Centinela — Operator guide · Guía del operador

Deploy

1. deploy/terraform/stacks/security-tooling: tofu init -backend-config=backend.hcl && tofu apply (one command). Optional: stacks/security-executor in a dedicated account.
2. Bootstrap ArgoCD; apply deploy/argocd/project.yaml and app-of-apps.yaml. Waves: cluster policies → OPA → API/workers → web → executor.
3. Secrets live in Secrets Manager under centinela/<env>/…; External Secrets syncs them. No secret is ever in Git, Helm values or environment files.
4. Release: tag vX.Y.Z → release.yml builds, scans, SBOMs, signs (cosign keyless), attests SLSA L3 and opens a GitOps PR with the new digests. Kyverno refuses unsigned images.

Onboard a tenant (< 60 min)

onboarding/README.md: AWS StackSet → GCP WIF script → GitHub Apps → verify_permissions.py → first evaluation. Demo mode first: make dev && make demo.

Day-2 operations

• Policies: edit policies/ via PR (tests required); the bundle hash becomes the policy_version recorded on every decision; the UI shows policies read-only.
• Risk weights: packages/risk/default_policy.yaml via PR; findings keep the version they were scored with.
• Autonomy levels per tenant/service: L0 inform · L1 propose · L2 open PR after approval (default). There is no level without human approval.
• Change freezes / maintenance windows: Settings → Governance (security_lead). Zero-day override requires a security lead.
• Kill switch: docs/runbooks/kill-switch.md.
• Monitoring: Datadog dashboard "Centinela — SLOs"; P1 monitors: executor rejections, kill switch, blocked egress.
• Audit: centinela-audit verify weekly (scheduled job) and on demand; SIEM export via OCSF webhook.
• Backups/DR: docs/runbooks/disaster-recovery.md; quarterly drills.
• Keys: docs/runbooks/key-rotation.md.

Local development

make bootstrap && make dev-keys && make dev → console :3000, API docs :8000/docs, Temporal UI :8233, Storybook via make storybook. make test, make security, make evals, make e2e.

---

ES: Despliegue con un tofu apply + sincronización de ArgoCD; secretos solo en Secrets Manager; releases firmadas y con procedencia SLSA; onboarding guiado en < 60 min; operación diaria por PR (políticas, pesos de riesgo), kill switch, auditoría verificable, DR con simulacros.