e323c45cb0
- Security: no IAM in service repos, no custom auth, no direct external calls - Architecture: no cross-cloud SDKs, no cross-service DB access, no hardcoded tenant/env config - DevOps: Foxtrot-compatible Helm (no custom ingress), no infra provisioning in service repos, no pinned infra versions - Cost: resource tagging, no unbounded allocation, no per-tenant infra - Updated checker and demo to match - These are NOT static code analysis — they catch organizational policy violations that SonarQube/Checkstyle miss
45 lines
2.1 KiB
Markdown
45 lines
2.1 KiB
Markdown
# DevOps Requirements
|
|
|
|
Phase: deployment
|
|
Enforcement: informational
|
|
|
|
## OPS-001: Foxtrot-Compatible Helm Chart
|
|
|
|
Every deployable service MUST include a Helm chart that honors the Foxtrot deployment contract.
|
|
|
|
**Rule:** The Helm chart must:
|
|
- Use the standard Foxtrot base chart as a dependency (or implement its interface)
|
|
- Expose `values.yaml` with the required Foxtrot parameters (replicas, resources, env, configMap references)
|
|
- Support the standard lifecycle hooks (pre-deploy validation, health check, rollback trigger)
|
|
- Not define its own ingress/networking — Foxtrot manages routing
|
|
|
|
**Test:** Validate Helm chart structure: check for Foxtrot base chart dependency, required values keys, no ingress resource definitions.
|
|
|
|
## OPS-002: No Infrastructure Provisioning in Service Repos
|
|
|
|
Service repositories MUST NOT provision infrastructure (databases, queues, storage, networking). Infrastructure is managed through the dedicated infrastructure repos.
|
|
|
|
**Rule:** No Terraform, CloudFormation, or Pulumi resource definitions in service repos. Services declare their infrastructure dependencies in a manifest; the platform provisions them.
|
|
|
|
**Test:** Scan for `*.tf`, `*.template.yaml` (CFN), `Pulumi.*` files in service repos.
|
|
|
|
## OPS-003: Standard Observability Contract
|
|
|
|
Every service MUST expose metrics, health, and readiness endpoints in the standard format.
|
|
|
|
**Rule:**
|
|
- `/health` or `/actuator/health` — returns 200 when healthy
|
|
- `/ready` or `/actuator/ready` — returns 200 when ready to accept traffic
|
|
- Prometheus metrics endpoint at `/metrics` or `/actuator/prometheus`
|
|
- Structured JSON logging with correlation ID propagation
|
|
|
|
**Test:** Check for health/ready endpoint registration in code. Verify logging config outputs JSON format.
|
|
|
|
## OPS-004: No Pinned Infrastructure Versions
|
|
|
|
Service Helm charts MUST NOT pin specific infrastructure versions (database versions, queue versions, runtime versions).
|
|
|
|
**Rule:** Infrastructure version management is handled by the platform team. Services declare compatibility ranges, not exact versions. No `image: postgres:14.2` in service charts.
|
|
|
|
**Test:** Scan Helm values and templates for hardcoded infrastructure image tags.
|