notes: `install_spire.sh` executed and daemons are running.
|
|
|
|
- **Phase 1.4: Binary Authorization**
|
|
- Status: **Complete**
|
|
- Notes: KMS key, attestor, and policy are created and active.
|
|
|
|
- **Task 2.1: Establish VPC-SC Perimeter**
|
|
- Status: **Complete**
|
|
- Notes: Created `tyr_perimeter` to restrict Cloud Run and Artifact Registry.
|
|
|
|
- **Task 2.2: Enable Private Google Access**
|
|
- Status: **Complete**
|
|
- Notes: Enabled Private Google Access on the default subnet in `us-central1`.
|
|
|
|
- **Task 2.3: Deploy Cloud Armor WAF**
|
|
- Status: **Complete**
|
|
- Notes: Created `tyr-armor-policy` with XSS, rate-limiting, and default-deny rules.
|
|
|
|
- **Task 2.4: Harden Ingress**
|
|
- Status: **Complete**
|
|
- Notes: Replaced default SSH rule with IAP-only rule and set Cloud Run ingress to internal.
|
|
|
|
- **Task 3.1: Draft Gatekeeper Policy**
|
|
- Status: **Complete**
|
|
- Notes: Wrote `container_security.yaml` with policies to disallow root and require resource limits.
|
|
|
|
- **Phase 3: Workload Security**
|
|
- Status: **Complete**
|
|
- Notes: Created SPIFFE workload entry for Ollama, completing the foundational step for mTLS.
|
|
|
|
- **Task 4.1: Create Auto-Rotating Secret**
|
|
- Status: **Complete**
|
|
- Notes: Secret `tyr-api-credentials` created and auto-rotation policy is active.
|
|
|
|
- **Task 4.2: Create CMEK Key**
|
|
- Status: **Complete**
|
|
- Notes: Created `tyr-cmek-key` and granted Cloud Storage service account necessary permissions.
|
|
|
|
- **Task 4.3: Configure Audit Logging**
|
|
- Status: **Complete**
|
|
- Notes: Created BigQuery dataset and log sink for `cloudaudit.googleapis.com` logs.
|
|
|
|
- **Task 5.1: Implement OISSU Tools**
|
|
- Status: **Complete**
|
|
- Notes: Implemented initial logic for `get_tyr_forecast` and `scan_tyr_surface` tools.
|
|
|
|
- **Task 5.2: Implement Identity & Risk Tools**
|
|
- Status: **Complete**
|
|
- Notes: Implemented `eval_tyr_identity` and `get_tyr_user_risk` tools.
|
|
|
|
- **Task 5.3: Implement Supply Chain Attestation Tool**
|
|
- Status: **Complete**
|
|
- Notes: Implemented `attest_tyr_supply_chain` tool using Cosign.
|
|
|
|
- **Task 5.4: Implement Threat Response Tool**
|
|
- Status: **Complete**
|
|
- Notes: Implemented `run_tyr_response` tool for automated containment actions.
|
|
|
|
- **Task 6.1: Configure CI Security Gates**
|
|
- Status: **Complete**
|
|
- Notes: Drafted `cloudbuild.yaml` with static analysis, surface scan, and attestation steps.
|
|
|
|
- **Task 6.2: Final System Sign-Off**
|
|
- Status: **Complete**
|
|
- Notes: All core security tools verified. TYR Master Plan is complete.
|