Skip to content

ADR 0003 — Experimental enforcement boundary (cross-repo)

Status: accepted (experimental) · Date: 2026-10-02

Context

Enforcement adds, in xila-guard-k8s, a kube-scheduler-framework plugin, a fail-closed admission webhook, and tenant RBAC. The single-evaluator rule must hold, and no component may claim real GPU isolation.

Decision

  1. Single evaluator preserved. The scheduler plugin (Filter / PreBind) calls xila-guard-core over HTTP; it never re-implements policy. The admission webhook performs only structural / identity boundary checks (route, direct binding, host access, tenant resolution) — placement semantics stay in core.
  2. Fail-closed everywhere. deny / indeterminate / incomplete / stale / source-not-accepted and evaluator timeout / unreachable all block the protected placement (Filter → Unschedulable / UnschedulableAndUnresolvable; webhook failurePolicy: Fail). Transport failure is never allow.
  3. Two enforce profiles. context.mode = "enforce" always. The production profile sets acceptedSources without mock, so synthetic evidence yields SOURCE_NOT_ACCEPTED and is blocked. A clearly-labeled lab-simulated profile (XILAGUARD_ENFORCE_ACCEPT_MOCK=true) accepts mock strictly to prove software integration — never described as real enforcement / attestation.
  4. Device-allocation limit is explicit. The scheduler evaluates node-scope policy over every potentially-allocatable device; it does not claim a specific physical GPU was selected. PreBind re-reads fresh policy / evidence and rejects on not-allow, node-UID change, or incarnation change, but cannot prove state is unchanged at execution.
  5. Version coupling. The out-of-tree scheduler is built from k8s.io/kubernetes v1.35.x; the demo cluster is pinned to the matching Kubernetes 1.35 node image (kind v0.31). A skewed apiserver (e.g. 1.32) does not serve resource.k8s.io/v1 (DRA GA in 1.35) and the scheduler's informers never sync.

Consequences

  • Enforcement is experimental and lab-only; the default mode remains observe.
  • make demo-m3 demonstrates, GPU-free: production-rejects-mock, bind-to-eligible-node-only, deny-with-reason, webhook bypass rejection, and tenant RBAC.
  • A real-hardware enforcement claim still requires a real collector / attestation run, with authenticated per-node identity before any networked agent is trusted.