longue-vue

README

A Configuration Management Database (CMDB) for Kubernetes environments, aligned with the ANSSI SecNumCloud (SNC) qualification framework. longue-vue polls one or more Kubernetes clusters, mirrors the inventory into PostgreSQL, and exposes a REST API and web UI so auditors can see the cartography and operators can annotate assets with business context.

Status: beta — data model and HTTP contract are stable; expect additive changes until 1.0.

Features

• Full Kubernetes inventory -- Clusters, Nodes, Namespaces, Workloads (Deployment / StatefulSet / DaemonSet), Pods, Services, Ingresses, PersistentVolumes, PVCs.
• Inventory of non-Kubernetes platform VMs (VPN, DNS, Bastion, Vault, …) per cloud account, with encrypted-at-rest credentials and a separate push-mode collector binary (ADR-0015).
• Dual-mode collection -- pull (longue-vue polls clusters) and push (longue-vue-collector runs inside air-gapped clusters and pushes over HTTPS).
• Multi-cluster -- one longue-vue catalogues N clusters in parallel, or mixed pull+push.
• ANSSI cartography layers -- every kind maps to an SNC layer (ecosystem, applicative, infrastructure, etc.).
• Dual-path auth -- humans use session cookies (local login or OIDC); machines use bearer tokens (PAT).
• Curated metadata -- operators annotate clusters with owner, criticality, runbook URL, and free-form notes.
• End-of-life inventory -- enricher queries endoflife.date, flags EOL / approaching-EOL software, shows the latest available version to upgrade to.
• Impact analysis graph -- interactive dependency diagram on every entity page; assess blast radius before a change.
• MCP server -- Model Context Protocol interface exposing read-only CMDB tools for AI agents; SSE and stdio transports.
• DMZ ingest gateway -- longue-vue-ingest-gw reverse-proxy for collector push traffic behind a network perimeter; mTLS, hardcoded 18-route allowlist, 60 s token-verify cache (ADR-0016).
• Hardened public listener -- native TLS 1.3 with hot cert reload, opt-in trusted-proxy header trust, trust-aware HSTS, secure session cookies, and a startup guard that refuses to ship credentials over plaintext (ADR-0017).
• VM application inventory and EOL enrichment -- operators declare platform software running on each non-Kubernetes VM (Vault, BIND, Cyberwatch, …); the EOL enricher evaluates declared versions against endoflife.date and writes longue-vue.io/eol.<product> annotations; the EOL dashboard surfaces VMs alongside clusters and nodes (ADR-0019).
• Application inventory -- Application + ApplicationBlock entities aligned with the ANSSI applicative layer; link workloads and VMs to an Application, classify DICT security needs (0..4 per axis) at the Application level with read-only inheritance onto members, roll up EOL exposure per application, and review the classification heat-map for SNC chapter 8 evidence (ADR-0029).
• Helm chart per deployable binary -- every longue-vue binary (longue-vue, longue-vue-ingest-gw, longue-vue-collector, longue-vue-vm-collector) ships with a sibling chart under charts/. Independent versioning, shared hardening defaults (ADR-0018).
• Audit log -- every state-changing call is recorded; passwords and tokens are scrubbed; source column distinguishes public-listener (api) from DMZ-gateway (ingest_gw) traffic.
• CSV / JSON / ZIP extracts -- bulk download of Search results and the EOL Dashboard (audit-logged, capped at 50 000 rows).
• Embedded web UI -- React SPA shipped inside the binary at /ui/.

Quick start

With Helm (recommended for Kubernetes)

helm install longue-vue charts/longue-vue -n longue-vue-system --create-namespace
kubectl -n longue-vue-system logs -l app.kubernetes.io/name=longue-vue | grep "LONGUE-VUE FIRST-RUN"

From source (local development)

docker run -d --rm --name longue-vue-pg \
  -e POSTGRES_PASSWORD=longue-vue -e POSTGRES_DB=longue-vue \
  -p 5432:5432 postgres:16-alpine

make ui-build && make build
LONGUE_VUE_DATABASE_URL="postgres://postgres:longue-vue@localhost:5432/longue-vue?sslmode=disable" \
  LONGUE_VUE_BOOTSTRAP_ADMIN_PASSWORD="changeme-on-first-login" \
  ./bin/longue-vue
# Open http://localhost:8080/ and sign in as admin

See Getting Started for the full walkthrough including cluster registration, collector setup, and demo data seeding.

Documentation

Document	Description
Getting Started	From zero to a working installation.
Configuration	All environment variables for longue-vue and longue-vue-collector.
Deploy with Helm	One-command Kubernetes install with optional bundled PostgreSQL.
Deploy with Kustomize	Production deployment with plain manifests.
Kubernetes Pull Collector	In-process pull collector: configuration, multi-cluster setup, reconciliation, RBAC, and metrics.
Push Collector	Deploy longue-vue-collector in air-gapped clusters (Helm or Kustomize).
VM Collector	Deploy longue-vue-vm-collector to inventory non-Kubernetes platform VMs (Helm or Kustomize).
DMZ Ingest Gateway	Deploy longue-vue-ingest-gw in a perimeter network to front collector push traffic (ADR-0016).
Secure kubeconfig delivery	Mount kubeconfigs from Kubernetes Secrets for multi-cluster pull-collector deployments.
Cloud Accounts	Register cloud-provider accounts, manage AK/SK rotation, master key handling.
Docker (local dev)	Run locally with Docker.
Authentication	Local users, OIDC, tokens, roles, sessions.
Audit Log	What gets recorded, scrubbing rules, API queries, retention guidance.
API Reference	REST endpoints with curl examples.
EOL Enrichment	End-of-life inventory: setup, dashboard, annotation format.
VM Applications	Declare platform software on non-Kubernetes VMs; EOL enrichment and search filters for applications.
Applications	First-class Application + ApplicationBlock inventory: link workloads/VMs, classify DICT, read per-application EOL, classification heat-map (ADR-0029).
Impact Analysis	Dependency graph: assess blast radius of a change.
MCP Server	Model Context Protocol server for AI agent integrations.
Monitoring	Prometheus metrics, alerts, Grafana tips.
Operations Runbook	Day-1 bootstrap, credential rotation, backup/restore, incident response, upgrade procedure.
UI Guide	End-user walkthrough of the web interface: login, navigation, search, EOL dashboard, admin panel.
Architecture	How longue-vue works internally.

Architecture

longue-vue ships as four binaries: longue-vue (the central server with API, UI, PostgreSQL store, and the in-process pull collectors), longue-vue-collector (push-mode Kubernetes collector for air-gapped clusters), longue-vue-vm-collector (push-mode cloud-VM collector for non-Kubernetes platform infrastructure), and longue-vue-ingest-gw (the optional DMZ ingest gateway that fronts longue-vue's mTLS-only ingest listener for high-security deployments — ADR-0016). Each binary ships with its own first-class Helm chart under charts/ (ADR-0018).

   Kubernetes cluster(s)        Air-gapped cluster        Cloud-provider account
          |                            |                           |
          | client-go (list)           | client-go (list)          | cloud SDK (list)
          v                            v                           v
   ┌──────────────┐            ┌──────────────────┐       ┌─────────────────────┐
   │ pull collector│            │ longue-vue-collector  │       │ longue-vue-vm-collector  │
   │ (goroutine/  │            │ (push over HTTPS)│       │ (push over HTTPS,   │
   │  cluster)    │            └────────┬─────────┘       │  fetches AK/SK from │
   └──────┬───────┘                     |                 │  longue-vue at boot)    │
          │ direct store                | REST API +      └──────────┬──────────┘
          v                             | Bearer                      |
   ┌──────────────┐     ┌────────────┐  v                              | REST API +
   │   longue-vue     │────>│ PostgreSQL │<──── REST API / SPA / Prometheus | Bearer (vm-collector scope)
   │ (API + UI +  │     │ (JSONB +   │<─────────────────────────────────┘
   │  collector)  │     │  goose)    │
   └──────────────┘     └────────────┘

Architectural decisions

#	Topic
0001	Build a CMDB for SNC against the Kubernetes API.
0002	Map every Kubernetes kind onto one of the six ANSSI cartography layers.
0003	Single workloads table polymorphic on kind, with a JSONB spec column.
0004	Classify Ingress in the applicative layer.
0005	Central-pull multi-cluster topology: one longue-vue, N collector goroutines.
0006	Web UI bundled into longue-vue for audit views and curated asset metadata.
0007	Dual-path auth (session + bearer) and four-role RBAC.
0008	SecNumCloud chapter 8 asset management alignment.
0009	Push-based collector for air-gapped clusters.
0010	Admin-only cluster deletion with audit.
0011	Collector auto-creates cluster on first contact.
0012	End-of-life enrichment via endoflife.date.
0013	Impact analysis graph for blast-radius assessment.
0014	MCP server for AI agent access to the CMDB.
0015	VM collector for non-Kubernetes platform infrastructure (cloud_accounts + virtual_machines + standalone collector binary).
0016	DMZ ingest gateway for collector push traffic — stateless reverse-proxy with mTLS, 18-route allowlist, and 60 s token-verify cache.
0017	Public-listener TLS posture and proxy trust — native TLS / trusted-proxy switch, secure cookies, HSTS, transactional last-admin guard.
0018	Helm chart per deployable binary — every longue-vue binary ships with a sibling chart under charts/, independently versioned, sharing the hardening conventions of charts/longue-vue-ingest-gw.
0019	VM applications inventory, EOL enrichment for platform software, and extended VM list search filters.
0020	Rename Argos → longue-vue: product name, token prefix, env vars, and migration guidance.
0021	Time-travel snapshots for SecNumCloud asset history (soft-delete foundation).
0029	First-class Application + ApplicationBlock inventory for the SNC applicative layer; DICT classification on Application, effective-DICT inheritance onto workloads/VMs, per-application EOL roll-up, and classification heat-map.

Contributing

Prerequisites: Go (version in go.mod), Node 22+, Docker (for integration tests).

make check    # fmt + vet + lint + test -- the CI-equivalent gate

Integration tests require PGX_TEST_DATABASE pointing at a PostgreSQL instance. See Docker (local dev) for the development workflow.

License

Apache-2.0 -- see LICENSE.