AI Kubernetes Workload Hardening and Security Policy Advisor

id: ai-kubernetes-manifest-hardening-advisor
namespace: company.platform

inputs:
  - id: manifest_url
    type: STRING
    defaults: "https://raw.githubusercontent.com/kubernetes/website/main/content/en\
      /examples/application/deployment.yaml"
    description: "URL of the raw Kubernetes manifest (YAML) to audit and harden"

  - id: auto_apply
    type: BOOL
    defaults: false
    description: "Whether to prompt for human approval to apply the hardened manifest"

tasks:
  - id: download_manifest
    type: io.kestra.plugin.core.http.Download
    uri: "{{ inputs.manifest_url }}"

  - id: audit_k8s_manifest_ai
    type: io.kestra.plugin.ai.completion.ChatCompletion
    description: "Audits Kubernetes manifest against NSA/CISA benchmarks using
      Kestra AI completion"
    provider:
      type: io.kestra.plugin.ai.provider.OpenAI
      apiKey: "{{ secret('OPENAI_API_KEY') }}"
      modelName: "gpt-4o-mini"
    messages:
      - type: SYSTEM
        content: |
          You are a Senior Kubernetes Security Specialist following NSA/CISA and CIS Kubernetes Benchmark guidelines.
          Audit the provided Kubernetes manifest.
          1. Identify missing securityContext (runAsNonRoot, readOnlyRootFilesystem, allowPrivilegeEscalation: false, drop ALL capabilities), missing resource limits/requests, and missing readiness/liveness probes.
          2. Generate a fully hardened, production-ready replacement YAML manifest.
          3. Rate overall compliance score from 0 to 100.

          Respond strictly with valid JSON matching the requested schema.
      - type: USER
        content: |
          Raw Kubernetes Manifest:
          ```yaml
          {{ read(outputs.download_manifest.uri) }}
          ```
    configuration:
      responseFormat:
        type: JSON
        jsonSchema:
          type: object
          properties:
            compliance_score:
              type: integer
            severity:
              type: string
              enum: [ "LOW", "MEDIUM", "HIGH", "CRITICAL" ]
            violations_found:
              type: array
              items:
                type: string
            hardened_yaml:
              type: string
            summary:
              type: string
          required:
            - compliance_score
            - severity
            - violations_found
            - hardened_yaml
            - summary

  - id: generate_artifacts
    type: io.kestra.plugin.scripts.python.Script
    description: "Parses AI evaluation output and produces downloadable audit report
      and hardened manifest files"
    warningOnStdErr: false
    taskRunner:
      type: io.kestra.plugin.scripts.runner.docker.Docker
    containerImage: ghcr.io/kestra-io/pydata:latest
    env:
      AI_RESPONSE: "{{ outputs.audit_k8s_manifest_ai.choices[0].message.content }}"
    script: |
      import os
      import json
      from kestra import Kestra

      raw_response = os.environ.get("AI_RESPONSE", "{}")
      try:
          data = json.loads(raw_response)
      except Exception:
          data = {
              "compliance_score": 50,
              "severity": "MEDIUM",
              "violations_found": ["Unknown violation"],
              "hardened_yaml": "# Hardened manifest unavailable",
              "summary": "AI audit parsing failed."
          }

      hardened_file = "hardened-deployment.yaml"
      with open(hardened_file, "w", encoding="utf-8") as f:
          f.write(data.get("hardened_yaml", ""))

      report_file = "k8s-security-audit-report.md"
      with open(report_file, "w", encoding="utf-8") as f:
          f.write("# Kubernetes Manifest Security Audit Report\n\n")
          f.write(f"**Compliance Score:** {data.get('compliance_score', 0)}/100\n")
          f.write(f"**Severity Level:** {data.get('severity', 'UNKNOWN')}\n\n")
          f.write("## Violations Detected\n")
          for v in data.get("violations_found", []):
              f.write(f"- {v}\n")
          f.write(f"\n## Summary\n{data.get('summary', '')}\n")

      Kestra.outputs({
          "compliance_score": data.get("compliance_score", 0),
          "severity": data.get("severity", "LOW"),
          "violation_count": len(data.get("violations_found", [])),
          "summary": data.get("summary", "")
      })
    outputFiles:
      - "hardened-deployment.yaml"
      - "k8s-security-audit-report.md"

  - id: notify_security_slack
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "channel": "#platform-security",
        "text": ":shield: *Kubernetes Security Manifest Audit Completed*\n*Source:* `{{ inputs.manifest_url }}`\n*Compliance Score:* {{ outputs.generate_artifacts.vars.compliance_score }}/100\n*Risk Severity:* {{ outputs.generate_artifacts.vars.severity }}\n*Violations Found:* {{ outputs.generate_artifacts.vars.violation_count }}\n*Hardened Manifest:* Available in execution outputs (`hardened-deployment.yaml`)."
      }

  - id: require_approval_gate
    type: io.kestra.plugin.core.flow.If
    description: "Gate applying the hardened manifest behind human verification when
      auto_apply is enabled"
    condition: "{{ inputs.auto_apply }}"
    then:
      - id: approval_gate
        type: io.kestra.plugin.core.flow.Pause
        description: "Pauses execution for platform engineer review and sign-off before
          applying hardened manifest"
        onResume:
          - id: proceed
            type: BOOL
            defaults: true
            description: "Approve applying the hardened manifest to the cluster"

      - id: apply_hardened_manifest
        type: io.kestra.plugin.kubernetes.kubectl.Apply
        description: "Applies the verified hardened manifest to the Kubernetes cluster"
        runIf: "{{ item.value.proceed ?? true }}"
        spec: "{{
          read(outputs.generate_artifacts.outputFiles['hardened-deployment.yaml'\
          ]) }}"