coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Complete renamed image source and verify bounded consumer migration readiness
Some checks failed
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Failing after 1m2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 23:25:19 +02:00
parent dd15d8cf3f
commit 16ca97b277
13 changed files with 455 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

29
decisions/decisions.md
View file

@ -2145,3 +2145,32 @@ alias would keep the old name in use, and the rename exists to end that.
`/opt/flex-auth` image paths, the caller audience, Kubernetes names and the
image package. They stay with `FLEX-WP-0036` T03 to T05 and their own order
(`FLEX-DEC-2026-015`).
---
## FLEX-DEC-2026-021 — Runtime target names and bounded side-by-side migration
**Date:** 2026-10-11
**Status:** proposed; exact scope in the single daily red batch
**Workplan:** `FLEX-WP-0036-T01`
**Supersedes on acceptance:** runtime rows of `FLEX-DEC-2026-013`.
The proposed namespace and chart are `access-engine`; pin release, Service,
Deployment and reviewer ServiceAccount names are `access-engine-<pin>`, preserving
the nine existing pin suffixes. DNS is
`access-engine-<pin>.access-engine.svc.cluster.local:8080`. The caller audience is
`access-engine`, with exact legacy `flex-auth` acceptance during migration. The
engine's own resource-system coordinate is `access-engine`; protected consumers
retain their existing identities and grants. No PDP-self resource lane is created.
The binary ruling remains the accepted FLEX-DEC-2026-020: `access-engine` is
the real binary and `flex-auth` is an exit-2 rename stub. Canonical image paths
are `/opt/access-engine/examples`; legacy paths remain during consumer migration.
The image is published as `coulomb/access-engine` and as `coulomb/flex-auth` from
one build, independently verifying equal registry manifest digests. New public
package publication and the nine new TokenReview subjects remain unexecuted
until the exact batch disposition; this source record does not approve them.
Switch consumers individually only after predecessor proofs and side-by-side
allow/deny checks. Remove old egress/grants only after bounded old-twin traffic
and soak evidence; rollback retains the original pins and consumer access.