Aleksei Sviridkin 286f260570 docs(security): add design-level threat model ...

Document the platform's actors, boundary-crossing actions, and security
goals/non-goals, organized by trust boundary (T0-T4) per the CNCF
TAG-Security Actors/Actions model. Records the primary trust-boundary
invariant (tenant RBAC grants no HelmRelease/core writes; the aggregated
API server fixes the chart reference server-side) and the two admission
enforcement points (core kube-apiserver vs cozystack-api). Every claim
cites a source file so the model can be re-verified as the code evolves.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-07-06 18:23:11 +03:00

..

agents

ci: address CodeRabbit review on build-matrix workflow

2026-06-25 17:51:38 +05:00

changelogs

docs(release): add changelog for v1.4.5 (#3083)

2026-07-03 17:50:16 +05:00

operations

feat(platform): add default backupclass

2026-05-28 13:49:59 +04:00

security

docs(security): add design-level threat model

2026-07-06 18:23:11 +03:00

gpu-vgpu.md

docs(gpu-operator): document passthrough variant host-driver prerequisite

2026-06-10 02:12:05 +03:00

hubble-observability.md

…

oidc-tenant.md

docs(oidc): reframe emailVerified as prescriptive, not chart-enforced

2026-07-06 09:25:07 +03:00

release.md

docs(release): document automated patch-release cron and support window

2026-06-21 14:26:15 +03:00

storage-immutability.md

build(dashboard): pin console image builder to pnpm 11.1.2 and repoint vendor doc link

2026-06-26 20:00:12 +05:00