bigbang_harden

Instructions

Implementation Reference

• src/tools/platform-one/bigbang-harden.ts:38-76 (handler)

  The handler function handleBigbangHarden that executes the tool logic. It validates args via Zod schema, calls Anthropic Claude API with the Big Bang hardening prompt, and returns the response text.

  export async function handleBigbangHarden(args: unknown): Promise<string> {
    return runTool('bigbang_harden', args, Schema, async ({ baseValues, targetLevel, enabledAddons, clusterName, registryUrl }) => {
      const response = await anthropic.messages.create({
        model: MODEL,
        max_tokens: getTokenBudget('bigbang_harden'),
        system: PLATFORM_ONE_SYSTEM,
        messages: [
          {
            role: 'user',
            content: `Generate a fully hardened Big Bang values.yaml for ${targetLevel}.
  
  **Cluster Name:** ${clusterName}
  **Registry:** ${registryUrl}
  **Enabled Addons:** ${(enabledAddons ?? ['istio', 'monitoring', 'logging', 'policy']).join(', ')}
  ${baseValues ? `\n**Base Values to Start From:**\n\`\`\`yaml\n${baseValues}\n\`\`\`` : ''}
  
  Provide:
  1. **Complete hardened values.yaml** with all security configurations
     - Iron Bank images from ${registryUrl} with SHA256 digest pins
     - Istio strict mTLS (PeerAuthentication STRICT mode)
     - OPA Gatekeeper / Kyverno policies enabled
     - NetworkPolicies restricting inter-namespace traffic
     - Resource limits on all workloads
     - Non-root containers enforced
     - Read-only root filesystems where possible
     - Secrets encryption at rest
  2. **Iron Bank Images Used** — table: Image | IB Path | Digest | Version
  3. **Required Kubernetes Secrets** to create before deployment (with creation commands)
  4. **Pre-deployment Checklist** (cluster requirements: node sizes, storage classes, etc.)
  5. **Post-deployment Verification Commands** to confirm ${targetLevel} compliance
  
  Use realistic Iron Bank registry paths and include actual STIG/IL requirements that drive each configuration.`,
          },
        ],
      });
  
      return response.content[0].type === 'text' ? response.content[0].text : '';
    });
  }

• src/tools/platform-one/bigbang-harden.ts:6-28 (schema)

  The tool definition (bigbangHardenTool) with name 'bigbang_harden', description, and JSON Schema input schema defining baseValues, targetLevel (il4/il5), enabledAddons, clusterName, and registryUrl.

  export const bigbangHardenTool = {
    name: 'bigbang_harden',
    description:
      'Generate a fully hardened Big Bang values.yaml targeting DoD IL4 or IL5 from scratch or from an existing values file. Includes Chainguard/Iron Bank digest-pinned images.',
    inputSchema: {
      type: 'object' as const,
      properties: {
        baseValues: { type: 'string', description: 'Existing values.yaml to start from (optional)' },
        targetLevel: { type: 'string', enum: ['il4', 'il5'], description: 'IL target level' },
        enabledAddons: {
          type: 'array',
          items: { type: 'string' },
          description: 'Big Bang addons to include e.g. ["istio","monitoring","logging","policy","vault","keycloak"]',
        },
        clusterName: { type: 'string' },
        registryUrl: {
          type: 'string',
          description: 'Registry URL (default: registry1.dso.mil)',
        },
      },
      required: ['targetLevel'],
    },
  };

• src/tools/platform-one/bigbang-harden.ts:30-36 (schema)

  Zod validation schema enforcing constraints: baseValues max 20000 chars, targetLevel enum (il4/il5), enabledAddons array max 50 items each max 500 chars (defaults to istio/monitoring/logging/policy), clusterName max 500 chars (default 'bb-cluster'), registryUrl max 500 chars (default 'registry1.dso.mil').

  const Schema = z.object({
    baseValues: z.string().max(20000).optional(),
    targetLevel: z.enum(['il4', 'il5']),
    enabledAddons: z.array(z.string().max(500)).max(50).default(['istio', 'monitoring', 'logging', 'policy']),
    clusterName: z.string().max(500).default('bb-cluster'),
    registryUrl: z.string().max(500).default('registry1.dso.mil'),
  });

• src/tools/index.ts:16-16 (registration)

  Import of bigbangHardenTool and handleBigbangHarden from the implementation file.

  import { bigbangHardenTool, handleBigbangHarden } from './platform-one/bigbang-harden.js';

• src/tools/index.ts:46-46 (registration)

  bigbangHardenTool registered in the allTools array for tool listing/discovery.

  bigbangHardenTool,

• src/tools/index.ts:75-75 (registration)

  Routing: case 'bigbang_harden' in the switch statement maps to handleBigbangHarden(args).

  case 'bigbang_harden':        return handleBigbangHarden(args);

• src/utils/tool-runner.ts:12-12 (helper)

  Token budget for bigbang_harden set to 8192 tokens.

  bigbang_harden: 8192,

• src/utils/tool-runner.ts:53-53 (helper)

  Timeout for bigbang_harden set to 60000ms (60 seconds).

  bigbang_harden: 60000,

• src/utils/response-validator.ts:18-18 (helper)

  Minimum response length validation for bigbang_harden set to 500 characters.

  bigbang_harden: 500,