feat: add optional operator-owned datapath witness Helm switch

[Pal Lakatos-Toth (pallakatos)]

Optional operator-owned datapath witness

Merged integration: the corrected witness source through 4337c848 landed via the fully qualified #566 as public kars-bridge commit d01d0e258454f4ed61c6788c7ca3bf07f2fa93ab. This PR is closed as superseded and retains the original witness evidence. Reviewed source is also preserved on review/bridge-witness-4337c848. No live witness enablement or successful kernel-capture claim is made.

Implements the requested easy eBPF witness switch as a separate default-off Helm add-on. Admins get copyable enable/disable commands and truthful installation/evidence status; the BFF does not gain privileged installation authority.

• Pins the official IG 0.53.2 images and client with checksum/license provenance.
• Captures bounded foreground DNS/TCP samples and retains explicitly selected sandbox aggregates.
• Uses scoped Kubernetes reads and UID/resourceVersion-fenced report publication.
• Refuses recognized legacy/shared ownership collisions and documents guarded disable/removal.
• Distinguishes requested off, pending, unavailable, legacy, stale, invalid, fresh and empty evidence. A missing report does not prove absent installation.

Independent source review and repair

Producer/chart/packaging review closed at 15579b1cdf7adcc7bff34088631299c0a3973e84. Separate BFF/web review found that incomplete beyond-baseline sets could produce contradictory negative evidence. Corrective f5dfe2c647667fb3fa02e4e17d4ba80db9271b9a requires the complete computed set and was independently closed. Shared fixtures exercise the actual producer matching contract, with an explicit CI step.

The committed audit records bounded independent-context AI review under the maintainer's existing delegation, not a second human review or a gate waiver.

Qualification

Executed locally: 13 producer tests, seven chart tests, three producer/consumer parity tests, all 54 web tests, full web TypeScript checking, focused lint and Rust formatting. The existing web cache has Next 16.2.9 rather than locked 16.3.3, so it is provisional evidence.

On exact public head b360441ef38a6232bd52250bfcf90bb0fb94c66c, Bridge CI 34993669330 passed, including locked BFF build/tests/Clippy, the actual producer/consumer parity step, locked web production image and real guarded Helm enable/off/removal in disposable Kind. The pinned witness image built and its provenance checks passed. These do not establish successful kernel capture.

That original head did not pass full qualification: copyright coverage rejected four first-party header layouts plus unclassified/scoped upstream licensing files; core CI 34993669274 failed its governed-service port-forward because the selected Pod was not Running; native 34993669340 failed team runtime readiness and observer writer settlement. Packaging and bounded pre-forward rollout-readiness repairs are now independently source-reviewed and included in the combined #566 candidate, not this historical PR head. No failure is waived.

This branch is based on public kars-bridge at 3bc7ff58, independently of #566. Joining that beta repair must preserve both Copilot registration guards in addition to this branch's 42, and retain the new parity CI step. The additional pending Copilot transport repair raises the eventual union to at least 57 exact registration guards.

Explicit limits

No live enablement, legacy adoption, duplicate observer, H100/GPU/node mutation or deployment has occurred. Kernel collection is broader than retained sandbox aggregates. Helm lookup is neither atomic nor namespace-UID-pinned. Reports are partial observations, not enforcement or complete/cryptographic coverage. Successful per-node kernel loading, capture and termination still require separate acceptance.

The public base, installed beta and all required branch protections remain unchanged until final-head qualification and protected merge.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
pip/PyYAML	6.0.3	Unknown	Unknown

Scanned Files

• deploy/ebpf-witness/tests/requirements.txt

[Pal Lakatos-Toth (pallakatos)]

Superseded by the source-reviewed and fully qualified combined repair in #566, merged into kars-bridge as d01d0e2. The corrected witness implementation and tests are included there; this PR and its earlier failed/successful runs remain historical evidence. No live witness enablement, legacy adoption or kernel-coverage claim is made.