# VDA ISA Mapping auf Kubernetes
apiVersion: v1
kind: ConfigMap
metadata:
  name: vda-isa-mapping
  namespace: tisax-compliance
data:
  controls.yaml: |
    # 1. Informationssicherheits-Policies
    information-security-policies:
      vda-isa: "1.1, 1.2, 1.3"
      kubernetes:
        - Pod Security Standards
        - Network Policies
        - RBAC Policies
      evidence:
        - policy-definitions.yaml
        - namespace-configs/

    # 2. Organisation der Informationssicherheit
    organization:
      vda-isa: "2.1, 2.2"
      kubernetes:
        - Namespace-Ownership
        - RBAC Role Bindings
      evidence:
        - rbac-matrix.xlsx
        - team-responsibilities.md

    # 3. Asset Management
    asset-management:
      vda-isa: "3.1, 3.2, 3.3"
      kubernetes:
        - Resource Labels
        - Container Registry
        - ConfigMaps/Secrets
      evidence:
        - asset-inventory.yaml
        - image-catalog.md

    # 4. Zugriffssteuerung
    access-control:
      vda-isa: "4.1, 4.2, 4.3, 4.4"
      kubernetes:
        - RBAC
        - Service Accounts
        - OIDC Integration
        - MFA
      evidence:
        - rbac-roles/
        - authentication-config.yaml

    # 5. Kryptographie
    cryptography:
      vda-isa: "5.1, 5.2"
      kubernetes:
        - Secrets Encryption
        - mTLS (Service Mesh)
        - TLS Certificates
      evidence:
        - encryption-config.yaml
        - certificate-inventory.md

    # 6. Physische Sicherheit
    physical-security:
      vda-isa: "6.1, 6.2"
      kubernetes:
        - Cloud Provider Datacenter
        - Node Security Groups
      evidence:
        - datacenter-certification.pdf
        - cloud-security-config.yaml

# TISAX-konforme Namespace-Hierarchie
apiVersion: v1
kind: Namespace
metadata:
  name: oem-project-vw
  labels:
    tisax-label: "proto"
    tisax-al: "3"
    data-classification: "strictly-confidential"
    oem: "volkswagen"
    project-phase: "development"
  annotations:
    tisax.vda.de/scope-id: "SCOPE-12345"
    tisax.vda.de/assessment-date: "2025-11-15"
    tisax.vda.de/valid-until: "2028-11-15"
    tisax.vda.de/auditor: "TÜV Süd"
---
apiVersion: v1
kind: Namespace
metadata:
  name: oem-project-bmw
  labels:
    tisax-label: "info-high"
    tisax-al: "2"
    data-classification: "confidential"
    oem: "bmw"
---
apiVersion: v1
kind: Namespace
metadata:
  name: production-systems
  labels:
    tisax-label: "avail"
    tisax-al: "2"
    data-classification: "internal"

# TISAX AL3 Cluster-Konfiguration
apiVersion: apps/v1
kind: Deployment
metadata:
  name: prototype-cad-viewer
  namespace: oem-project-vw
  labels:
    app: cad-viewer
    tisax-scope: "proto"
  annotations:
    tisax.compliance/data-handling: "prototype-drawings"
    tisax.compliance/encryption: "required"
    tisax.compliance/access-logging: "enabled"
spec:
  replicas: 2
  selector:
    matchLabels:
      app: cad-viewer
  template:
    metadata:
      labels:
        app: cad-viewer
        tisax-scope: "proto"
    spec:
      serviceAccountName: cad-viewer-sa
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: cad-viewer
          image: cad-viewer:v2.0@sha256:abc123...
          imagePullPolicy: Always
          ports:
            - containerPort: 8443
              name: https
          env:
            - name: WATERMARK_ENABLED
              value: "true"
            - name: DOWNLOAD_DISABLED
              value: "true"
            - name: SCREENSHOT_PREVENTION
              value: "enabled"
            - name: SESSION_TIMEOUT_MINUTES
              value: "15"
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          resources:
            requests:
              cpu: "1"
              memory: "2Gi"
            limits:
              cpu: "2"
              memory: "4Gi"
          volumeMounts:
            - name: cad-data
              mountPath: /data
              readOnly: true
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: cad-data
          persistentVolumeClaim:
            claimName: prototype-data-encrypted
        - name: tmp
          emptyDir:
            medium: Memory
            sizeLimit: 100Mi

# Strikte Trennung zwischen OEM-Projekten
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: vw-project-engineer
  namespace: oem-project-vw
rules:
  - apiGroups: [""]
    resources: ["pods", "pods/log"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["get", "list", "watch"]
  # Kein Zugriff auf Secrets - nur über Vault
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: vw-team-binding
  namespace: oem-project-vw
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: vw-project-engineer
subjects:
  - kind: Group
    name: ad-group-vw-project
    apiGroup: rbac.authorization.k8s.io
---
# WICHTIG: Kein Cross-Namespace Zugriff
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: oem-isolation
  namespace: oem-project-vw
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - podSelector: {}  # Nur innerhalb des Namespace
  egress:
    - to:
        - podSelector: {}
    # Logging erlaubt
    - to:
        - namespaceSelector:
            matchLabels:
              name: logging
      ports:
        - protocol: TCP
          port: 514

# DLP (Data Loss Prevention) für Prototypen
apiVersion: v1
kind: ConfigMap
metadata:
  name: dlp-config
  namespace: oem-project-vw
data:
  policy.yaml: |
    # TISAX Proto Label Requirements
    data-loss-prevention:
      enabled: true

      # Keine Downloads erlaubt
      downloads:
        blocked: true
        exceptions: []

      # Wasserzeichen auf allen Dokumenten
      watermarking:
        enabled: true
        content: "CONFIDENTIAL - ${USER} - ${TIMESTAMP}"

      # Clipboard-Überwachung
      clipboard:
        monitoring: true
        blocking: true

      # Screenshot-Prävention
      screenshot:
        prevention: true
        detection: true
        alert: true

      # USB-Blockierung
      usb:
        blocked: true
        logging: true

      # Print-Kontrolle
      printing:
        blocked: true
        exceptions:
          - role: project-manager
            approval-required: true

# Vehicle Backend Services
apiVersion: apps/v1
kind: Deployment
metadata:
  name: vehicle-connectivity
  namespace: connected-car
spec:
  replicas: 10
  template:
    spec:
      containers:
        - name: mqtt-broker
          image: vehicle-mqtt:v3.0@sha256:...
          ports:
            - containerPort: 8883
              name: mqtts
          env:
            - name: MAX_CONNECTIONS
              value: "1000000"
            - name: TLS_VERSION
              value: "1.3"
            - name: CLIENT_AUTH
              value: "certificate"
          resources:
            requests:
              cpu: "4"
              memory: "8Gi"
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: vehicle-connectivity-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: vehicle-connectivity
  minReplicas: 10
  maxReplicas: 100
  metrics:
    - type: Pods
      pods:
        metric:
          name: mqtt_connections
        target:
          type: AverageValue
          averageValue: "100000"

# Manufacturing Execution System Integration
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mes-connector
  namespace: production
spec:
  replicas: 3
  template:
    spec:
      containers:
        - name: mes-adapter
          image: mes-connector:v2.5@sha256:...
          env:
            - name: MES_PROTOCOL
              value: "OPC-UA"
            - name: PRODUCTION_LINE
              value: "LINE-A,LINE-B,LINE-C"
            - name: DATA_COLLECTION_INTERVAL_MS
              value: "100"
          ports:
            - containerPort: 4840
              name: opcua
          volumeMounts:
            - name: mes-certs
              mountPath: /etc/opcua/certs
              readOnly: true
      volumes:
        - name: mes-certs
          secret:
            secretName: opcua-certificates

# Visual Inspection ML Pipeline
apiVersion: apps/v1
kind: Deployment
metadata:
  name: visual-inspection
  namespace: quality-assurance
spec:
  replicas: 5
  template:
    spec:
      containers:
        - name: inspection-model
          image: visual-inspection:v4.0@sha256:...
          resources:
            limits:
              nvidia.com/gpu: 1
          env:
            - name: MODEL_PATH
              value: "/models/defect-detection-v4"
            - name: CONFIDENCE_THRESHOLD
              value: "0.95"
            - name: INFERENCE_TIMEOUT_MS
              value: "100"
          volumeMounts:
            - name: models
              mountPath: /models
              readOnly: true
      volumes:
        - name: models
          persistentVolumeClaim:
            claimName: ml-models-pvc

# Lieferketten-Transparenz
apiVersion: apps/v1
kind: Deployment
metadata:
  name: supply-chain-tracker
  namespace: logistics
spec:
  replicas: 3
  template:
    spec:
      containers:
        - name: tracker-api
          image: supply-chain:v2.0@sha256:...
          env:
            - name: BLOCKCHAIN_ENABLED
              value: "true"
            - name: EDI_INTEGRATION
              value: "EDIFACT,VDA4905"
            - name: REAL_TIME_TRACKING
              value: "enabled"
          ports:
            - containerPort: 8443

## TISAX Kubernetes Evidence Package

### 1. Sicherheits-Policies
- [ ] Pod Security Standards (Restricted/Baseline)
- [ ] Network Policies pro Namespace
- [ ] RBAC-Dokumentation

### 2. Zugriffskontrolle
- [ ] RBAC-Matrix (Rolle → Berechtigung → Person)
- [ ] Service Account Inventory
- [ ] MFA-Konfiguration (OIDC)
- [ ] Privileged Access Management

### 3. Kryptographie
- [ ] Encryption at Rest Config
- [ ] TLS-Zertifikat-Übersicht
- [ ] Key Management Prozess
- [ ] mTLS Service Mesh Config

### 4. Logging & Monitoring
- [ ] Kubernetes Audit Policy
- [ ] Log-Retention (mind. 1 Jahr)
- [ ] Alerting-Regeln
- [ ] SIEM-Integration

### 5. Prototypenschutz (wenn Proto-Label)
- [ ] DLP-Konfiguration
- [ ] Watermarking
- [ ] Access-Protokollierung
- [ ] Physische Sicherheit Clients