feat(infra,analytics): startup probes, AWS Macie discovery, multi-tenancy framework, authenticity dashboard - #1067
Open
Ummi-001 wants to merge 1 commit into
Conversation
… framework, authenticity dashboard - k8s: add startup probes for all services (gates liveness/readiness) (PinSpace-Org#921) - terraform: enable AWS Macie with scheduled S3 scanning and custom data identifiers (PinSpace-Org#920) - monitoring: severity-routed Macie alert rules - k8s: tenant isolation template + onboarding automation for shared-cluster multi-tenancy (PinSpace-Org#919) - analytics: content authenticity scoring model and dashboard with distribution, trend, flagging and export (PinSpace-Org#798) Closes PinSpace-Org#921, closes PinSpace-Org#920, closes PinSpace-Org#919, closes PinSpace-Org#798
|
@Ummi-001 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Single PR resolving all four issues currently assigned to @Ummi-001.
Closes #921 – Kubernetes container startup probe configuration
infrastructure/k8s/probes/startup-probes.yaml: canonical startup-probe snippets for backend, frontend, analytics and postgresbackend-deployment.yamlgains astartupProbe(30×10s = 300s budget) that gates liveness/readiness; theirinitialDelaySecondsdropped to 5s/1s so steady-state crashes are still caught fastinfrastructure/docs/startup-probes.mddocuments probe semantics, sizing rule (threshold × period ≈ 2× p99 startup) and per-service rationaleCloses #920 – AWS Macie sensitive data discovery
terraform/macie.tf: Macie enablement, encrypted/versioned findings bucket, daily scheduled classification job over uploads/backups/logs buckets, EventBridge severity routing (Critical/High → existing alerts SNS, Low/Medium → digest topic), remediation playbook summaryterraform/macie-identifiers.tf: custom data identifiers for Stellar secret keys (S...), public keys, service API tokens and DB connection strings, attached to a scheduled scanmonitoring/macie-alerts.yml: Prometheus/Alertmanager rules with severity-routed receivers + scan-job health alertsCloses #919 – Kubernetes multi-tenancy isolation framework
k8s/multi-tenancy/tenant-template.yaml: per-tenant namespace, tier-sized ResourceQuota + LimitRange, default-deny NetworkPolicies (intra-tenant + DNS-only egress), scoped RBAC, pod-security labels — 9-document templatescripts/onboard-tenant.sh: validates RFC-1123 tenant names, renders quotas by tier via envsubst, applies, verifies isolation objectsdocs/multi-tenancy.md: architecture, virtual-cluster (vcluster) approach for control-plane tenants, verification/offboarding runbookCloses #798 – Content authenticity score dashboard
analytics/lib/authenticity-score.ts: weighted-blend scoring model over five spam signals (lexical originality, link-spam ratio, engagement authenticity, author reputation, formatting quality), report penalties, distribution buckets, 6-week trend series, CSV export of flagged contentanalytics/app/authenticity/page.tsx: KPI cards, score-distribution histogram, improvement-over-time line chart, flagged-content table with export buttonVerification
bash -npasses on the onboarding scripttsc --noEmit: clean for both new files (remaining project errors are pre-existing in untouched files)