aegis-devops 0.3.0__tar.gz → 0.3.2__tar.gz

{aegis_devops-0.3.0/src/aegis_devops.egg-info → aegis_devops-0.3.2}/PKG-INFO

@@ -1,7 +1,8 @@
 Metadata-Version: 2.4
 Name: aegis-devops
-Version: 0.3.0
+Version: 0.3.2
 Summary: Provenance-backed, authority-aware policy verifier for agentic DevOps actions.
+Author: Vamshidher Reddy Jannapu Reddy
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/moneytool/aegis-devops
 Project-URL: Repository, https://github.com/moneytool/aegis-devops
@@ -33,7 +34,7 @@ Dynamic: license-file
 # Aegis-DevOps
 
 [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.22950337.svg)](https://doi.org/10.5281/zenodo.22950337)
-[![PyPI](https://img.shields.io/pypi/v/aegis-devops?label=pypi)](https://pypi.org/project/aegis-devops/)
+[![PyPI](https://img.shields.io/pypi/v/aegis-devops?label=PyPI&cacheSeconds=3600)](https://pypi.org/project/aegis-devops/)
 
 **Stop AI agents from running `kubectl delete`, `terraform destroy` or `DROP TABLE` because a
 ticket told them to.**
@@ -65,7 +66,10 @@ Codex, GitHub Copilot (CLI and VS Code), Cursor and OpenCode:
 (see [Coding agents](docs/agents.md)). It only acts in projects with a `.aegis/` policy, and
 only blocks what that policy blocks. It also works as a CI step
 (`aegis check terraform plan.json --exit-style ci`) and as a Python library; see
-[Quick start](#quick-start).
+[Quick start](#quick-start). In GitHub Actions, the
+[Aegis-DevOps Plan Check](https://github.com/marketplace/actions/aegis-devops-plan-check) Action
+checks a Terraform or OpenTofu plan and comments the verdict on the pull request:
+`uses: moneytool/aegis-devops-action@v1` with `plan: plan.json`.
 
 ## What it does
 
@@ -252,7 +256,7 @@ context a rule can arrive from a ticket or a chat message as easily as from you.
 
 The engine (constraint store, interceptor, environment mapping, dry-run handling, rate limits,
 plan-level constraints, and parsers for every tool in "Supported tools") is complete, and
-v0.3.0 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
+v0.3.2 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
 the API (cached in `results/llm-external.md`), Haiku through the Claude Code CLI, `gpt-6-astra`
 through the Codex CLI, and a local `mistral:latest`.
 

{aegis_devops-0.3.0 → aegis_devops-0.3.2}/README.md

@@ -1,7 +1,7 @@
 # Aegis-DevOps
 
 [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.22950337.svg)](https://doi.org/10.5281/zenodo.22950337)
-[![PyPI](https://img.shields.io/pypi/v/aegis-devops?label=pypi)](https://pypi.org/project/aegis-devops/)
+[![PyPI](https://img.shields.io/pypi/v/aegis-devops?label=PyPI&cacheSeconds=3600)](https://pypi.org/project/aegis-devops/)
 
 **Stop AI agents from running `kubectl delete`, `terraform destroy` or `DROP TABLE` because a
 ticket told them to.**
@@ -33,7 +33,10 @@ Codex, GitHub Copilot (CLI and VS Code), Cursor and OpenCode:
 (see [Coding agents](docs/agents.md)). It only acts in projects with a `.aegis/` policy, and
 only blocks what that policy blocks. It also works as a CI step
 (`aegis check terraform plan.json --exit-style ci`) and as a Python library; see
-[Quick start](#quick-start).
+[Quick start](#quick-start). In GitHub Actions, the
+[Aegis-DevOps Plan Check](https://github.com/marketplace/actions/aegis-devops-plan-check) Action
+checks a Terraform or OpenTofu plan and comments the verdict on the pull request:
+`uses: moneytool/aegis-devops-action@v1` with `plan: plan.json`.
 
 ## What it does
 
@@ -220,7 +223,7 @@ context a rule can arrive from a ticket or a chat message as easily as from you.
 
 The engine (constraint store, interceptor, environment mapping, dry-run handling, rate limits,
 plan-level constraints, and parsers for every tool in "Supported tools") is complete, and
-v0.3.0 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
+v0.3.2 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
 the API (cached in `results/llm-external.md`), Haiku through the Claude Code CLI, `gpt-6-astra`
 through the Codex CLI, and a local `mistral:latest`.
 

{aegis_devops-0.3.0 → aegis_devops-0.3.2}/pyproject.toml

@@ -7,6 +7,7 @@ name = "aegis-devops"
 license = "Apache-2.0"
 dynamic = ["version"]
 description = "Provenance-backed, authority-aware policy verifier for agentic DevOps actions."
+authors = [{ name = "Vamshidher Reddy Jannapu Reddy" }]
 readme = "README.md"
 requires-python = ">=3.11"
 dependencies = [

{aegis_devops-0.3.0 → aegis_devops-0.3.2}/src/aegis_core/__init__.py

@@ -4,4 +4,4 @@ infrastructure actions of AI agents.
 See the README for what this does and, importantly, what it does not yet do.
 """
 
-__version__ = "0.3.0"
+__version__ = "0.3.2"

aegis_devops-0.3.2/src/aegis_core/audit_kubernetes.py

@@ -0,0 +1,312 @@
+"""``aegis audit-identity kubernetes``: what the identity model means for the
+identities that exist in a cluster (design v0.3, §4.2, §4.3, §6.6).
+
+Read-only. The inventory -- ServiceAccounts, RBAC bindings, which
+ServiceAccounts pods run as, and SubjectAccessReviews for the escape
+permissions -- comes from :func:`collect_inventory` (kubectl with the
+operator's credentials) or a saved copy; :func:`audit` is pure.
+
+* ``would_restrict``: every identity the compiled policies would restrict --
+  ServiceAccounts, and users/groups named in RBAC bindings (the API has no
+  user objects) -- with the control plane exempt as in the compiler.
+* ``missing``: listed ServiceAccounts that do not exist, and a break-glass
+  group or user no binding grants anything (break-glass without access).
+* ``findings``: escape permissions an identity the policies restrict still
+  holds. Admission cannot see impersonation or protect admission objects, so
+  RBAC is the only control there.
+"""
+
+from __future__ import annotations
+
+import json
+import subprocess
+from concurrent.futures import ThreadPoolExecutor
+from dataclasses import dataclass, field
+from typing import Any
+
+from aegis_core.identity import IdentityModel
+
+# (id, why). Each check is asked as several SubjectAccessReviews (see
+# _probes): by name where RBAC can grant by name (resourceNames), per
+# namespace where a RoleBinding can grant it, and for every write verb that
+# disables a control (review of #22).
+ESCAPE_CHECKS: tuple[tuple[str, str], ...] = (
+    ("impersonate-users", "can act as another user (kubectl --as), a trusted or break-glass "
+                          "one included; admission then sees that user"),
+    ("impersonate-groups", "can claim another group, break-glass included"),
+    ("impersonate-serviceaccounts", "can act as another ServiceAccount"),
+    ("impersonate-uids", "can claim another identity's UID"),
+    ("write-admission-policies", "can update, patch or delete ValidatingAdmissionPolicies or "
+                                 "their bindings (make a rule always pass, or Deny into Warn), "
+                                 "which admission cannot protect"),
+    ("write-webhooks", "can update, patch or delete admission webhook configurations"),
+    ("create-mutating-admission", "can create a mutating webhook or mutating admission policy "
+                                  "that rewrites requests before validation"),
+    ("escalate-roles", "can grant itself permissions it does not hold (escalate)"),
+    ("bind-roles", "can bind any cluster role, cluster-admin included"),
+    ("write-clusterrolebindings", "can create or change cluster role bindings"),
+)
+_ADM = "admissionregistration.k8s.io"
+_RBAC = "rbac.authorization.k8s.io"
+_SA_PREFIX = "system:serviceaccount:"
+# every identity (or every ServiceAccount) carries these; agents.yaml refuses
+# to trust them, so they are not identities to review
+_UNIVERSAL_GROUPS = ("system:authenticated", "system:unauthenticated", "system:serviceaccounts")
+_HINTS = {
+    ("group", "system:masters"): "the super-admin group; usually break-glass",
+    ("user", "kube-apiserver-kubelet-client"): "the API server's client to kubelets; trust it",
+}
+
+
+class InventoryError(ValueError):
+    """The cluster inventory could not be collected or read."""
+
+
+def _is_control_plane(username: str, groups: list[str]) -> bool:
+    """The compiler's always-exempt set in deny-by-default."""
+    if username.startswith("system:") and not username.startswith(_SA_PREFIX):
+        return True
+    return "system:nodes" in groups or "system:serviceaccounts:kube-system" in groups
+
+
+def _sa_groups(namespace: str) -> list[str]:
+    return ["system:serviceaccounts", f"system:serviceaccounts:{namespace}",
+            "system:authenticated"]
+
+
+# --- collection ------------------------------------------------------------------------------
+
+
+def _run(context: str | None, *args: str) -> subprocess.CompletedProcess:
+    argv = ["kubectl", *(["--context", context] if context else []), *args]
+    try:
+        return subprocess.run(argv, capture_output=True, text=True, check=False)
+    except FileNotFoundError:
+        raise InventoryError("kubectl is not on PATH (or pass --inventory FILE)") from None
+
+
+def _kubectl(context: str | None, *args: str) -> str:
+    proc = _run(context, *args)
+    if proc.returncode != 0:
+        raise InventoryError(f"kubectl {' '.join(args)} failed: {proc.stderr.strip()[:300]}")
+    return proc.stdout
+
+
+def can_i(context: str | None, args: list[str]) -> bool:
+    """One SubjectAccessReview. ``kubectl auth can-i`` exits non-zero for
+    "no" too, so only an explicit yes/no answer counts: a failed review (no
+    right to impersonate for it, no SubjectAccessReview access, an API error)
+    is an error, never a quiet "no" (review of #22)."""
+    proc = _run(context, "auth", "can-i", *args)
+    lines = proc.stdout.strip().splitlines()
+    answer = lines[-1].strip() if lines else ""
+    if answer == "yes":
+        return True
+    if answer == "no":
+        return False
+    raise InventoryError(f"SubjectAccessReview failed (kubectl auth can-i {' '.join(args)}): "
+                         f"{(proc.stderr or proc.stdout).strip()[:300] or 'no answer'}")
+
+
+def _probes(model: IdentityModel, namespaces: list[str]) -> list[tuple[str, list[str], str]]:
+    """``(check, can-i arguments, target description)`` for every escape
+    check."""
+    exempt = model.exempt("kubernetes")
+    users = sorted({i.id for i in exempt if i.kind == "user"})
+    groups = sorted({i.id for i in exempt if i.kind == "group"} | {"system:masters"})
+    sas = sorted({i.id for i in exempt if i.kind == "serviceaccount"})
+    out: list[tuple[str, list[str], str]] = [
+        ("impersonate-users", ["impersonate", "users"], "any user"),
+        ("impersonate-groups", ["impersonate", "groups"], "any group"),
+        ("impersonate-uids", ["impersonate", "uids"], "any uid"),
+    ]
+    out += [("impersonate-users", ["impersonate", f"users/{u}"], f"user {u}") for u in users]
+    out += [("impersonate-groups", ["impersonate", f"groups/{g}"], f"group {g}") for g in groups]
+    for ns in sorted(set(namespaces)):
+        out.append(("impersonate-serviceaccounts", ["impersonate", "serviceaccounts", "-n", ns],
+                    f"any ServiceAccount in {ns}"))
+    for sa in sas:
+        ns, name = sa.split(":", 1)
+        out.append(("impersonate-serviceaccounts",
+                    ["impersonate", f"serviceaccounts/{name}", "-n", ns],
+                    f"ServiceAccount {sa}"))
+    for res in ("validatingadmissionpolicies", "validatingadmissionpolicybindings"):
+        for verb in ("update", "patch", "delete"):
+            out.append(("write-admission-policies", [verb, f"{res}.{_ADM}"], f"{verb} {res}"))
+    for res in ("validatingwebhookconfigurations", "mutatingwebhookconfigurations"):
+        for verb in ("update", "patch", "delete"):
+            out.append(("write-webhooks", [verb, f"{res}.{_ADM}"], f"{verb} {res}"))
+    for res in ("mutatingwebhookconfigurations", "mutatingadmissionpolicies",
+                "mutatingadmissionpolicybindings"):
+        out.append(("create-mutating-admission", ["create", f"{res}.{_ADM}"], f"create {res}"))
+    out.append(("escalate-roles", ["escalate", f"clusterroles.{_RBAC}"], "escalate clusterroles"))
+    out.append(("bind-roles", ["bind", f"clusterroles.{_RBAC}"], "bind clusterroles"))
+    for verb in ("create", "update", "patch"):
+        out.append(("write-clusterrolebindings", [verb, f"clusterrolebindings.{_RBAC}"],
+                    f"{verb} clusterrolebindings"))
+    return out
+
+
+def _identities(sas: list[dict], bindings: list[dict]) -> list[dict[str, Any]]:
+    out: dict[tuple[str, str], dict[str, Any]] = {}
+    for sa in sas:
+        ns, name = sa["namespace"], sa["name"]
+        user = f"{_SA_PREFIX}{ns}:{name}"
+        out[("serviceaccount", user)] = {"kind": "serviceaccount", "id": f"{ns}:{name}",
+                                         "username": user, "groups": _sa_groups(ns)}
+    for b in bindings:
+        for s in b.get("subjects") or []:
+            if s.get("kind") == "User":
+                out.setdefault(("user", s["name"]), {
+                    "kind": "user", "id": s["name"], "username": s["name"],
+                    "groups": ["system:authenticated"]})
+            elif s.get("kind") == "Group" and not (
+                    s["name"] in _UNIVERSAL_GROUPS
+                    or s["name"].startswith("system:serviceaccounts:")):
+                out.setdefault(("group", s["name"]), {
+                    "kind": "group", "id": s["name"], "username": "aegis-audit:probe",
+                    "groups": [s["name"], "system:authenticated"]})
+    return sorted(out.values(), key=lambda i: (i["kind"], i["id"]))
+
+
+def collect_inventory(context: str | None, model: IdentityModel) -> dict[str, Any]:
+    """ServiceAccounts, bindings, pod ServiceAccounts and, for every identity
+    the policies would restrict, the escape SubjectAccessReviews."""
+    sa_doc = json.loads(_kubectl(context, "get", "serviceaccounts", "-A", "-o", "json"))
+    sas = [{"namespace": i["metadata"]["namespace"], "name": i["metadata"]["name"]}
+           for i in sa_doc.get("items", [])]
+    bindings = []
+    for kind in ("clusterrolebindings", "rolebindings"):
+        doc = json.loads(_kubectl(context, "get", kind, "-A", "-o", "json"))
+        for i in doc.get("items", []):
+            bindings.append({"kind": kind, "namespace": i["metadata"].get("namespace", ""),
+                             "name": i["metadata"]["name"], "role": i["roleRef"]["name"],
+                             "subjects": i.get("subjects") or []})
+    pods = json.loads(_kubectl(context, "get", "pods", "-A", "-o", "json"))
+    pod_sas: dict[str, int] = {}
+    for p in pods.get("items", []):
+        key = f"{p['metadata']['namespace']}:{p['spec'].get('serviceAccountName', 'default')}"
+        pod_sas[key] = pod_sas.get(key, 0) + 1
+
+    inventory = {"serviceaccounts": sas, "bindings": bindings, "pod_serviceaccounts": pod_sas,
+                 "access": {}}
+    restricted = [i for i in _identities(sas, bindings) if _restricted(model, i)]
+    probes = _probes(model, [s["namespace"] for s in sas])
+
+    def ask(job):
+        ident, (check, args, target) = job
+        who = ["--as", ident["username"]]
+        for g in ident["groups"]:
+            who += ["--as-group", g]
+        return f"{ident['kind']}:{ident['id']}", check, target, can_i(context, [*args, *who])
+
+    jobs = [(i, p) for i in restricted for p in probes]
+    for ident in restricted:
+        inventory["access"][f"{ident['kind']}:{ident['id']}"] = {
+            c[0]: [] for c in ESCAPE_CHECKS}
+    with ThreadPoolExecutor(max_workers=8) as pool:
+        for key, check, target, allowed in pool.map(ask, jobs):
+            if allowed:
+                inventory["access"][key][check].append(target)
+    return inventory
+
+
+# --- analysis ---------------------------------------------------------------------------------
+
+
+def _restricted(model: IdentityModel, ident: dict[str, Any]) -> bool:
+    if model.mode == "deny-by-default" and _is_control_plane(ident["username"],
+                                                              ident["groups"]):
+        return False
+    presented = [("user", ident["username"]), *(("group", g) for g in ident["groups"])]
+    if ident["kind"] == "group":
+        presented = [("group", ident["id"])]
+    return model.is_agent("kubernetes", presented)
+
+
+@dataclass
+class KubernetesAuditResult:
+    context: str
+    mode: str
+    enforcement: str
+    would_restrict: list[dict[str, Any]] = field(default_factory=list)
+    exempt: list[dict[str, Any]] = field(default_factory=list)
+    control_plane: int = 0
+    missing: list[dict[str, str]] = field(default_factory=list)
+    findings: list[dict[str, Any]] = field(default_factory=list)
+
+    @property
+    def problems(self) -> bool:
+        return bool(self.missing) or any(f["severity"] == "high" for f in self.findings)
+
+    def to_dict(self) -> dict[str, Any]:
+        return {"context": self.context, "mode": self.mode, "enforcement": self.enforcement,
+                "would_restrict": self.would_restrict, "exempt": self.exempt,
+                "control_plane": self.control_plane, "missing": self.missing,
+                "findings": self.findings}
+
+
+def audit(inventory: dict[str, Any], model: IdentityModel, context: str = "") -> \
+        KubernetesAuditResult:
+    result = KubernetesAuditResult(context, model.mode, model.enforcement)
+    sas, bindings = inventory.get("serviceaccounts", []), inventory.get("bindings", [])
+    pod_sas = inventory.get("pod_serviceaccounts", {})
+    access = inventory.get("access", {})
+    bound: dict[tuple[str, str], list[str]] = {}
+    for b in bindings:
+        for s in b.get("subjects") or []:
+            if s.get("kind") == "ServiceAccount":
+                key = ("serviceaccount", f"{s.get('namespace', b.get('namespace', ''))}:"
+                                         f"{s['name']}")
+            else:
+                key = (str(s.get("kind", "")).lower(), s["name"])
+            bound.setdefault(key, []).append(f"{b['kind'][:-1]}/{b['name']} -> {b['role']}")
+
+    for ident in _identities(sas, bindings):
+        if model.mode == "deny-by-default" and _is_control_plane(ident["username"],
+                                                                  ident["groups"]):
+            result.control_plane += 1
+            continue
+        row = {"kind": ident["kind"], "id": ident["id"],
+               "bindings": sorted(bound.get((ident["kind"], ident["id"]), []))}
+        if ident["kind"] == "serviceaccount":
+            row["pods"] = pod_sas.get(ident["id"], 0)
+        hint = _HINTS.get((ident["kind"], ident["id"]))
+        if ident["kind"] == "group" and ident["id"].startswith("system:bootstrappers:"):
+            hint = "node bootstrap tokens (kubeadm join); trust it"
+        if hint:
+            row["hint"] = hint
+        if _restricted(model, ident):
+            result.would_restrict.append(row)
+            granted = access.get(f"{ident['kind']}:{ident['id']}", {})
+            for check, why in ESCAPE_CHECKS:
+                targets = granted.get(check)
+                if targets:
+                    detail = why + (f" ({', '.join(targets)})" if isinstance(targets, list)
+                                    else "")
+                    result.findings.append({
+                        "identity": f"{ident['kind']}/{ident['id']}", "kind": check,
+                        "severity": "high", "detail": detail,
+                        "why": "an identity the compiled policies restrict; admission cannot "
+                               "see or stop this, so RBAC must not grant it"})
+        else:
+            result.exempt.append(row)
+
+    existing = {f"{s['namespace']}:{s['name']}" for s in sas}
+    for ident in (*model.exempt("kubernetes"),
+                  *(model.agents_for("kubernetes") if model.mode == "agents-only" else ())):
+        section = ("break_glass" if ident in model.break_glass else
+                   "trusted" if ident in model.trusted else "agents")
+        if ident.kind == "serviceaccount" and ident.id not in existing:
+            result.missing.append({"identity": f"serviceaccount/{ident.id}",
+                                   "listed_as": section,
+                                   "detail": "listed in agents.yaml but not in this cluster"})
+        elif section == "break_glass" and ident.kind in ("user", "group") and \
+                (ident.kind, ident.id) not in bound:
+            result.missing.append({"identity": f"{ident.kind}/{ident.id}",
+                                   "listed_as": section,
+                                   "detail": "no role binding grants it anything, so "
+                                             "break-glass has no access"})
+    result.would_restrict.sort(key=lambda r: (r["kind"], r["id"]))
+    result.exempt.sort(key=lambda r: (r["kind"], r["id"]))
+    return result

{aegis_devops-0.3.0 → aegis_devops-0.3.2}/src/aegis_core/cli.py

@@ -529,6 +529,23 @@ def _build_parser() -> argparse.ArgumentParser:
     aws_parser.add_argument("--max-policies", type=int, default=4,
                             help="SCPs available on the target (default 4: five may attach, "
                             "one is usually FullAWSAccess)")
+    kube_parser = compile_sub.add_parser(
+        "kubernetes",
+        help="Kubernetes ValidatingAdmissionPolicies scoped to agent identities (agents.yaml), "
+        "for one cluster",
+    )
+    _add_common_options(kube_parser)
+    _add_agents_option(kube_parser)
+    kube_parser.add_argument("--cluster", required=True,
+                             help="the cluster (or kube context) name; its environment comes "
+                             "from environments.yaml (kubernetes.clusters / contexts)")
+    kube_out = kube_parser.add_mutually_exclusive_group(required=True)
+    kube_out.add_argument("--out", metavar="DIR", help="write the output here")
+    kube_out.add_argument("--check", metavar="DIR",
+                          help="exit 1 if DIR differs from a fresh compile (drift check)")
+    kube_parser.add_argument("--escalate", default="deny", choices=("deny", "omit"),
+                             help="ESCALATE rules: 'deny' (default; admission cannot ask) or "
+                             "'omit' (left client-only, reported as not enforced)")
 
     audit_parser = subparsers.add_parser(
         "audit-identity",
@@ -547,6 +564,19 @@ def _build_parser() -> argparse.ArgumentParser:
                            "output instead of calling AWS")
     audit_aws.add_argument("--would-restrict", action="store_true",
                            help="print only the identities the compiled policy would restrict")
+    audit_kube = audit_sub.add_parser(
+        "kubernetes", help="a cluster's ServiceAccounts, RBAC subjects and escape permissions")
+    _add_common_options(audit_kube)
+    _add_agents_option(audit_kube)
+    audit_kube.add_argument("--context", dest="kube_context", default=None,
+                            help="kube context to read (read-only: get and SubjectAccessReviews)")
+    audit_kube.add_argument("--inventory", default=None, metavar="FILE",
+                            help="use a saved inventory (JSON) instead of calling the cluster")
+    audit_kube.add_argument("--save-inventory", default=None, metavar="FILE",
+                            help="also write the collected inventory here")
+    audit_kube.add_argument("--would-restrict", action="store_true",
+                            help="print only the identities the compiled policies would "
+                            "restrict")
 
     agents_parser = subparsers.add_parser(
         "agents",
@@ -1343,6 +1373,53 @@ def _run_audit_aws(args: argparse.Namespace) -> int:
     return 1 if result.problems else 0
 
 
+def _run_audit_kubernetes(args: argparse.Namespace) -> int:
+    """``aegis audit-identity kubernetes``: read-only; exit 1 on a problem."""
+    from aegis_core.audit_kubernetes import InventoryError, audit, collect_inventory
+
+    model, warnings = _load_identity(args)
+    try:
+        if args.inventory:
+            inventory = json.loads(Path(args.inventory).read_text())
+        else:
+            inventory = collect_inventory(args.kube_context, model)
+            if args.save_inventory:
+                Path(args.save_inventory).write_text(json.dumps(inventory, indent=2) + "\n")
+        result = audit(inventory, model, args.kube_context or "")
+    except InventoryError as exc:
+        raise DataError(f"audit-identity: {exc}") from None
+    doc = result.to_dict()
+    if args.would_restrict:
+        doc = {"context": result.context, "would_restrict": result.would_restrict}
+    if not args.pretty:
+        print(json.dumps({**doc, "warnings": warnings}, sort_keys=True))
+        return 1 if result.problems else 0
+    print(f"AUDIT kubernetes {result.context or '(current context)'} "
+          f"({result.mode}, {result.enforcement})")
+    print(f"  would restrict ({len(result.would_restrict)}):")
+    for r in result.would_restrict:
+        pods = f", {r['pods']} pod(s)" if r.get("pods") else ""
+        roles = f"{len(r['bindings'])} binding(s)" if r["bindings"] else "no bindings"
+        hint = f"  <- {r['hint']}" if r.get("hint") else ""
+        print(f"    {r['kind']:<14} {r['id']}  ({roles}{pods}){hint}")
+    if not args.would_restrict:
+        print(f"  exempt ({len(result.exempt)}):")
+        for r in result.exempt:
+            print(f"    {r['kind']:<14} {r['id']}")
+        print(f"  control plane, always exempt: {result.control_plane}")
+        for m in result.missing:
+            print(f"  MISSING {m['listed_as']}: {m['identity']} ({m['detail']})")
+        by_identity: dict[str, list[str]] = {}
+        for f in result.findings:
+            by_identity.setdefault(f["identity"], []).append(f["kind"])
+        for identity, kinds in by_identity.items():
+            print(f"  PROBLEM {identity} can: {', '.join(kinds)} (admission cannot see or stop "
+                  "these; RBAC must not grant them to an identity the policies restrict)")
+    for w in warnings:
+        print(f"  warning: {w}")
+    return 1 if result.problems else 0
+
+
 def _run_agents(args: argparse.Namespace) -> int:
     """``aegis agents``: verify ``agents.yaml`` (signature, shape, the
     principal's ``identity`` class) and print the identity model."""
@@ -1399,6 +1476,67 @@ def _build_snapshot(args: argparse.Namespace):
         authority_map, load
 
 
+def _compile_inputs(args: argparse.Namespace):
+    """``(store, snapshot, model, env_map, identity path)`` for a compile."""
+    store, snap, authority_map, load = _build_snapshot(args)
+    path = _agents_path(args)
+    if not os.path.exists(path):
+        raise DataError(f"compile: no {path}; server-side policy needs the identity model "
+                        "(copy agents.example.yaml, see docs/configuration.md)")
+    model = _load_or_data_error(
+        lambda: load_identity_model(path, authority_map=authority_map, **load), path, "agents")
+    env_map = None
+    if args.environments:
+        env_map = _load_or_data_error(lambda: load_environment_map(args.environments, **load),
+                                      args.environments, "environments")
+    return store, snap, model, env_map, path
+
+
+def _write_or_check(args: argparse.Namespace, result, snap) -> int | None:
+    from aegis_core.compile import check_outputs, write_outputs
+
+    if args.check:
+        drift = check_outputs(args.check, result.files)
+        for line in drift:
+            print(f"drift: {line}")
+        if not drift:
+            print(f"aegis: {args.check} matches the current policy "
+                  f"(snapshot {snap.digest[:16]})")
+        return 1 if drift else 0
+    write_outputs(args.out, result.files)
+    return None
+
+
+def _run_compile_kubernetes(args: argparse.Namespace) -> int:
+    """``aegis compile kubernetes``: ValidatingAdmissionPolicies for one cluster."""
+    from aegis_core.compile import CompileError
+    from aegis_core.compile.kubernetes import KubernetesTarget, compile_kubernetes
+
+    store, snap, model, env_map, path = _compile_inputs(args)
+    env = None
+    if env_map is not None:
+        env = (env_map.kubernetes_clusters.get(args.cluster)
+               or env_map.kubernetes_contexts.get(args.cluster))
+    try:
+        result = compile_kubernetes(snap, model,
+                                    KubernetesTarget(cluster=args.cluster, env=env,
+                                                     escalate=args.escalate),
+                                    identity_sha256=_sha256_file(path))
+    except (CompileError, ValueError) as exc:
+        raise DataError(f"compile: {exc}") from None
+    checked = _write_or_check(args, result, snap)
+    if checked is not None:
+        return checked
+    summary = ", ".join(f"{k}={v}" for k, v in result.coverage["summary"].items())
+    print(f"aegis: wrote {len(result.manifest['policies'])} ValidatingAdmissionPolicies for "
+          f"cluster {args.cluster} to {args.out} (snapshot {snap.digest[:16]}; {summary})")
+    if model.enforcement != "enforce":
+        print("aegis: agents.yaml is report-only: bindings warn and audit instead of denying")
+    for w in [*store.warnings, *(f"agents: {w}" for w in model.warnings)]:
+        print(f"  warning: {w}")
+    return 0
+
+
 def _run_compile_aws(args: argparse.Namespace) -> int:
     """``aegis compile aws``: SCPs, coverage and manifest for one account."""
     from aegis_core.compile import CompileError, check_outputs, write_outputs
@@ -1486,8 +1624,12 @@ def _run(argv: list[str]) -> int:
     if args.command == "agents":
         return _run_agents(args)
     if args.command == "compile":
+        if args.target == "kubernetes":
+            return _run_compile_kubernetes(args)
         return _run_compile_aws(args)
     if args.command == "audit-identity":
+        if args.target == "kubernetes":
+            return _run_audit_kubernetes(args)
         return _run_audit_aws(args)
     if args.command == "hook":
         return hook_module.main_hook(