Arsitektur Platform Engineering Modern: Crossplane Control Plane, Argo Rollouts Progressive Delivery, Istio Ambient Mesh HBONE, ARC dan SLSA Level 3

+---------------------------------------------------------------------------------------------------+
|                        INTERNAL DEVELOPER PLATFORM (IDP) KUBERNETES CONTROL PLANE                 |
+---------------------------------------------------------------------------------------------------+
|  Developer Claim (XRC: "PostgreSqlInstance")                                                      |
|         │                                                                                         |
|         ▼                                                                                         |
|  [ CROSSPLANE COMPOSITION ENGINE ] ───────────────────────────────────────────────┐              |
|         │                                                                         │ (Creates Cloud)|
|         ├──────────────────────────────────┐                                      ▼               |
|         ▼                                  ▼                             [ Cloud Infrastructure ] |
|  [ Argo Rollout Canary ]        [ Istio Ambient Mesh ]                   (RDS, S3, IAM, VPC via   |
|         │ (Progressive Delivery)           │ (Sidecarless mTLS)           Provider-AWS/GCP K8s CRD)|
|         ▼                                  ▼                                                      |
|   Gateway API (HTTPRoute)          ztunnel (Node eBPF) ──[HBONE:15008]──> Waypoint Envoy (L7)     |
|         │                                                                                         |
|         ▼                                                                                         |
|  [ CI Pipeline: GitHub Actions ARC ] ──(Build & Attest)──> [ SLSA Level 3 Cosign / Kyverno Gate ] |
+---------------------------------------------------------------------------------------------------+

NODE 1 (192.0.2.11)                                     NODE 2 (192.0.2.12)
+------------------------------------+                  +------------------------------------+
| Pod A (Frontend / Client)          |                  | Pod B (Backend / Payment API)      |
|   │ (Plain TCP via veth)           |                  |   ▲ (Plain TCP)                    |
|   ▼                                |                  |   │                                |
| Linux Network Stack (eBPF Redirect)|                  | Linux Network Stack                |
|   │                                |                  |   ▲                                |
|   ▼                                |                  |   │                                |
| ztunnel (Rust Node Daemon)         |                  | ztunnel (Rust Node Daemon)         |
|   │ [HBONE: Port 15008 / mTLS]     |                  |   ▲                                |
+───┼────────────────────────────────+                  +───┼────────────────────────────────+
    │                                                       │
    └───────────────────────[ Underlay Network ]────────────┘

# xrd-postgresql.yaml
apiVersion: apiextensions.crossplane.io/v1
kind: CompositeResourceDefinition
metadata:
  name: xpostgresqlinstances.platform.lanina.io
spec:
  group: platform.lanina.io
  names:
    kind: XPostgreSqlInstance
    plural: xpostgresqlinstances
  claimNames:
    kind: PostgreSqlInstance
    plural: postgresqlinstances
  versions:
    - name: v1alpha1
      served: true
      referenceable: true
      schema:
        openAPIV3Schema:
          type: object
          properties:
            spec:
              type: object
              required:
                - storageGB
                - engineVersion
                - tier
              properties:
                storageGB:
                  type: integer
                  minimum: 20
                  maximum: 10000
                  description: "Alokasi disk storage dalam Gigabytes"
                engineVersion:
                  type: string
                  enum: ["15.6", "16.2", "16.4"]
                  description: "Versi engine PostgreSQL"
                tier:
                  type: string
                  enum: ["development", "staging", "production-ha"]
                  description: "Tier lingkungan deployment"
                backupRetentionDays:
                  type: integer
                  default: 7
                  minimum: 1
                  maximum: 35
            status:
              type: object
              properties:
                endpoint:
                  type: string
                port:
                  type: integer
                readyStatus:
                  type: string

# composition-aws-rds.yaml
apiVersion: apiextensions.crossplane.io/v1
kind: Composition
metadata:
  name: xpostgresqlinstances.aws.rds.production
  labels:
    provider: aws
    tier: production-ha
spec:
  compositeTypeRef:
    apiVersion: platform.lanina.io/v1alpha1
    kind: XPostgreSqlInstance
  mode: Pipeline
  pipeline:
    - step: patch-and-transform
      functionRef:
        name: function-patch-and-transform
      input:
        apiVersion: pt.fn.crossplane.io/v1beta1
        kind: Resources
        resources:
          - name: rds-subnet-group
            base:
              apiVersion: rds.aws.upbound.io/v1beta1
              kind: SubnetGroup
              spec:
                forProvider:
                  region: ap-southeast-1
                  description: "Subnet group managed by Crossplane Control Plane"
                  subnetIdSelector:
                    matchLabels:
                      type: database-private-subnet
            patches:
              - type: SetIdentifier
                transforms:
                  - type: string
                    string:
                      fmt: "%s-subnet-group"
          - name: rds-instance
            base:
              apiVersion: rds.aws.upbound.io/v1beta1
              kind: Instance
              spec:
                forProvider:
                  region: ap-southeast-1
                  autoGeneratePassword: true
                  dbSubnetGroupNameSelector:
                    matchControllerRef: true
                  engine: postgres
                  instanceClass: db.m6i.xlarge
                  multiAz: true
                  publiclyAccessible: false
                  storageEncrypted: true
                  kmsKeyIdSelector:
                    matchLabels:
                      role: rds-kms-key
                  skipFinalSnapshot: false
                  deletionProtection: true
                writeConnectionSecretToRef:
                  namespace: crossplane-system
            patches:
              - type: FromCompositeFieldPath
                fromFieldPath: spec.storageGB
                toFieldPath: spec.forProvider.allocatedStorage
              - type: FromCompositeFieldPath
                fromFieldPath: spec.engineVersion
                toFieldPath: spec.forProvider.engineVersion
              - type: FromCompositeFieldPath
                fromFieldPath: spec.backupRetentionDays
                toFieldPath: spec.forProvider.backupRetentionPeriod
              - type: SetIdentifier
                transforms:
                  - type: string
                    string:
                      fmt: "%s-rds-pg"
              - type: ToCompositeFieldPath
                fromFieldPath: status.atProvider.address
                toFieldPath: status.endpoint
              - type: ToCompositeFieldPath
                fromFieldPath: status.atProvider.port
                toFieldPath: status.port
              - type: ToCompositeFieldPath
                fromFieldPath: status.conditions[0].status
                toFieldPath: status.readyStatus

# rollout-canary-gateway-api.yaml
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: payment-engine
  namespace: core-banking
  labels:
    app: payment-engine
    tier: api
spec:
  replicas: 10
  revisionHistoryLimit: 5
  selector:
    matchLabels:
      app: payment-engine
  strategy:
    canary:
      canaryService: payment-engine-canary
      stableService: payment-engine-stable
      trafficRouting:
        gatewayAPI:
          httpRoute: payment-engine-route
          namespace: core-banking
      steps:
        - setWeight: 5
        - pause: { duration: 10m }
        - setWeight: 20
        - pause: { duration: 15m }
        - setWeight: 50
        - pause: { duration: 20m }
        - setWeight: 80
        - pause: { duration: 10m }
      analysis:
        templates:
          - templateName: payment-engine-success-rate-p99
        args:
          - name: service-name
            value: payment-engine
  template:
    metadata:
      labels:
        app: payment-engine
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "8080"
    spec:
      containers:
        - name: payment-engine
          image: ghcr.io/lanina-corp/banking/payment-engine:v2.4.1
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 8080
          resources:
            requests:
              cpu: "1000m"
              memory: "2Gi"
            limits:
              cpu: "2000m"
              memory: "4Gi"
          readinessProbe:
            httpGet:
              path: /healthz/ready
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 5
          livenessProbe:
            httpGet:
              path: /healthz/live
              port: 8080
            initialDelaySeconds: 15
            periodSeconds: 10

# analysistemplate-prometheus.yaml
apiVersion: argoproj.io/v1alpha1
kind: AnalysisTemplate
metadata:
  name: payment-engine-success-rate-p99
  namespace: core-banking
spec:
  args:
    - name: service-name
  metrics:
    - name: error-rate-percentage
      interval: 1m
      successCondition: result[0] <= 0.5
      failureLimit: 2
      provider:
        prometheus:
          address: http://prometheus-k8s.monitoring.svc.cluster.local:9090
          query: |
            (
              sum(rate(http_requests_total{job="payment-engine-canary", status=~"5.."}[2m]))
              /
              clamp_min(sum(rate(http_requests_total{job="payment-engine-canary"}[2m])), 1)
            ) * 100
    - name: p99-latency-milliseconds
      interval: 1m
      successCondition: result[0] <= 150
      failureLimit: 3
      provider:
        prometheus:
          address: http://prometheus-k8s.monitoring.svc.cluster.local:9090
          query: |
            histogram_quantile(0.99, sum(rate(http_request_duration_seconds_bucket{job="payment-engine-canary"}[2m])) by (le)) * 1000

# ambient-helm-values.yaml
cni:
  ambient:
    enabled: true
    configDir: "/etc/cni/net.d"
    cniBinDir: "/opt/cni/bin"
    redirectMode: "ebpf"

ztunnel:
  enabled: true
  resources:
    requests:
      cpu: "200m"
      memory: "128Mi"
    limits:
      cpu: "1000m"
      memory: "512Mi"
  env:
    LOG_LEVEL: "info"
    ZTUNNEL_ENABLE_PROFILING: "false"
    TERMINATION_DRAIN_DURATION: "5s"

# Tandai namespace untuk bergabung ke data-plane Ambient
kubectl label namespace core-banking istio.io/dataplane-mode=ambient --overwrite

# waypoint-gateway.yaml
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: banking-waypoint
  namespace: core-banking
  labels:
    istio.io/waypoint-for: all
spec:
  gatewayClassName: istio-waypoint
  listeners:
    - name: mesh
      port: 15008
      protocol: HBONE
---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: require-authenticated-spiffe
  namespace: core-banking
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: banking-waypoint
  action: ALLOW
  rules:
    - from:
        - source:
            principals: ["cluster.local/ns/frontend/sa/web-gateway-sa"]
      to:
        - operation:
            methods: ["POST", "GET"]
            paths: ["/api/v1/payments/*"]

# arc-runner-set-gvisor.yaml
apiVersion: actions.github.com/v1alpha1
kind: AutoscalingRunnerSet
metadata:
  name: hardened-prod-runners
  namespace: arc-runners
spec:
  githubConfigUrl: "https://github.com/lanina-corp"
  githubConfigSecret: github-arc-app-credentials
  minRunners: 2
  maxRunners: 50
  template:
    spec:
      runtimeClassName: runsc # Mewajibkan user-space kernel gVisor sandbox
      securityContext:
        runAsNonRoot: true
        runAsUser: 1001
        runAsGroup: 1001
        fsGroup: 1001
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: runner
          image: ghcr.io/actions/actions-runner:latest
          command: ["/home/runner/run.sh"]
          resources:
            requests:
              cpu: "2000m"
              memory: "4Gi"
            limits:
              cpu: "4000m"
              memory: "8Gi"
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          volumeMounts:
            - name: runner-work-ephemeral
              mountPath: /home/runner/_work
            - name: runner-tmp
              mountPath: /tmp
      volumes:
        - name: runner-work-ephemeral
          emptyDir:
            medium: Memory # Volume RAM-disk berkecepatan tinggi yang musnah seketika
            sizeLimit: 4Gi
        - name: runner-tmp
          emptyDir:
            sizeLimit: 1Gi

# kyverno-slsa-verification.yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-slsa3-provenance-and-cosign
  annotations:
    policies.kyverno.io/title: "Verify SLSA Level 3 Provenance & Cosign Signature"
    policies.kyverno.io/category: "Software Supply Chain Security"
    policies.kyverno.io/severity: "critical"
spec:
  validationFailureAction: Enforce
  webhookTimeoutSeconds: 30
  rules:
    - name: verify-cosign-signature-and-attestation
      match:
        any:
          - resources:
              kinds: ["Pod"]
              namespaces: ["core-banking", "production"]
      verifyImages:
        - imageReferences:
            - "ghcr.io/lanina-corp/*"
          attestors:
            - entries:
                - keyless:
                    issuer: "https://token.actions.githubusercontent.com"
                    subject: "https://github.com/lanina-corp/banking-workflows/.github/workflows/release.yaml@refs/heads/main"
                    rekor:
                      url: "https://rekor.sigstore.dev"
          attestations:
            - predicateType: "https://slsa.dev/provenance/v1"
              conditions:
                - all:
                    - key: "{{ builder.id }}"
                      operator: Equals
                      value: "https://github.com/actions/runner"
                    - key: "{{ buildDefinition.buildType }}"
                      operator: Equals
                      value: "https://actions.github.com/workflow/v1"

#!/usr/bin/env bash
# ==============================================================================
# Script: validate-crossplane-xrd.sh
# Deskripsi: Validasi & Audit Mendalam Arsitektur Crossplane Control Plane:
#            XRDs, Compositions, Managed Resources (MRs), serta Cloud Reconcilers.
# Author: La Nina 🌊 | Data Sintetis: RFC 5737
# ==============================================================================

set -euo pipefail

RED=''
GREEN=''
YELLOW=''
BLUE=''
CYAN=''
BOLD=''
NC=''

log_info() { echo -e "${BLUE}[INFO]${NC} $(date '+%Y-%m-%d %H:%M:%S') - $1"; }
log_ok()   { echo -e "${GREEN}[OK]${NC}   $(date '+%Y-%m-%d %H:%M:%S') - $1"; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $(date '+%Y-%m-%d %H:%M:%S') - $1"; }
log_err()  { echo -e "${RED}[ERR]${NC}  $(date '+%Y-%m-%d %H:%M:%S') - $1"; }

echo -e "${BOLD}${CYAN}========================================================================${NC}"
echo -e "${BOLD}${CYAN}   CROSSPLANE CONTROL PLANE HEALTH & DRIFT AUDITOR - 2026 EDITION       ${NC}"
echo -e "${BOLD}${CYAN}========================================================================${NC}"

# 1. Verifikasi Status Pod Provider
log_info "Memeriksa ketersediaan Pod Provider Crossplane..."
kubectl get pods -n crossplane-system -l "pkg.crossplane.io/provider" --no-headers | while read -r line; do
    POD_NAME=$(echo "$line" | awk '{print $1}')
    POD_STATUS=$(echo "$line" | awk '{print $3}')
    if [[ "$POD_STATUS" == "Running" ]]; then
        log_ok "Provider Pod: $POD_NAME [STATUS: $POD_STATUS]"
    else
        log_err "Provider Pod Tidak Sehat: $POD_NAME [STATUS: $POD_STATUS]"
    fi
done

# 2. Audit CompositeResourceDefinitions (XRD)
log_info "Memeriksa status Established & Offered pada seluruh XRD..."
kubectl get xrd -o jsonpath='{range .items[*]}{.metadata.name}{"	"}{range .status.conditions[*]}{.type}={.status}{" "}{end}{"
"}{end}' | while read -r line; do
    XRD_NAME=$(echo "$line" | awk '{print $1}')
    CONDITIONS=$(echo "$line" | cut -f2-)
    if [[ "$CONDITIONS" =~ "Established=True" ]] && [[ "$CONDITIONS" =~ "Offered=True" ]]; then
        log_ok "XRD: $XRD_NAME [ESTABLISHED & OFFERED]"
    else
        log_warn "XRD Anomali: $XRD_NAME [CONDITIONS: $CONDITIONS]"
    fi
done

# 3. Audit Managed Resources (MR) Sinkronisasi & Drift
log_info "Memeriksa sinkronisasi status SYNCED & READY pada Managed Resources..."
kubectl get managed -o jsonpath='{range .items[*]}{.kind}{"/"}{.metadata.name}{"	"}{.status.conditions[?(@.type=="Synced")].status}{"	"}{.status.conditions[?(@.type=="Ready")].status}{"
"}{end}' | while read -r line; do
    MR_NAME=$(echo "$line" | awk '{print $1}')
    SYNCED=$(echo "$line" | awk '{print $2}')
    READY=$(echo "$line" | awk '{print $3}')

    if [[ "$SYNCED" == "True" ]] && [[ "$READY" == "True" ]]; then
        log_ok "Resource: $MR_NAME [SYNCED: True, READY: True]"
    else
        log_err "Resource Drift/Error: $MR_NAME [SYNCED: $SYNCED, READY: $READY]"
    fi
done

#!/usr/bin/env bash
# ==============================================================================
# Script: benchmark-rollouts-canary.sh
# Deskripsi: Injeksi beban trafik sintetis dan validasi SLA Automated Rollback
# Author: La Nina 🌊 | Target IP: 198.51.100.25 (RFC 5737 Synthetic Gateway)
# ==============================================================================

set -euo pipefail

TARGET_GATEWAY_URL="http://198.51.100.25/api/v1/payments/checkout"
ROLLOUT_NAME="payment-engine"
NAMESPACE="core-banking"

echo "[TEST] Memulai verifikasi Progressive Delivery Canary..."
INITIAL_STEP=$(kubectl argo rollouts get rollout "${ROLLOUT_NAME}" -n "${NAMESPACE}" -o json | jq -r '.status.currentStepIndex')
echo "[INFO] Step awal kanari terdeteksi pada indeks: ${INITIAL_STEP}"

echo "[STRESS] Menginjeksi 1.000 request dengan 15% kegagalan HTTP 500 sintetis..."
for i in $(seq 1 1000); do
    if (( i % 7 == 0 )); then
        # Injeksi header trigger error simulasi
        curl -s -o /dev/null -H "X-Synthetic-Fault: error500" "${TARGET_GATEWAY_URL}" || true
    else
        curl -s -o /dev/null "${TARGET_GATEWAY_URL}" || true
    fi
done

echo "[AUDIT] Mengamati reaksi Argo Rollouts AnalysisRun..."
START_TIME=$(date +%s)
while true; do
    PHASE=$(kubectl argo rollouts get rollout "${ROLLOUT_NAME}" -n "${NAMESPACE}" -o json | jq -r '.status.phase')
    if [[ "${PHASE}" == "Degraded" ]] || [[ "${PHASE}" == "Aborted" ]]; then
        END_TIME=$(date +%s)
        ELAPSED=$((END_TIME - START_TIME))
        echo "================================================================="
        echo "✅ SUCCESS: Automated Rollback terpicu dalam ${ELAPSED} detik!"
        echo "Status Rollout beralih ke: ${PHASE}"
        echo "Bobot trafik canary berhasil dipangkas kembali ke 0%."
        echo "================================================================="
        break
    fi
    sleep 2
done

#!/usr/bin/env bash
# ==============================================================================
# Script: audit-ambient-mesh-traffic.sh
# Deskripsi: Audit data-plane Istio Ambient, soket ztunnel, dan HBONE handshake
# Author: La Nina 🌊 | Port Terproteksi: 15008 (mTLS HBONE), 15006 (Inbound Plain)
# ==============================================================================

set -euo pipefail

echo "=== MEMERIKSA STATUS LISTENER ZTUNNEL PADA HOST LOCAL ==="
ss -tulpn | grep -E "15008|15006" || {
    echo "❌ ERROR: Listener ztunnel tidak aktif di port 15008 / 15006!"
    exit 1
}
echo "✅ OK: ztunnel Rust Daemon aktif mendengarkan koneksi HBONE (Port 15008)."

echo "=== AUDIT KONEKSI AKTIF OVERLAY ENKAPSULASI HBONE ==="
ss -tnp '( dport = :15008 or sport = :15008 )'

echo "=== VALIDASI IDENTITAS SPIFFE PADA ZTUNNEL CERTIFICATE CACHE ==="
ZTUNNEL_POD=$(kubectl get pods -n istio-system -l app=ztunnel -o jsonpath='{.items[0].metadata.name}')
kubectl exec -n istio-system "${ZTUNNEL_POD}" -c ztunnel --     curl -s http://localhost:15000/config_dump | jq '.certificates[] | {subject: .subject, valid_to: .valid_to}'

{"level":"info","ts":"2026-09-17T14:22:01.102Z","msg":"Reconciling external resource","diff":"- spec.forProvider.allocatedStorage: 100
+ status.atProvider.allocatedStorage: 120"}