ENGINEERING_DOCS

Raw technical specifications, Kubernetes manifests, and operational playbooks for the Offline Security Auditor (OSA).

01. Custom Resource Definition (CRD)

The OSAPolicy CRD defines how logs are ingested and which anomaly detection engines (Z-Score, Markov) are applied to the workload.

# osa-policy-crd.yaml
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
name: osapolicies.security.osa.dev
spec:
group: security.osa.dev
versions:
- name: v1alpha1
served: true
storage: true
schema:
openAPIV3Schema:
type: object
properties:
spec:
type: object
properties:
engines:
type: array
items:
type: string
enum: ["z-score", "markov"]
logFormat:
type: string
threshold:
type: number
scope: Namespaced
names:
plural: osapolicies
singular: osapolicy
kind: OSAPolicy
shortNames:
- osap

02. Sidecar Injection Webhook

OSA operates as a zero-dependency Go binary injected as a sidecar. The mutating admission webhook automatically intercepts pod creation if the osa-injection=enabled label is present.

# mutating-webhook-config.yaml
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
name: osa-sidecar-injector
webhooks:
- name: inject.osa.dev
clientConfig:
service:
name: osa-injector-svc
namespace: osa-system
path: "/mutate"
caBundle: "Cg==" # Injected by cert-manager
rules:
- operations: [ "CREATE" ]
apiGroups: [""]
apiVersions: ["v1"]
resources: ["pods"]
namespaceSelector:
matchLabels:
osa-injection: enabled
admissionReviewVersions: ["v1"]
sideEffects: None

03. Daemon Boot Trace

Raw terminal output from the OSA sidecar initializing within an air-gapped pod environment.

$ osa-daemon --config /etc/osa/policy.yaml

[15:23:01.002] INFO: Booting OSA (Offline Security Auditor) v1.4.2

[15:23:01.005] INFO: Detected air-gapped environment. Network outbound disabled.

[15:23:01.015] INIT: Loading Z-Score anomaly engine...

[15:23:01.028] INIT: Compiling Markov Chain probability matrices...

[15:23:01.045] SUCCESS: Log ingestion pipeline attached to /var/log/app/*.log

[15:24:12.881] WARN: [Z-Score 3.8] Suspicious frequency of 401 Unauthorized from internal IP.

[15:24:15.002] CRIT: [Markov] Sequence deviation threshold exceeded (0.92). Possible lateral movement.

[15:24:15.005] ACTN: Writing local audit event to /var/log/osa/audit.json