kubernetes.networkpolicy.verify-receipt

Independent read-only receipt of NetworkPolicies applied in one or more namespaces (canonical spec digest)

Read-only receipt of NetworkPolicies actually applied in the given namespaces.

Lists every NetworkPolicy, canonicalises name/namespace/labels/spec (no resourceVersion, uid, or managedFields), and returns a SHA-256 digest per policy plus a combined receipt over the sorted per-policy digests.

Overview

Property	Value
Workflow type	Atomic
Library	App-kubernetes
Version	1.0

Input Schema

Field	Type	Required	Default	Description
connection_uuid	uuid	Yes	—	—
namespaces	list	Yes	—	Namespaces to hash. Order does not affect the receipt.
label_selector	string	No	—	—
organization_uuid	uuid	No	—	—

Output Schema

Field	Type	Required	Default	Description
connection_uuid	uuid	No	—	—
organization_uuid	uuid	No	—	—
namespaces	list	No	—	—
label_selector	string	No	—	—
algorithm	string	No	—	—
receipt_digest	string	No	—	—
policy_count	integer	No	—	—
items	json	No	—	—
observed_at	string	No	—	—
failure_reason	string	No	—	—
failure_type	string	No	—	—
failed_action	string	No	—	—
failed_at_state	string	No	—	—
failed_step	string	No	—	—
failed_layer	string	No	—	—
error	string	No	—	—
error_type	string	No	—	—

States

State	Initial	Terminal	Success	Auto-advance	Description
pending	Yes	No	—	execute	—
completed	No	Yes	Yes	—	—
failed	No	Yes	No	—	—

State Diagram

Transitions

From	Action	To	Description
pending	execute	completed	—
* (any state)	fail	failed	—

API Usage

POST /api/workflows/start
Content-Type: application/json

{
  "workflow_type": "kubernetes.networkpolicy.verify-receipt",
  "initial_data": {
    "connection_uuid": "value",
    "namespaces": "value"
  }
}