@oneuptime/common 14.0.0 → 14.0.2

package/Tests/Utils/AiRemediation/KubectlWaitBudget.test.ts

@@ -0,0 +1,267 @@
+import KubectlWaitBudget, {
+  KUBECTL_WAIT_OVERHEAD_MS,
+  KubectlWaitBudgetResult,
+  KubectlWaitPlan,
+  MIN_KUBECTL_CLAIM_TIMEOUT_MS,
+  MIN_KUBECTL_TIMEOUT_MS,
+} from "../../../Utils/AiRemediation/KubectlWaitBudget";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * Contract under test — the planner that keeps one kubectl command's wait
+ * (claim window + execution timeout + poll slack) inside the AI run's
+ * remaining wall clock:
+ *  1. without a deadline the requested windows are used unchanged;
+ *  2. with room to spare they are used unchanged too;
+ *  3. as the deadline nears, execution keeps its request until the claim
+ *     floor is threatened, and the claim window gives way first;
+ *  4. below the floors the command is refused with the numbers a caller
+ *     needs to explain why;
+ *  5. whatever the inputs, claim + execution + overhead never exceeds the
+ *     time left.
+ */
+
+const CLAIM_MS: number = 60_000;
+const NOW_MS: number = 1_700_000_000_000;
+
+function planWithRemaining(
+  remainingMs: number,
+  requestedTimeoutInMs: number,
+): KubectlWaitBudgetResult {
+  return KubectlWaitBudget.plan({
+    requestedTimeoutInMs,
+    maxClaimTimeoutInMs: CLAIM_MS,
+    deadlineAtMs: NOW_MS + remainingMs,
+    nowMs: NOW_MS,
+  });
+}
+
+function expectPlan(result: KubectlWaitBudgetResult): KubectlWaitPlan {
+  if (!result.ok) {
+    throw new Error(
+      `Expected a plan, got a refusal: ${JSON.stringify(result.refusal)}`,
+    );
+  }
+  return result.plan;
+}
+
+describe("KubectlWaitBudget.plan", () => {
+  it("uses the requested windows unchanged when there is no deadline", () => {
+    const plan: KubectlWaitPlan = expectPlan(
+      KubectlWaitBudget.plan({
+        requestedTimeoutInMs: 30_000,
+        maxClaimTimeoutInMs: CLAIM_MS,
+      }),
+    );
+
+    expect(plan).toEqual({
+      timeoutInMs: 30_000,
+      claimTimeoutInMs: CLAIM_MS,
+      isClamped: false,
+    });
+  });
+
+  it.each([NaN, Infinity, -Infinity])(
+    "treats a non-finite deadline (%s) as no deadline",
+    (deadlineAtMs: number) => {
+      const plan: KubectlWaitPlan = expectPlan(
+        KubectlWaitBudget.plan({
+          requestedTimeoutInMs: 30_000,
+          maxClaimTimeoutInMs: CLAIM_MS,
+          deadlineAtMs,
+          nowMs: NOW_MS,
+        }),
+      );
+
+      expect(plan.isClamped).toBe(false);
+      expect(plan.timeoutInMs).toBe(30_000);
+      expect(plan.claimTimeoutInMs).toBe(CLAIM_MS);
+    },
+  );
+
+  it("leaves both windows alone while the budget has room for them", () => {
+    const plan: KubectlWaitPlan = expectPlan(
+      planWithRemaining(150_000, 30_000),
+    );
+
+    expect(plan.timeoutInMs).toBe(30_000);
+    expect(plan.claimTimeoutInMs).toBe(CLAIM_MS);
+    expect(plan.isClamped).toBe(false);
+    expect(plan.remainingBudgetMs).toBe(150_000);
+  });
+
+  it("is exact at the boundary where the full windows just fit", () => {
+    const exactFit: number = CLAIM_MS + 30_000 + KUBECTL_WAIT_OVERHEAD_MS;
+
+    const fits: KubectlWaitPlan = expectPlan(
+      planWithRemaining(exactFit, 30_000),
+    );
+    expect(fits.isClamped).toBe(false);
+    expect(fits.claimTimeoutInMs).toBe(CLAIM_MS);
+
+    const clipped: KubectlWaitPlan = expectPlan(
+      planWithRemaining(exactFit - 1, 30_000),
+    );
+    expect(clipped.isClamped).toBe(true);
+    expect(clipped.timeoutInMs).toBe(30_000);
+    expect(clipped.claimTimeoutInMs).toBe(CLAIM_MS - 1);
+  });
+
+  it("shortens the claim window first and keeps the requested execution time", () => {
+    // 80 s left: execution keeps its 30 s, the claim window shrinks to fit.
+    const plan: KubectlWaitPlan = expectPlan(planWithRemaining(80_000, 30_000));
+
+    expect(plan.timeoutInMs).toBe(30_000);
+    expect(plan.claimTimeoutInMs).toBe(
+      80_000 - KUBECTL_WAIT_OVERHEAD_MS - 30_000,
+    );
+    expect(plan.isClamped).toBe(true);
+  });
+
+  it("clamps a maximal execution request once the claim floor is threatened", () => {
+    // The finding's scenario: 120 s asked for with well under that left.
+    const remaining: number = 40_000;
+    const plan: KubectlWaitPlan = expectPlan(
+      planWithRemaining(remaining, 120_000),
+    );
+
+    expect(plan.claimTimeoutInMs).toBe(MIN_KUBECTL_CLAIM_TIMEOUT_MS);
+    expect(plan.timeoutInMs).toBe(
+      remaining - KUBECTL_WAIT_OVERHEAD_MS - MIN_KUBECTL_CLAIM_TIMEOUT_MS,
+    );
+    expect(plan.isClamped).toBe(true);
+    expect(KubectlWaitBudget.getWorstCaseWaitMs(plan)).toBeLessThanOrEqual(
+      remaining,
+    );
+  });
+
+  it("gives the floors exactly when only the minimum budget is left", () => {
+    const plan: KubectlWaitPlan = expectPlan(
+      planWithRemaining(KubectlWaitBudget.getMinimumBudgetMs(), 120_000),
+    );
+
+    expect(plan.timeoutInMs).toBe(MIN_KUBECTL_TIMEOUT_MS);
+    expect(plan.claimTimeoutInMs).toBe(MIN_KUBECTL_CLAIM_TIMEOUT_MS);
+    expect(KubectlWaitBudget.getWorstCaseWaitMs(plan)).toBe(
+      KubectlWaitBudget.getMinimumBudgetMs(),
+    );
+  });
+
+  it.each([
+    ["one millisecond under the minimum", -1],
+    ["ten seconds", -KubectlWaitBudget.getMinimumBudgetMs() + 10_000],
+    ["nothing", -KubectlWaitBudget.getMinimumBudgetMs()],
+    [
+      "a deadline already passed",
+      -KubectlWaitBudget.getMinimumBudgetMs() - 5_000,
+    ],
+  ])(
+    "refuses when %s is left, reporting what is left and what is needed",
+    (_label: string, offsetFromMinimum: number) => {
+      const remaining: number =
+        KubectlWaitBudget.getMinimumBudgetMs() + offsetFromMinimum;
+      const result: KubectlWaitBudgetResult = planWithRemaining(
+        remaining,
+        1_000,
+      );
+
+      expect(result.ok).toBe(false);
+      if (result.ok) {
+        return;
+      }
+      expect(result.refusal).toEqual({
+        remainingBudgetMs: remaining,
+        minimumBudgetMs: KubectlWaitBudget.getMinimumBudgetMs(),
+      });
+    },
+  );
+
+  it("never lets the requested timeout fall below the execution floor", () => {
+    const plan: KubectlWaitPlan = expectPlan(
+      KubectlWaitBudget.plan({
+        requestedTimeoutInMs: 0,
+        maxClaimTimeoutInMs: CLAIM_MS,
+      }),
+    );
+
+    expect(plan.timeoutInMs).toBe(MIN_KUBECTL_TIMEOUT_MS);
+  });
+
+  it("never lets the claim window fall below the claim floor", () => {
+    const plan: KubectlWaitPlan = expectPlan(
+      KubectlWaitBudget.plan({
+        requestedTimeoutInMs: 30_000,
+        maxClaimTimeoutInMs: 1_000,
+        deadlineAtMs: NOW_MS + 150_000,
+        nowMs: NOW_MS,
+      }),
+    );
+
+    expect(plan.claimTimeoutInMs).toBe(MIN_KUBECTL_CLAIM_TIMEOUT_MS);
+  });
+
+  it("defaults the clock to now", () => {
+    const before: number = Date.now();
+    const result: KubectlWaitBudgetResult = KubectlWaitBudget.plan({
+      requestedTimeoutInMs: 30_000,
+      maxClaimTimeoutInMs: CLAIM_MS,
+      deadlineAtMs: before + 150_000,
+    });
+
+    const plan: KubectlWaitPlan = expectPlan(result);
+    expect(plan.remainingBudgetMs).toBeLessThanOrEqual(150_000);
+    expect(plan.remainingBudgetMs).toBeGreaterThan(140_000);
+  });
+
+  /*
+   * The invariant behind the finding: whatever is asked for and whatever is
+   * left, a planned wait ends before the deadline — or is refused.
+   */
+  it("keeps claim + execution + overhead within the remaining budget for every input", () => {
+    const remainings: Array<number> = [
+      -10_000, 0, 5_000, 16_999, 17_000, 17_001, 20_000, 30_000, 45_000, 60_000,
+      75_000, 96_000, 100_000, 125_000, 150_000, 186_000, 200_000, 600_000,
+    ];
+    const requests: Array<number> = [
+      1_000, 5_000, 29_999, 30_000, 60_000, 90_000, 119_999, 120_000,
+    ];
+
+    let plans: number = 0;
+    let refusals: number = 0;
+
+    for (const remaining of remainings) {
+      for (const requested of requests) {
+        const result: KubectlWaitBudgetResult = planWithRemaining(
+          remaining,
+          requested,
+        );
+
+        if (!result.ok) {
+          refusals++;
+          expect(remaining).toBeLessThan(
+            KubectlWaitBudget.getMinimumBudgetMs(),
+          );
+          continue;
+        }
+
+        plans++;
+        const plan: KubectlWaitPlan = result.plan;
+        expect(KubectlWaitBudget.getWorstCaseWaitMs(plan)).toBeLessThanOrEqual(
+          remaining,
+        );
+        expect(plan.timeoutInMs).toBeGreaterThanOrEqual(MIN_KUBECTL_TIMEOUT_MS);
+        expect(plan.timeoutInMs).toBeLessThanOrEqual(requested);
+        expect(plan.claimTimeoutInMs).toBeGreaterThanOrEqual(
+          MIN_KUBECTL_CLAIM_TIMEOUT_MS,
+        );
+        expect(plan.claimTimeoutInMs).toBeLessThanOrEqual(CLAIM_MS);
+        expect(plan.isClamped).toBe(
+          plan.timeoutInMs < requested || plan.claimTimeoutInMs < CLAIM_MS,
+        );
+      }
+    }
+
+    expect(plans).toBeGreaterThan(0);
+    expect(refusals).toBeGreaterThan(0);
+  });
+});

package/Tests/Utils/AiRemediation/KubectlWriteScope.test.ts

@@ -0,0 +1,390 @@
+/*
+ * ---------------------------------------------------------------------------
+ * KubectlWriteScope: the Runner's own namespace bound on AI-composed kubectl
+ * writes.
+ *
+ * The finding this pins: the kubernetes-agent chart bound its write RBAC
+ * cluster-wide, and patch/update on a workload template (or create on a
+ * job) is running any image as any ServiceAccount of that namespace. So
+ * `set image deployment/ingress-nginx-controller -n ingress-nginx ...` or
+ * `scale deployment coredns -n kube-system --replicas=0` ran wherever the
+ * policy tiered them, and nothing on the Runner looked at the namespace.
+ * Now every non-Read argv is refused before spawning when its namespace is
+ * the Runner pod's own, or outside ONEUPTIME_KUBECTL_WRITE_NAMESPACES.
+ *
+ * Two halves: reading the namespace exactly the way kubectl does (every
+ * spelling, and refusing what cannot be read for certain), and the verdict.
+ *
+ * The rule moved from the Runner into Common so the Runner, the server's
+ * enqueue chokepoint and the remediation toolkit ask ONE function; these
+ * cases moved with it unchanged (KubectlWriteScopeCallerParity holds the
+ * three callers to it).
+ * ---------------------------------------------------------------------------
+ */
+
+import KubectlWriteScope, {
+  KubectlNamespaceResolution,
+  KubectlWriteScopeRefusal,
+} from "../../../Utils/AiRemediation/KubectlWriteScope";
+import KubectlPolicy, {
+  KubectlTokenizeResult,
+} from "../../../Utils/AiRemediation/KubectlPolicy";
+import { KubectlCommandTier } from "../../../Types/Kubernetes/KubernetesClusterAiAccess";
+import { describe, expect, test } from "@jest/globals";
+
+const POD_NAMESPACE: string = "oneuptime-agent";
+
+function resolve(args: Array<string>): KubectlNamespaceResolution {
+  return KubectlWriteScope.resolveNamespaces(args);
+}
+
+/*
+ * The verdict for a command, tokenized the way the server tokenizes it.
+ * The tier is passed in rather than taken from the shared policy: this
+ * layer only distinguishes Read from everything else, and its verdict must
+ * not depend on how the policy happens to tier a namespace today. The node
+ * switch is on: these cases are about the namespace scope.
+ *
+ * `usesCredential` picks what a missing -n means: "default" through a
+ * credential's kubeconfig, the pod's own namespace (unknown when
+ * podNamespace is null) in-cluster.
+ */
+function verdict(
+  command: string,
+  scope: {
+    writeNamespaces?: Array<string>;
+    podNamespace?: string | null;
+    usesCredential?: boolean;
+    tier?: KubectlCommandTier;
+  } = {},
+): string | null {
+  const tokenized: KubectlTokenizeResult = KubectlPolicy.tokenize(command);
+  const args: Array<string> = tokenized.args || [];
+
+  expect(args.length).toBeGreaterThan(0);
+
+  const refusal: KubectlWriteScopeRefusal | null = KubectlWriteScope.getRefusal(
+    {
+      command: {
+        args,
+        tier: scope.tier ?? KubectlCommandTier.RiskyWrite,
+        verb: KubectlPolicy.evaluateArgs(args).verb,
+        displayCommand: KubectlPolicy.renderDisplayCommand(args),
+      },
+      writeNamespaces: scope.writeNamespaces ?? [],
+      podNamespace:
+        scope.podNamespace === undefined ? POD_NAMESPACE : scope.podNamespace,
+      allowNodeOperations: true,
+      usesCredential: scope.usesCredential ?? false,
+    },
+  );
+
+  return refusal ? refusal.reason : null;
+}
+
+describe("KubectlWriteScope.resolveNamespaces reads -n the way kubectl does", () => {
+  test.each([
+    ["-n x", ["scale", "deploy/web", "-n", "web", "--replicas=1"], ["web"]],
+    ["-nx", ["scale", "deploy/web", "-nweb", "--replicas=1"], ["web"]],
+    ["-n=x", ["scale", "deploy/web", "-n=web", "--replicas=1"], ["web"]],
+    [
+      "--namespace x",
+      ["scale", "deploy/web", "--namespace", "web", "--replicas=1"],
+      ["web"],
+    ],
+    [
+      "--namespace=x",
+      ["scale", "deploy/web", "--namespace=web", "--replicas=1"],
+      ["web"],
+    ],
+    [
+      "-n before the verb",
+      ["-n", "web", "rollout", "restart", "deploy/web"],
+      ["web"],
+    ],
+    [
+      "inside a boolean cluster (-An x)",
+      ["get", "pods", "-An", "web"],
+      ["web"],
+    ],
+    ["inside a boolean cluster (-Anx)", ["get", "pods", "-Anweb"], ["web"]],
+    [
+      "after a boolean long flag",
+      ["label", "pod", "p", "--overwrite", "-n", "web", "a=b"],
+      ["web"],
+    ],
+    [
+      "after an optional-value flag written bare",
+      ["delete", "pod", "p", "--cascade", "-n", "web"],
+      ["web"],
+    ],
+    [
+      "after a value flag that carries its value inline",
+      ["get", "pods", "--selector=app=x", "-n", "web"],
+      ["web"],
+    ],
+    [
+      "after a value flag and its separate value",
+      ["get", "pods", "-l", "app=x", "-n", "web"],
+      ["web"],
+    ],
+    [
+      "after an inline short value",
+      ["get", "pods", "-lapp=x", "-nweb"],
+      ["web"],
+    ],
+    [
+      "every setting, in order (kubectl uses the last)",
+      ["get", "pods", "-n", "a", "--namespace=b"],
+      ["a", "b"],
+    ],
+    ["-n swallows a flag-looking value", ["get", "pods", "-n", "-A"], ["-A"]],
+    ["no -n at all", ["rollout", "restart", "deploy/web"], []],
+    [
+      "an n inside a value is not a namespace",
+      ["get", "pods", "-lnamespace=kube-system"],
+      [],
+    ],
+    [
+      "an n after a value letter is that letter's value",
+      ["get", "pods", "-lnkube-system"],
+      [],
+    ],
+    [
+      "an inline patch mentioning -n is a value",
+      ["patch", "deploy", "web", '-p{"spec":{"x":"-nkube-system"}}'],
+      [],
+    ],
+    [
+      "a positional that looks like a namespace flag value",
+      ["label", "pod", "p", "note=-nkube-system"],
+      [],
+    ],
+  ])("%s", (_label: string, args: Array<string>, expected: Array<string>) => {
+    const resolution: KubectlNamespaceResolution = resolve(args);
+
+    expect(resolution.ambiguity).toBeNull();
+    expect(resolution.namespaces).toEqual(expected);
+  });
+
+  /*
+   * Whether kubectl reads these as a namespace depends on something this
+   * reader cannot know for certain, so they are refused rather than
+   * guessed — both directions of a wrong guess would be a bypass.
+   */
+  test.each([
+    [
+      "right after a value flag written without its value",
+      ["rollout", "restart", "deploy/web", "--selector", "-n", "web"],
+    ],
+    ["right after -l", ["rollout", "restart", "deploy/web", "-l", "-nweb"]],
+    [
+      "right after a long flag this reader does not know",
+      ["scale", "deploy/web", "--brand-new-flag", "-n", "web"],
+    ],
+    ["after --", ["label", "pod", "p", "--", "-n", "web"]],
+    ["with an unknown short letter before it", ["get", "pods", "-Xn", "web"]],
+    ["-n with nothing after it", ["scale", "deploy/web", "-n"]],
+  ])("is ambiguous %s", (_label: string, args: Array<string>) => {
+    expect(resolve(args).ambiguity).not.toBeNull();
+  });
+
+  test.each([
+    ["-A", ["label", "pods", "--all", "-A", "x=y"], true],
+    ["--all-namespaces", ["label", "pods", "--all", "--all-namespaces"], true],
+    ["--all_namespaces", ["label", "pods", "--all", "--all_namespaces"], true],
+    ["-A inside a cluster", ["label", "pods", "-wA", "x=y"], true],
+    ["-An web", ["get", "pods", "-An", "web"], true],
+    [
+      "--all-namespaces=false",
+      ["get", "pods", "--all-namespaces=false"],
+      false,
+    ],
+    ["-A=false", ["get", "pods", "-A=false"], false],
+    ["an A inside a selector value", ["get", "pods", "-lA"], false],
+    ["-A as the namespace value", ["get", "pods", "-n", "-A"], false],
+    ["no -A at all", ["rollout", "restart", "deploy/web", "-n", "web"], false],
+  ])(
+    "reads all-namespaces: %s",
+    (_label: string, args: Array<string>, expected: boolean) => {
+      expect(resolve(args).allNamespaces).toBe(expected);
+    },
+  );
+});
+
+describe("KubectlWriteScope.getRefusal: the namespace scope", () => {
+  describe("the Runner pod's own namespace", () => {
+    test.each([
+      `kubectl scale deployment oneuptime-agent-kubernetes-agent -n ${POD_NAMESPACE} --replicas=0`,
+      `kubectl rollout restart deployment/x -n${POD_NAMESPACE}`,
+      `kubectl patch deployment x --namespace=${POD_NAMESPACE} -p '{"spec":{}}'`,
+      `kubectl -n ${POD_NAMESPACE} delete pod ai-runner-0`,
+      `kubectl scale deployment x -n ${POD_NAMESPACE.toUpperCase()} --replicas=0`,
+    ])("refuses `%s`", (command: string) => {
+      const reason: string | null = verdict(command);
+
+      expect(reason).not.toBeNull();
+      expect(reason).toContain(`"${POD_NAMESPACE}"`);
+      expect(reason).toContain("this Runner itself runs in");
+    });
+
+    /*
+     * In-cluster, a namespaced write with no -n runs in the pod's own
+     * namespace — the most natural way for a model to hit the agent.
+     */
+    test("refuses a write with no -n, which kubectl would run in the pod's namespace", () => {
+      const reason: string | null = verdict(
+        "kubectl rollout restart deployment/oneuptime-agent-kubernetes-agent",
+      );
+
+      expect(reason).not.toBeNull();
+      expect(reason).toContain("names no namespace");
+      expect(reason).toContain(POD_NAMESPACE);
+      expect(reason).toContain("-n <namespace>");
+    });
+
+    test("lets a write into any other namespace through when no list is set", () => {
+      expect(
+        verdict("kubectl rollout restart deployment/web -n web"),
+      ).toBeNull();
+      expect(
+        verdict("kubectl scale deployment coredns -n kube-system --replicas=2"),
+      ).toBeNull();
+    });
+  });
+
+  describe("the write-namespace list", () => {
+    const writeNamespaces: Array<string> = ["web", "api"];
+
+    test.each([
+      "kubectl scale deployment coredns -n kube-system --replicas=0",
+      "kubectl set image deployment/x -nkube-system c=i",
+      `kubectl patch pod p --namespace=kube-system -p '{"spec":{}}'`,
+      "kubectl set image deployment/ingress-nginx-controller -n ingress-nginx controller=attacker/img:1",
+      "kubectl -n kube-system delete pod coredns-abc",
+      // Every setting must be allowed, not just the one kubectl uses.
+      "kubectl rollout restart deployment/web -n kube-system -n web",
+    ])("refuses `%s`", (command: string) => {
+      const reason: string | null = verdict(command, { writeNamespaces });
+
+      expect(reason).not.toBeNull();
+      expect(reason).toContain("outside the namespaces");
+      expect(reason).toContain('"web", "api"');
+      expect(reason).toContain("ONEUPTIME_KUBECTL_WRITE_NAMESPACES");
+    });
+
+    test.each([
+      "kubectl rollout restart deployment/web -n web",
+      "kubectl scale deployment/api -n api --replicas=3",
+      `kubectl patch deployment web -n web -p'{"spec":{"paused":false}}'`,
+      "kubectl -n WEB rollout restart deployment/web",
+    ])("lets `%s` through", (command: string) => {
+      expect(verdict(command, { writeNamespaces })).toBeNull();
+    });
+
+    test('a write with no -n on the credential path lands in "default", which is not listed', () => {
+      const reason: string | null = verdict(
+        "kubectl rollout restart deployment/web",
+        { writeNamespaces, podNamespace: null, usesCredential: true },
+      );
+
+      expect(reason).toContain('"default"');
+      expect(reason).toContain("-n <namespace>");
+    });
+
+    test("a write with no -n whose default namespace is unknown is refused", () => {
+      const reason: string | null = verdict(
+        "kubectl rollout restart deployment/web",
+        { writeNamespaces, podNamespace: null, usesCredential: false },
+      );
+
+      expect(reason).toContain("names no namespace");
+    });
+
+    test("an ambiguous namespace is refused with the unambiguous spelling", () => {
+      const reason: string | null = verdict(
+        "kubectl rollout restart deployment/web --selector -n web",
+        { writeNamespaces },
+      );
+
+      expect(reason).toContain("cannot tell for certain");
+      expect(reason).toContain("kubectl -n <namespace>");
+    });
+
+    test("a write across every namespace is never inside a scope", () => {
+      for (const command of [
+        "kubectl label pods --all -A tier=x",
+        "kubectl -n web label pods --all --all-namespaces tier=x",
+      ]) {
+        const reason: string | null = verdict(command, { writeNamespaces });
+
+        expect(reason).toContain("every namespace");
+      }
+
+      // The pod-namespace rule alone refuses it too.
+      expect(
+        verdict("kubectl label pods --all -A tier=x", { writeNamespaces: [] }),
+      ).toContain("every namespace");
+    });
+
+    test("an ambiguous namespace is refused even when it names an allowed one", () => {
+      // kubectl may read "-n" as the selector's value and run in "default".
+      expect(
+        verdict("kubectl rollout restart deployment/web -l -n web", {
+          writeNamespaces,
+          podNamespace: null,
+          usesCredential: true,
+        }),
+      ).not.toBeNull();
+    });
+  });
+
+  describe("what is never namespace-scoped", () => {
+    test.each([
+      "kubectl get pods -n kube-system",
+      `kubectl logs coredns-abc -n ${POD_NAMESPACE}`,
+      "kubectl describe deployment web",
+      "kubectl get pods -A",
+    ])("a read: `%s`", (command: string) => {
+      expect(
+        verdict(command, {
+          writeNamespaces: ["web"],
+          tier: KubectlCommandTier.Read,
+        }),
+      ).toBeNull();
+    });
+
+    test("the same argv as a write IS scoped (the Read tier is what exempts it)", () => {
+      expect(
+        verdict("kubectl get pods -n kube-system", {
+          writeNamespaces: ["web"],
+          tier: KubectlCommandTier.SafeWrite,
+        }),
+      ).not.toBeNull();
+    });
+
+    test.each([
+      "kubectl cordon node-1",
+      "kubectl uncordon node-1",
+      "kubectl drain node-1 --ignore-daemonsets",
+      "kubectl taint nodes node-1 dedicated=ai:NoSchedule",
+    ])("a node operation: `%s`", (command: string) => {
+      expect(verdict(command, { writeNamespaces: ["web"] })).toBeNull();
+    });
+
+    test("nothing at all when no scope is configured", () => {
+      expect(
+        verdict(
+          "kubectl scale deployment coredns -n kube-system --replicas=0",
+          { writeNamespaces: [], podNamespace: null },
+        ),
+      ).toBeNull();
+      expect(
+        verdict("kubectl rollout restart deployment/web", {
+          writeNamespaces: [],
+          podNamespace: null,
+        }),
+      ).toBeNull();
+    });
+  });
+});