FR-CFG-002 — Infrastructure as Code

Go to Crucible Configuration Management Requirements

Crucible SHALL represent each Infrastructure Configuration as a machine-readable, version-controlled Artifact.

The system SHALL support Infrastructure-as-Code methodologies.

Crucible System Requirements Specification, Version 1.1 Draft, Functional Requirements, Configuration Management, FR-CFG-002.

The source statement expresses the approved functional intent but does not provide all information required for deterministic verification.

The following Specification Discipline and Authoring findings apply:

• The system does not use the defined system name
• Support is a weak verb that does not identify the behavior Crucible performs
• Infrastructure-as-Code does not identify the infrastructure information represented as code
• Methodologies does not identify the required representation, controls, records, or outcomes
• The source statement does not identify whether the infrastructure representation must be machine-readable
• The source statement does not identify whether the representation must be maintained through Version Control
• The source statement does not distinguish the representation of infrastructure configuration from the separate behaviors used to validate, compare, review, approve, authorize, apply, or retire that configuration
• The source statement does not identify the records required to preserve Provenance, Auditability, and Traceability

The normalized Statement replaces the weak verb with represent, identifies the Infrastructure Configuration as the controlled Artifact, and defines machine readability and Version Control as required characteristics of the representation.

The source statement does not identify validation, comparison, review, approval, authorization, application, rollback, or retirement behavior. These candidate obligations require evaluation against FR-CFG-003 through FR-CFG-005 before allocation to this requirement or creation of derived requirements.

Infrastructure as Code applies software configuration management disciplines to infrastructure definitions.

An Infrastructure Configuration that exists only as an informal document, manually executed procedure, or untracked script cannot provide reliable reuse, comparison, governance, or reconstruction.

Crucible represents Infrastructure Configurations as machine-readable, version-controlled Artifacts.

A machine-readable representation allows an authorized tool or workflow to process the Infrastructure Configuration without manual transcription.

Version Control preserves the configuration content associated with each revision and the relationships among successive revisions.

This representation provides a foundation for separately defined configuration management behaviors such as:

• Configuration validation
• Configuration comparison
• Configuration review
• Configuration approval
• Configuration application
• Configuration reuse
• Configuration rollback
• Configuration retirement
• Drift detection

The machine-readable, version-controlled representation supports:

• Reproducibility
• Provenance
• Auditability
• Traceability

This requirement applies to:

• Crucible
• Infrastructure as Code
• Infrastructure Configurations
• Declarative Configuration
• Artifacts
• Machine-readable representations
• Version Control
• Revisions
• Revision History
• Configuration Management
• Provenance
• Auditability
• Reproducibility
• Traceability

1. Verification SHALL confirm that each tested Infrastructure Configuration uses a machine-readable representation
2. Verification SHALL confirm that an authorized tool can process the machine-readable representation without requiring manual transcription
3. Verification SHALL confirm that each tested Infrastructure Configuration is maintained by the applicable Version Control system
4. Verification SHALL confirm that the Version Control system preserves the content associated with each tested configuration revision
5. Verification SHALL confirm that the Version Control system preserves the relationship between successive configuration revisions
6. Verification SHALL confirm that an authorized user can retrieve a tested configuration revision
7. Verification SHALL confirm that the configuration record preserves the applicable Provenance and Traceability

Verification may include:

• Machine-readable format inspection
• Automated parsing tests
• Automated processing tests
• Version Control repository inspection
• Repository history inspection
• Revision content inspection
• Revision relationship inspection
• Prior revision retrieval tests

The verification record SHALL identify:

1. The tested Infrastructure Configuration
2. The machine-readable representation
3. The tool used to process the representation
4. The processing result
5. The Version Control repository
6. The tested revision
7. The preceding revision, when applicable
8. The succeeding revision, when applicable
9. The revision retrieval result
10. The applicable Provenance
11. The observed results
12. The generated Evidence

This requirement refines:

• MO-001 — Repeatable, Compliant, and Secure Infrastructure Environments
• MO-002 — Reduced Platform Deployment Timelines
• MO-003 — Platform Independent Deployment
• MO-005 — Reusable and Version-Controlled Infrastructure
• MO-006 — Infrastructure Lifecycle Management

This requirement operates within the conditions established by:

• OR-001 — Operational Roles
• OR-002 — Deployment Environments
• OR-003 — Classified and Unclassified Environments
• OR-004 — Concurrent Environment Management
• OR-005 — Distributed Environment Management

This requirement also relates to:

• 5. Descriptions, Composition, and Baselines
• 7. Infrastructure and Deployment
• 10. Reproducibility, Provenance, and Traceability

The wiki Backlinks function provides the current list of pages that reference FR-CFG-002.

Incoming traceability should be derived dynamically from backlinks rather than maintained as a duplicate manual list.

Backlinks identify incoming references but do not define the semantics of each relationship. Referencing pages should identify whether the relationship represents realization, refinement, verification, dependency, or another defined traceability relationship.

The Crucible Concept of Operations describes Phase 1 as a command-line utility invoked through CI/CD Pipeline steps.

The Phase 1 workflow uses machine-readable, version-controlled Infrastructure Configurations as controlled inputs for activities such as:

• Selecting applicable configuration revisions
• Composing selected Baselines
• Building Machine Images
• Preparing deployment inputs
• Performing Infrastructure Deployment
• Recording the configuration revision associated with an execution
• Preserving execution results and Evidence

The machine-readable, version-controlled representation provides the controlled Infrastructure Configuration input required by these activities.

Configuration validation, review, approval, authorization, application, and rollback remain separate functional behaviors subject to allocation across the remaining Configuration Management requirements.

Phase 1 and subsequent phases

Not Assessed

Implementation status requires verification that Crucible represents Infrastructure Configurations as machine-readable, version-controlled Artifacts.

Draft

The source System Requirements Specification identifies Version 1.1 as a draft.

This requirement page should retain the stable requirement identifier FR-CFG-002.

Changes to the Statement SHALL preserve the approved intent of the source requirement.

Material changes should receive review and should update the related outbound traceability, verification criteria, configuration records, and source records.

The Source Statement should preserve the original wording from the controlling System Requirements Specification.

The Configuration Management completeness review should evaluate whether validation, comparison, review, approval, authorization, application, rollback, and retirement obligations are allocated to FR-CFG-003 through FR-CFG-005 or require derived requirements.

Incoming traceability should use the wiki Backlinks function rather than a manually maintained list.

To reference this requirement Statement from another wiki page, insert:

{{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-01-configuration-management:fr-cfg-002#Statement&noheader&nofooter&noeditbtn}}

Do not rename this page after an external citation unless a redirect or move plan is in place.