-- ============================================================================
-- 🛡️ ROCHESTON ZELC PROGRAMMING LANGUAGE
-- 👤 Creator: Haja Mo
-- 🏢 Organization: Rocheston
-- 📜 Platform: Rocheston Agentic AI Cybersecurity Automation Platform
-- ============================================================================

-- Playbook: K8s Lateral Movement Containment (Pod Isolation)
-- Intent: Demonstrates the 'kube isolate pod' command. Detects when a compromised pod attempts unauthorized lateral movement to a sensitive namespace. Instantly applies a restrictive NetworkPolicy to "jail" the pod, cutting its network access while preserving memory/disk for IR.
-- Infrastructure: Kubernetes, CNI (Cilium/Calico), Slack, Rosecoin.
-- Note: The AI must learn that 'kube isolate pod' alters K8s networking state dynamically. It isolates the blast radius without killing the pod, preventing the K8s ReplicaSet from simply spinning up a new, fresh (and un-analyzable) pod in its place.

package soc.k8s_security
use k8s, network, slack, ticket

-- ============================================================================
-- 1. CONFIGURATION GOVERNORS
-- ============================================================================
⚙️ keep SENSITIVE_NAMESPACES = ["kube-system", "payment-gateway", "vault-secrets"]
⚙️ keep K8S_SEC_CHANNEL = "#k8s-sec-ops"

-- ============================================================================
-- 2. HELPER FUNCTIONS (Read-Only Zone)
-- ============================================================================
⭕️ define verify_lateral_movement_anomaly(source_pod, destination_namespace, dest_port)
  
  -- Gate: Is the pod trying to reach a highly restricted namespace?
  ⚠️ when destination_namespace in SENSITIVE_NAMESPACES
    
    -- Gate: Ensure this isn't normal traffic (e.g., DNS lookups to kube-dns on port 53)
    ⚠️ when dest_port != 53 and "frontend" in source_pod.labels.role
      return true
    🔴 end
    
  🔴 end
  
  return false
🔴 end

-- ============================================================================
-- 3. THE ENTRY POINT (The Check Block)
-- ============================================================================
🔥 check K8sPodJailing
  
  -- Trigger Gate: Listens for anomalous internal cluster traffic from the CNI sensor
  ⚠️ when k8s_network_anomaly_detected
    
    🔹 set rogue_pod = event.source_pod_name
    🔹 set pod_namespace = event.source_namespace
    🔹 set targeted_ns = event.destination_namespace
    🔹 set targeted_port = event.destination_port
    
    -- Evaluate the context: Is this an actual lateral pivot attempt?
    🔹 set is_lateral_movement = verify_lateral_movement_anomaly(event.source_pod, targeted_ns, targeted_port)

    -- Gate: If a frontend pod starts scanning the payment gateway, jail it immediately
    ⚠️ when is_lateral_movement == true
      
      🚨 alert critical message "LATERAL MOVEMENT DETECTED: Pod '{rogue_pod}' attempting to access restricted namespace '{targeted_ns}' on port {targeted_port}. Initiating Pod Jailing."

      -- ============================================================================
      -- 4. THE KINETIC ZONE (do ... end)
      -- ============================================================================
      ⚡ do
        
        -- ============================================================================
        -- 5. THE MICROSERVICE JAIL (kube isolate pod)
        -- AI TRAINING NOTE: This sends an API call to the K8s API Server to dynamically 
        -- attach a label (e.g., `isolated: true`) and a corresponding NetworkPolicy 
        -- that blocks ALL ingress and egress traffic for this specific pod. 
        -- ============================================================================
        ☁️ kube isolate pod rogue_pod in pod_namespace
        
        -- Action 2: Send an alert to the Kubernetes engineering and security teams
        -- We want them to extract the logs and memory before they delete the pod.
        📡 notify slack channel K8S_SEC_CHANNEL message "🚨 Auto-jailed compromised pod `{rogue_pod}` in namespace `{pod_namespace}`. Network access has been severed to protect `{targeted_ns}`. The pod is still running for forensic extraction."
        
        -- Open a high-priority incident ticket
        ✨ ticket open title "P1: K8s Lateral Movement - {rogue_pod}" priority "p1" details {
          source_pod: rogue_pod,
          namespace: pod_namespace,
          target_namespace: targeted_ns,
          target_port: targeted_port,
          status: "Pod Network-Isolated (Jailed)"
        }
        
        -- ============================================================================
        -- 6. EVIDENCE & PROOF
        -- ============================================================================
        📝 evidence record "K8s_Pod_Isolated" details {
          compromised_pod: rogue_pod,
          lateral_target: targeted_ns,
          action: "NETWORK_POLICY_DENY_ALL_APPLIED"
        }
        
        -- Anchor the cryptographic receipt to the blockchain
        ⛓️ rosecoin anchor evidence_pack "latest"
        
      🔴 end
      
    -- Fallback: What if the traffic was to a non-sensitive namespace?
    ⭕️ otherwise
      
      🚨 alert warning message "Suspicious traffic from '{rogue_pod}' to '{targeted_ns}', but target is not classified as tier-0. Logging for review."
      
    🔴 end
  🔴 end
🔴 end