Auditoria e Compliance

apiVersion: platform.chatcli.io/v1alpha1
kind: AuditEvent
metadata:
  name: audit-1773930600123456789-a7f3b2
  namespace: production                  # namespace do recurso afetado
  labels:
    platform.chatcli.io/event-type: remediation_started
    platform.chatcli.io/severity: info
  annotations:
    platform.chatcli.io/immutable: "true"
spec:
  # Tipo do evento (string livre; veja a lista abaixo)
  eventType: remediation_started

  # Quando o evento foi registrado (RFC 3339, precisão de segundos)
  timestamp: "2026-03-19T14:30:00Z"

  # Quem executou a ação
  actor:
    type: controller                     # sempre "controller" nos eventos do operator
    name: RemediationReconciler
    controller: remediation-controller

  # Recurso afetado
  resource:
    kind: RemediationPlan
    name: api-server-pod-restart-1773930000-plan-1
    namespace: production
    uid: 6f1c2d0a-4b7e-4f35-9a51-0c8e2b7d9e14

  # Detalhes específicos do evento (mapa de strings)
  details:
    issue: api-server-pod-restart-1773930000
    attempt: "1"
    strategy: "Roll back to the previous revision"
    agentic: "false"

  # Agrupa eventos relacionados: o nome da Issue (o nome do SLO em slo_violation)
  correlationId: api-server-pod-restart-1773930000

  # info | warning | critical (padrão "info")
  severity: info

type AuditResource struct {
    Kind      string `json:"kind"`
    Name      string `json:"name"`
    Namespace string `json:"namespace"`
    UID       string `json:"uid,omitempty"`
}

audit-{unix-nanossegundos}-{6-caracteres-aleatorios}

apiVersion: platform.chatcli.io/v1alpha1
kind: AuditEvent
metadata:
  name: audit-1773934200987654321-k2m9qz
  namespace: production
  labels:
    platform.chatcli.io/event-type: sla_breach
    platform.chatcli.io/severity: critical
  annotations:
    platform.chatcli.io/immutable: "true"
spec:
  eventType: sla_breach
  timestamp: "2026-03-19T15:30:00Z"
  actor:
    type: controller
    name: SLAReconciler
    controller: sla-controller
  resource:
    kind: Issue
    name: api-server-pod-restart-1773930000
    namespace: production
    uid: 0b7e3c1d-92a4-4c1e-8f60-5d2a9e3b7c48
  details:
    type: resolution
    elapsed: 1h0m12s
    threshold: 1h0m0s
  correlationId: api-server-pod-restart-1773930000
  severity: critical

curl -s -H "X-API-Key: $CHATCLI_API_KEY" \
  "http://chatcli-operator.chatcli-system.svc:8090/api/v1/analytics/compliance?namespace=production" | jq .

{
  "apiVersion": "v1",
  "kind": "ComplianceReport",
  "spec": {
    "Period": { "Start": "2026-03-12T14:00:00Z", "End": "2026-03-19T14:00:00Z" },
    "IncidentMetrics": { "...": "..." },
    "RemediationMetrics": { "...": "..." },
    "SLAMetrics": { "...": "..." },
    "ApprovalMetrics": { "...": "..." },
    "AuditSummary": { "...": "..." },
    "IncidentSLAs": [ { "...": "..." } ]
  }
}

"AuditSummary": {
  "TotalEvents": 312,
  "BySeverity": { "info": 251, "warning": 55, "critical": 6 },
  "ByEventType": {
    "issue_created": 47,
    "issue_resolved": 41,
    "issue_escalated": 3,
    "remediation_started": 52,
    "remediation_completed": 46,
    "remediation_failed": 6,
    "approval_requested": 12,
    "approval_approved": 8,
    "approval_rejected": 2,
    "approval_expired": 2,
    "notification_sent": 87,
    "sla_breach": 6
  }
}

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: chatcli-role-operator-sre
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: chatcli-role-operator
subjects:
  - kind: Group
    name: sre-oncall
    apiGroup: rbac.authorization.k8s.io

curl -s -H "X-API-Key: $CHATCLI_API_KEY" \
  "http://chatcli-operator.chatcli-system.svc:8090/api/v1/audit?type=remediation_failed&from=2026-03-18T00:00:00Z&to=2026-03-19T23:59:59Z&pageSize=10" | jq .

{
  "apiVersion": "v1",
  "kind": "AuditEventList",
  "metadata": { "totalCount": 3, "page": 1, "pageSize": 10 },
  "items": [
    {
      "name": "audit-1773931800456789123-p4x8nb",
      "namespace": "production",
      "eventType": "remediation_failed",
      "severity": "warning",
      "actorType": "controller",
      "actorName": "RemediationReconciler",
      "resourceKind": "RemediationPlan",
      "resourceName": "api-server-pod-restart-1773930000-plan-1",
      "resourceNamespace": "production",
      "correlationId": "api-server-pod-restart-1773930000",
      "detail": "issue=api-server-pod-restart-1773930000; result=Approval request expired without decision; attempt=1",
      "timestamp": "2026-03-19T14:50:00Z",
      "creationTimestamp": "2026-03-19T14:50:00Z"
    }
  ]
}

curl -s -H "X-API-Key: $CHATCLI_API_KEY" -o audit-export.json \
  "http://chatcli-operator.chatcli-system.svc:8090/api/v1/audit/export?from=2026-03-18T14:00:00Z&to=2026-03-19T14:00:00Z"

jq '.totalCount' audit-export.json

{
  "apiVersion": "v1",
  "kind": "AuditEventExport",
  "exportedAt": "2026-03-19T14:00:05Z",
  "totalCount": 312,
  "items": [
    { "name": "audit-1773930600123456789-a7f3b2", "eventType": "remediation_started", "...": "..." }
  ]
}

apiVersion: batch/v1
kind: CronJob
metadata:
  name: audit-export-elastic
  namespace: chatcli-system
spec:
  schedule: "*/15 * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
            - name: exporter
              image: alpine:3.22
              command:
                - /bin/sh
                - -c
                - |
                  set -eu
                  apk add --no-cache curl jq >/dev/null
                  FROM=$(date -u -d "@$(( $(date +%s) - 1200 ))" +%Y-%m-%dT%H:%M:%SZ)
                  TO=$(date -u +%Y-%m-%dT%H:%M:%SZ)

                  # Bulk API; o nome do evento como _id torna a sobreposição idempotente
                  curl -sf -H "X-API-Key: $CHATCLI_API_KEY" \
                    "http://chatcli-operator.chatcli-system.svc:8090/api/v1/audit/export?from=$FROM&to=$TO" \
                    | jq -c '.items[] | {index: {_id: .name}}, .' > /tmp/bulk.ndjson

                  [ -s /tmp/bulk.ndjson ] && curl -sf -X POST \
                    "https://elastic.example.com:9200/chatcli-audit/_bulk" \
                    -H "Content-Type: application/x-ndjson" \
                    -u "$ELASTIC_USER:$ELASTIC_PASS" \
                    --data-binary @/tmp/bulk.ndjson
              env:
                - name: CHATCLI_API_KEY
                  valueFrom:
                    secretKeyRef:
                      name: chatcli-audit-exporter
                      key: api-key
                - name: ELASTIC_USER
                  valueFrom:
                    secretKeyRef:
                      name: elastic-credentials
                      key: username
                - name: ELASTIC_PASS
                  valueFrom:
                    secretKeyRef:
                      name: elastic-credentials
                      key: password
          restartPolicy: OnFailure

# Apaga AuditEvents com mais de 90 dias, em todos os namespaces
apiVersion: v1
kind: ServiceAccount
metadata:
  name: audit-retention
  namespace: chatcli-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: audit-retention
rules:
  - apiGroups: ["platform.chatcli.io"]
    resources: ["auditevents"]
    verbs: ["list", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: audit-retention
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: audit-retention
subjects:
  - kind: ServiceAccount
    name: audit-retention
    namespace: chatcli-system
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: audit-retention
  namespace: chatcli-system
spec:
  schedule: "0 2 * * 0"    # Todo domingo às 02:00
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: audit-retention
          containers:
            - name: cleanup
              # Qualquer imagem que traga kubectl e um shell POSIX
              image: registry.example.com/tools/kubectl-shell:1.31
              command:
                - /bin/sh
                - -c
                - |
                  CUTOFF=$(date -u -d "@$(( $(date +%s) - 90*86400 ))" +%Y-%m-%dT%H:%M:%SZ)
                  kubectl get auditevents -A --no-headers \
                    -o custom-columns=NS:.metadata.namespace,NAME:.metadata.name,TS:.spec.timestamp | \
                  awk -v c="$CUTOFF" '$3 < c {print $1, $2}' | \
                  while read -r ns name; do
                    kubectl delete auditevent -n "$ns" "$name"
                  done
          restartPolicy: OnFailure