Crucible

Go to DIDO Solutions

• 1 Introduction

  • 1.1 Purpose
  • 1.2 Scope
  • 1.3 Intended Audience
  • 1.4 How to Use This Wiki
  • 1.5 Document Conventions
• 2 Business and Executive Concepts

  • 2.1 What Is Crucible?
  • 2.2 Accredited Software Factory as a Commodity
  • 2.3 Business Value
  • 2.4 Stakeholders
  • 2.5 Current Status
• 3 Environments and Connectivity

  • 3.1 Operational Environments
  • 3.2 Connected Operations
  • 3.3 Disconnected Operations
  • 3.4 Air-Gap Transfer
• 4 Platforms and Providers

  • 4.1 Platform Concepts
  • 4.2 Cloud Agnosticism
  • 4.3 Provider Architecture
  • 4.4 Supported Providers

    • 4.4.1 Oracle Cloud Infrastructure
    • 4.4.2 Amazon Web Services
    • 4.4.3 OpenStack
    • 4.4.4 VMware vSphere
    • 4.4.5 libvirt
• 5 Descriptions, Composition, and Baselines

  • 5.1 Crucible Description
  • 5.2 Baseline Concepts
  • 5.3 Baseline Composition
  • 5.4 Pipeline Workspace
  • 5.5 Version Pinning and Pull Lock
• 6 Machine Images and Image Layers

  • 6.1 Machine Image Concepts
  • 6.2 Image Layering
  • 6.3 Image Build
  • 6.4 Supported Operating Systems

    • 6.4.1 Red Hat Enterprise Linux
    • 6.4.2 Ubuntu
    • 6.4.3 Windows Server
  • 6.5 Supported Processor Architectures
  • 6.6 Image Catalog and Records
  • 6.7 Image Requirements and Resolution
  • 6.8 Image Lifecycle
• 7 Infrastructure and Deployment

  • 7.1 Infrastructure as Code
  • 7.2 Platform Initialization
  • 7.3 Infrastructure Deployment
  • 7.4 Provisioning
  • 7.5 Orchestration
  • 7.6 Teardown
• 8 Dependencies and Air-Gap Operations

  • 8.1 Dependency Concepts
  • 8.2 Dependency Capture
  • 8.3 Dependency Store
  • 8.4 Transfer Bundle
  • 8.5 Offline Repositories and Mirrors

    • 8.5.1 Offline Repository
    • 8.5.2 Package Repository
    • 8.5.3 Container Mirror
    • 8.5.4 Provider Mirror
  • 8.6 Offline Reconstitution
  • 8.7 Supply-Chain Capture and Integrity
• 9 Compliance and Security

  • 9.1 Compliance by Design
  • 9.2 Compliance Baseline and Posture
  • 9.3 Compliance as Code
  • 9.4 Security Technical Implementation Guides
  • 9.5 Compliance Provider Architecture
  • 9.6 Scan, Normalize, and Remediate

    • 9.6.1 Compliance Scan
    • 9.6.2 Compliance Finding
    • 9.6.3 Normalized Finding
    • 9.6.4 Findings Model
    • 9.6.5 Remediation
    • 9.6.6 Post-Remediation Verification
  • 9.7 Compliance Evidence
  • 9.8 Evidence Outputs

    • 9.8.1 Security Controls Traceability Matrix
    • 9.8.2 Risk Management Framework Evidence
    • 9.8.3 Authority to Operate Evidence
  • 9.9 Security of Crucible
• 10 Reproducibility, Provenance, and Traceability

  • 10.1 Reproducibility
  • 10.2 Provenance
  • 10.3 Traceability
  • 10.4 Controlled Inputs
  • 10.5 Auditability
• 11 Architecture and Extensibility

  • 11.1 Architecture Overview
  • 11.2 Design Principles
  • 11.3 Subsystems

    • 11.3.1 Forge CLI
    • 11.3.2 Baseline Workspace
    • 11.3.3 Image Builder
    • 11.3.4 Infrastructure Engine
    • 11.3.5 Infrastructure Registry
    • 11.3.6 Infrastructure Core
    • 11.3.7 Platform Deployer
    • 11.3.8 Dependency Manager
    • 11.3.9 Compliance Engine
    • 11.3.10 Requirements Verifier
  • 11.4 External Toolchain
  • 11.5 Extension Model
  • 11.6 Architecture Decision Records
• 12 Operational Lifecycle

  • 12.1 Lifecycle Overview
  • 12.2 Lifecycle Stages

    • 12.2.1 Declare
    • 12.2.2 Pull
    • 12.2.3 Build
    • 12.2.4 Harden
    • 12.2.5 Scan
    • 12.2.6 Upload
    • 12.2.7 Initialize
    • 12.2.8 Deploy
    • 12.2.9 Verify
    • 12.2.10 Audit
    • 12.2.11 Maintain
    • 12.2.12 Promote
    • 12.2.13 Teardown
    • 12.2.14 Reproduce
  • 12.3 Build Pipeline
• 13 Use Cases

  • 13.1 STIG-Hardened Kubernetes on OCI
  • 13.2 Air-Gapped Enclave Delivery
  • 13.3 Accredited Software Factory
  • 13.4 Reproducible Compliant Baseline
  • 13.5 AWS Kubernetes Platform
  • 13.6 Image-Only Delivery
  • 13.7 Infrastructure-Only Delivery
• 14 Getting Started

  • 14.1 Prerequisites
  • 14.2 Install Forge
  • 14.3 Verify the Installation
  • 14.4 Understand a Crucible Description
  • 14.5 First Build
  • 14.6 First Deployment
  • 14.7 Capture Dependencies
  • 14.8 Generate Compliance Evidence
  • 14.9 Teardown the Environment
  • 14.10 Where to Go Next
• 15 Command Reference

  • 15.1 Command Structure
  • 15.2 Global Options
  • 15.3 Pull
  • 15.4 Build
  • 15.5 Upload
  • 15.6 Initialize Platform
  • 15.7 Deploy
  • 15.8 Build and Deploy
  • 15.9 Destroy Platform
  • 15.10 Dependency Commands
  • 15.11 Compliance Commands
  • 15.12 Workspace Commands
  • 15.13 Requirements Commands
  • 15.14 Exit Codes
  • 15.15 Logging
• 16 Implementation Status and Roadmap

  • 16.1 Status Model
  • 16.2 Current Phase 1 Status
  • 16.3 OCI Status
  • 16.4 AWS Status
  • 16.5 Air-Gap Status
  • 16.6 Compliance Status
  • 16.7 Planned Providers
  • 16.8 Phase 2 Management Application
  • 16.9 Known Limitations
• 17 Annexes

  • Annex A Acronyms and Abbreviations
  • Annex B Terms and Definitions
  • Annex C Supported Operating Systems and Architectures
  • Annex D Provider Capability Matrix
  • Annex E Compliance Artefact Matrix
  • Annex F External Toolchain
  • Annex G Requirements Traceability
  • Annex H Architecture Decision Record Index
  • Annex I Example Crucible Description
  • Annex J Example End-to-End Workflow
  • Annex K Repository and Workspace Structure
  • Annex L References