Compare commits
3 commits
2cdce7eb8a
...
f4c9f2beeb
| Author | SHA1 | Date | |
|---|---|---|---|
| f4c9f2beeb | |||
| ff5d0643fa | |||
| 58a12d258f |
9 changed files with 470 additions and 13 deletions
|
|
@ -1,4 +1,4 @@
|
|||
FROM golang:1.26.7-alpine@sha256:28d89ee9cc0ff9fec75c82ca201e6bf7fdf9a679d4b7b24dfa04f2bb766bb468 AS build
|
||||
FROM golang:1.26.10-alpine@sha256:a2012b4a1d1f9f7e9f44e0d39b805a901e856b1dd80b4e6ee4338db547050308 AS build
|
||||
WORKDIR /src
|
||||
COPY go.mod go.sum ./
|
||||
# Portable, unchanged Approval-owner pure data helper; available before download.
|
||||
|
|
|
|||
209
docs/compact-sitting-v14-release-runbook.md
Normal file
209
docs/compact-sitting-v14-release-runbook.md
Normal file
|
|
@ -0,0 +1,209 @@
|
|||
# Runbook: release compact-sitting v14 to `flex-auth-informed-decision-sitting`
|
||||
|
||||
**Date prepared:** 2026-11-01 (owner: access-engine / flex-auth; nothing below has been run)
|
||||
**Workplan:** `workplans/FLEX-WP-0040-bounded-execution-pdp-gate.md`, FLEX-WP-0040-T07
|
||||
**Owner note:** `docs/compact-sitting-v14-present-existing.md` ("Live steps")
|
||||
**Approval:** founder, 2026-11-01, relayed by the net-kingdom coordinator
|
||||
**Runs:** the founder, from an access-engine checkout at the commit carrying this file
|
||||
**Evidence:** `docs/evidence/2026-11-01-compact-sitting-v14/release-candidate-checks.json`
|
||||
|
||||
## Coordinated with informed-decision (same window)
|
||||
|
||||
This release is one half of a pair. informed-decision pins the policy package it
|
||||
expects (`policy` object of its review runtime: `deploy/lifecycle/service.candidate.json`
|
||||
`runtime.json` and `deploy/lifecycle/admission.candidate.json`) and compares the
|
||||
`policy_package` / `policy_version` / `policy_package_digest` of every decision with
|
||||
that pin. **A version or digest mismatch fails closed**: from the moment this upgrade
|
||||
completes until the consumer pins v14, every review request is refused, and the reverse
|
||||
holds if the consumer moves first. Run both in one window, this release first, the
|
||||
consumer pin immediately after; roll both back together.
|
||||
|
||||
| | before (in force) | after |
|
||||
| --- | --- | --- |
|
||||
| package | `informed-decision.compact-sitting` | same |
|
||||
| version | `v13` | `v14` |
|
||||
| package_digest | `sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873` | `sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde` |
|
||||
|
||||
The consumer's `approval_action` context change (owner note, "Consumer change required")
|
||||
is needed only for `service:nk-bind-executor` present-existing requests. Without it those
|
||||
are refused with `approval_action_not_admitted`; requests for requester
|
||||
`informed-decision` are unaffected by v14.
|
||||
|
||||
## Release candidate
|
||||
|
||||
| Field | Value |
|
||||
| --- | --- |
|
||||
| release / namespace | `flex-auth-informed-decision-sitting` / `flex-auth` |
|
||||
| chart | `charts/flex-auth` (this checkout) |
|
||||
| values | `values/informed-decision-sitting.yaml` (edited directly; twin `values/access-engine/informed-decision-sitting.yaml` regenerated, not deployed) |
|
||||
| image | `forgejo.coulomb.social/coulomb/flex-auth@sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776` |
|
||||
| image tag / source | `main-2de0f86`, OCI revision label `2de0f862f9875f344f090b633813239a33d63426` (CI `.forgejo/workflows/image.yaml`, push to main) |
|
||||
| policy | `/opt/flex-auth/examples/informed-decision-present-existing-review/policy.md` (file sha256 `dcfae737…40141`, package digest verified from the image) |
|
||||
| registry | unchanged path `/opt/flex-auth/examples/informed-decision-lifecycle-review/registry.json` (byte-identical to the present-existing copy) |
|
||||
|
||||
### Gate: image scan (founder decision)
|
||||
|
||||
Trivy (HIGH/CRITICAL) finds four Go stdlib 1.26.7 CVEs in both binaries of the candidate
|
||||
(CVE-2026-111943, CVE-2026-78667, CVE-2026-78669, CVE-2026-97031; fixed in Go 1.26.9 /
|
||||
1.26.10). The image in force (`6c6dc263`) has **the same four**, so the candidate does not
|
||||
regress, but the earlier release bar (zero HIGH/CRITICAL, FLEX-WP-0034) is not met. Either
|
||||
accept for this release (no regression) or ask the owner for a Go toolchain bump and
|
||||
rebuild first, which yields a new digest and requires re-running the checks in the evidence
|
||||
file. Do not proceed without choosing.
|
||||
|
||||
## Image in force (source evidence)
|
||||
|
||||
`values/informed-decision-sitting.yaml` recorded `bdac62bc…` (FLEX-WP-0033 cutover,
|
||||
2026-10-04) but was never promoted after FLEX-WP-0034. Source evidence says the release
|
||||
runs `6c6dc263`:
|
||||
|
||||
- FLEX-WP-0034-T02 (2026-10-05): Helm revision 13 deployed with `--atomic` from owner CI
|
||||
image `6c6dc263` (source f234d01), values `values/informed-decision-lifecycle-review.candidate.yaml`
|
||||
(commit 941ffa6), consumer pinned v13 `31be5985`.
|
||||
- `registry/release-units/flex-auth-informed-decision-sitting.yaml` pins the live OCI image
|
||||
`6c6dc263…168e`.
|
||||
- FLEX-WP-0038 (2026-10-22): a diff of the values file against live showed the sitting
|
||||
release "also changes image", i.e. live is not `bdac62bc`; that release was not upgraded.
|
||||
|
||||
So the pre-release state is expected to be: revision 13, image `6c6dc263`, v13 policy at
|
||||
`…/informed-decision-lifecycle-review/policy.md`, memory request 32Mi. Step 0 confirms it
|
||||
read-only; if it differs, stop and report.
|
||||
|
||||
## Steps
|
||||
|
||||
```bash
|
||||
export KUBECONFIG=$HOME/.kube/config-railiance01
|
||||
cd ~/access-engine # the commit carrying this runbook
|
||||
REL=flex-auth-informed-decision-sitting
|
||||
NS=flex-auth
|
||||
```
|
||||
|
||||
### 0. Record the state in force (read-only)
|
||||
|
||||
```bash
|
||||
helm -n $NS history $REL --max 5
|
||||
helm -n $NS get values $REL -o yaml > /tmp/$REL.values-before.yaml
|
||||
kubectl -n $NS get deploy $REL -o jsonpath='{.spec.template.spec.containers[0].image}{"\n"}{.spec.template.spec.containers[0].args}{"\n"}'
|
||||
```
|
||||
|
||||
Expect: last revision `deployed` (13 unless something has run since), image
|
||||
`…@sha256:6c6dc263f4a7f6461e109e133c004c080e8e373acfead8611856c5fb3e44168e`, `--policy`
|
||||
`/opt/flex-auth/examples/informed-decision-lifecycle-review/policy.md`. Write down the
|
||||
revision number as `PREV`; it is the rollback target. If the image differs, stop.
|
||||
|
||||
### 1. Server dry-run and diff (read-only)
|
||||
|
||||
```bash
|
||||
helm -n $NS upgrade $REL charts/flex-auth -f values/informed-decision-sitting.yaml \
|
||||
--dry-run=server > /tmp/$REL.dry-run.txt && echo dry-run-ok
|
||||
helm template $REL charts/flex-auth -n $NS -f values/informed-decision-sitting.yaml \
|
||||
| kubectl -n $NS diff -f -
|
||||
```
|
||||
|
||||
Expected diff, Deployment `flex-auth-informed-decision-sitting` only:
|
||||
|
||||
- image `@sha256:6c6dc263…168e` → `@sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776`
|
||||
- `--policy` `…/informed-decision-lifecycle-review/policy.md` → `…/informed-decision-present-existing-review/policy.md`
|
||||
- memory request `32Mi` → `40Mi` (FLEX-WP-0038 right-sizing, already in the values file)
|
||||
- possibly two added args `--caller-audience` `flex-auth` (FLEX-WP-0038 saw this chart
|
||||
drift). `flex-auth` is the binary's default, so behaviour is unchanged; the consumer's
|
||||
token audience is untouched.
|
||||
- possibly Helm-managed labels/annotations (chart version, revision).
|
||||
|
||||
Anything else (NetworkPolicy, RBAC, Service, caller binding, registry path, replicas) means
|
||||
stop and report to the owner.
|
||||
|
||||
### 2. Upgrade
|
||||
|
||||
```bash
|
||||
helm -n $NS upgrade $REL charts/flex-auth -f values/informed-decision-sitting.yaml \
|
||||
--atomic --wait --timeout 3m
|
||||
kubectl -n $NS rollout status deploy/$REL --timeout=2m
|
||||
```
|
||||
|
||||
`--atomic` reverts to `PREV` by itself if the pod does not become ready.
|
||||
|
||||
### 3. Pin the consumer (informed-decision, same window)
|
||||
|
||||
Per informed-decision's own runbook: set the review runtime's `policy` object to
|
||||
`informed-decision.compact-sitting` / `v14` /
|
||||
`sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde` and release it.
|
||||
Until then review requests fail closed.
|
||||
|
||||
### 4. Verify (read-only decision checks with synthetic claims)
|
||||
|
||||
The service admits only the informed-decision pod and the
|
||||
`system:serviceaccount:informed-decision:review` caller, so check through a port-forward
|
||||
with a short-lived token for that ServiceAccount (the documented pattern of
|
||||
`docs/operator-caller-access-path.md`). Both requests are synthetic and must be **denied**;
|
||||
no approval or memo is touched.
|
||||
|
||||
```bash
|
||||
kubectl -n $NS get deploy $REL -o jsonpath='{.spec.template.spec.containers[0].image}{"\n"}'
|
||||
kubectl -n $NS logs deploy/$REL --tail=20
|
||||
|
||||
kubectl -n $NS port-forward svc/$REL 18080:8080 >/dev/null 2>&1 & PF=$!
|
||||
sleep 2
|
||||
TOKEN=$(kubectl -n informed-decision create token review --audience=flex-auth --duration=10m)
|
||||
E=docs/evidence/2026-11-01-compact-sitting-v14
|
||||
for f in verify-self-approval verify-missing-action; do
|
||||
jq --argjson now "$(date +%s)" '.subject.attributes.assurance.at = $now' $E/$f.request.json \
|
||||
| curl -s -X POST localhost:18080/v1/check -H "Authorization: Bearer $TOKEN" \
|
||||
-H 'Content-Type: application/json' -d @- \
|
||||
| jq -c --arg f $f '[$f,.effect,.reason,.provenance.policy_version,.provenance.policy_package_digest]'
|
||||
done
|
||||
curl -s -o /dev/null -w 'no-token http %{http_code}\n' -X POST localhost:18080/v1/check \
|
||||
-H 'Content-Type: application/json' -d @$E/verify-self-approval.request.json
|
||||
unset TOKEN; kill $PF
|
||||
```
|
||||
|
||||
Expected:
|
||||
|
||||
```text
|
||||
["verify-self-approval","deny","self_approval_refused","v14","sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde"]
|
||||
["verify-missing-action","deny","approval_action_not_admitted","v14","sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde"]
|
||||
no-token http 401
|
||||
```
|
||||
|
||||
(The same two requests against v13 answer `unknown_class`, so these reasons prove v14 is
|
||||
serving. They were checked offline against the image's own `check` command.) Then confirm
|
||||
in informed-decision that an ordinary review read for requester `informed-decision`
|
||||
still succeeds with the v14 pin (its own check). Any other result: roll back.
|
||||
|
||||
### 5. Rollback (both halves)
|
||||
|
||||
```bash
|
||||
helm -n $NS rollback $REL $PREV --wait --timeout 3m
|
||||
kubectl -n $NS get deploy $REL -o jsonpath='{.spec.template.spec.containers[0].image}{"\n"}'
|
||||
```
|
||||
|
||||
Expect image `@sha256:6c6dc263f4a7f6461e109e133c004c080e8e373acfead8611856c5fb3e44168e`
|
||||
and the lifecycle-review policy path. Then restore informed-decision's v13 pin
|
||||
(`v13`, `sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873`).
|
||||
|
||||
Rollback values, if `helm rollback` is unavailable (exact revision-13 values, kept in the
|
||||
repo): `values/informed-decision-lifecycle-review.candidate.yaml`
|
||||
|
||||
```yaml
|
||||
image: forgejo.coulomb.social/coulomb/flex-auth@sha256:6c6dc263f4a7f6461e109e133c004c080e8e373acfead8611856c5fb3e44168e
|
||||
--registry /opt/flex-auth/examples/informed-decision-lifecycle-review/registry.json
|
||||
--policy /opt/flex-auth/examples/informed-decision-lifecycle-review/policy.md # v13, 31be5985…
|
||||
resources.requests: cpu 5m, memory 32Mi
|
||||
```
|
||||
|
||||
```bash
|
||||
helm -n $NS upgrade $REL charts/flex-auth -f values/informed-decision-lifecycle-review.candidate.yaml --atomic --wait --timeout 3m
|
||||
```
|
||||
|
||||
The candidate image also carries the v13 package unchanged (same path, same digest), so
|
||||
reverting only `--policy` on the new image is a valid partial rollback if the image itself
|
||||
is not the problem.
|
||||
|
||||
## After a successful release (owner follow-up)
|
||||
|
||||
- Record the Helm revision and the step-4 output under
|
||||
`docs/evidence/2026-11-01-compact-sitting-v14/` and mark FLEX-WP-0040-T07 accordingly.
|
||||
- Update `registry/release-units/flex-auth-informed-decision-sitting.yaml` to the new image
|
||||
digest and source.
|
||||
- Keep `values/informed-decision-lifecycle-review.candidate.yaml` as the v13 rollback
|
||||
reference until the v14 pair has run cleanly.
|
||||
|
|
@ -0,0 +1,155 @@
|
|||
{
|
||||
"scope": "release-candidate artifact checks for compact-sitting v14; read-only, offline (docker create/cp, docker run --network none); not a general security attestation; nothing applied",
|
||||
"checked_at": "2026-11-01",
|
||||
"candidate": {
|
||||
"repository": "forgejo.coulomb.social/coulomb/flex-auth",
|
||||
"tag": "main-2de0f86",
|
||||
"immutable_image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776",
|
||||
"revision_label": "2de0f862f9875f344f090b633813239a33d63426",
|
||||
"platform": "linux/amd64",
|
||||
"built_by": ".forgejo/workflows/image.yaml (push to main, examples/** path trigger), tools/publish-runtime-images.sh legacy mode"
|
||||
},
|
||||
"policy_file": {
|
||||
"path": "/opt/flex-auth/examples/informed-decision-present-existing-review/policy.md",
|
||||
"file_sha256": "dcfae73726a824795fbb19962116366461cc22813031939f4d8bcc6803f40141",
|
||||
"equals_source_at": "2de0f86",
|
||||
"package": "informed-decision.compact-sitting",
|
||||
"version": "v14",
|
||||
"package_digest": "sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde",
|
||||
"package_digest_method": "internal/policy Package.Digest() over the directory copied out of the image (whole directory byte-identical to examples/ at 2de0f86)",
|
||||
"image_validate": "access-engine validate --kind policy: valid, 46 Rego tests and 4 fixtures pass"
|
||||
},
|
||||
"rollback_policy_in_same_image": {
|
||||
"path": "/opt/flex-auth/examples/informed-decision-lifecycle-review/policy.md",
|
||||
"version": "v13",
|
||||
"package_digest": "sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873"
|
||||
},
|
||||
"registry_file_sha256": "58c308f8abf2e1804b82d7d6247e8f547b1b58ae7050bbd69ba87650a3df2283 (lifecycle-review and present-existing-review copies identical)",
|
||||
"offline_verify_requests": {
|
||||
"verify-self-approval.request.json": {
|
||||
"v14": "deny self_approval_refused",
|
||||
"v13": "deny unknown_class"
|
||||
},
|
||||
"verify-missing-action.request.json": {
|
||||
"v14": "deny approval_action_not_admitted",
|
||||
"v13": "deny unknown_class"
|
||||
},
|
||||
"note": "subject.attributes.assurance.at must be set to the current epoch at run time (jq), otherwise both answer identity_refused"
|
||||
},
|
||||
"scan": {
|
||||
"scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
|
||||
"severities": [
|
||||
"HIGH",
|
||||
"CRITICAL"
|
||||
],
|
||||
"candidate": {
|
||||
"image_id": "sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776",
|
||||
"vulnerabilities": 8,
|
||||
"findings": [
|
||||
{
|
||||
"target": "usr/local/bin/access-engine",
|
||||
"id": "CVE-2026-111943",
|
||||
"pkg": "stdlib",
|
||||
"installed": "v1.26.7",
|
||||
"fixed": "1.26.10, 1.27.3",
|
||||
"severity": "HIGH"
|
||||
},
|
||||
{
|
||||
"target": "usr/local/bin/access-engine",
|
||||
"id": "CVE-2026-78667",
|
||||
"pkg": "stdlib",
|
||||
"installed": "v1.26.7",
|
||||
"fixed": "1.26.9, 1.27.2",
|
||||
"severity": "HIGH"
|
||||
},
|
||||
{
|
||||
"target": "usr/local/bin/access-engine",
|
||||
"id": "CVE-2026-78669",
|
||||
"pkg": "stdlib",
|
||||
"installed": "v1.26.7",
|
||||
"fixed": "1.26.9, 1.27.2",
|
||||
"severity": "HIGH"
|
||||
},
|
||||
{
|
||||
"target": "usr/local/bin/access-engine",
|
||||
"id": "CVE-2026-97031",
|
||||
"pkg": "stdlib",
|
||||
"installed": "v1.26.7",
|
||||
"fixed": "1.26.9, 1.27.2",
|
||||
"severity": "HIGH"
|
||||
},
|
||||
{
|
||||
"target": "usr/local/bin/flex-auth",
|
||||
"id": "CVE-2026-111943",
|
||||
"pkg": "stdlib",
|
||||
"installed": "v1.26.7",
|
||||
"fixed": "1.26.10, 1.27.3",
|
||||
"severity": "HIGH"
|
||||
},
|
||||
{
|
||||
"target": "usr/local/bin/flex-auth",
|
||||
"id": "CVE-2026-78667",
|
||||
"pkg": "stdlib",
|
||||
"installed": "v1.26.7",
|
||||
"fixed": "1.26.9, 1.27.2",
|
||||
"severity": "HIGH"
|
||||
},
|
||||
{
|
||||
"target": "usr/local/bin/flex-auth",
|
||||
"id": "CVE-2026-78669",
|
||||
"pkg": "stdlib",
|
||||
"installed": "v1.26.7",
|
||||
"fixed": "1.26.9, 1.27.2",
|
||||
"severity": "HIGH"
|
||||
},
|
||||
{
|
||||
"target": "usr/local/bin/flex-auth",
|
||||
"id": "CVE-2026-97031",
|
||||
"pkg": "stdlib",
|
||||
"installed": "v1.26.7",
|
||||
"fixed": "1.26.9, 1.27.2",
|
||||
"severity": "HIGH"
|
||||
}
|
||||
]
|
||||
},
|
||||
"in_force_6c6dc263": {
|
||||
"image_id": "sha256:6c6dc263f4a7f6461e109e133c004c080e8e373acfead8611856c5fb3e44168e",
|
||||
"vulnerabilities": 4,
|
||||
"findings": [
|
||||
{
|
||||
"target": "usr/local/bin/flex-auth",
|
||||
"id": "CVE-2026-111943",
|
||||
"pkg": "stdlib",
|
||||
"installed": "v1.26.7",
|
||||
"fixed": "1.26.10, 1.27.3",
|
||||
"severity": "HIGH"
|
||||
},
|
||||
{
|
||||
"target": "usr/local/bin/flex-auth",
|
||||
"id": "CVE-2026-78667",
|
||||
"pkg": "stdlib",
|
||||
"installed": "v1.26.7",
|
||||
"fixed": "1.26.9, 1.27.2",
|
||||
"severity": "HIGH"
|
||||
},
|
||||
{
|
||||
"target": "usr/local/bin/flex-auth",
|
||||
"id": "CVE-2026-78669",
|
||||
"pkg": "stdlib",
|
||||
"installed": "v1.26.7",
|
||||
"fixed": "1.26.9, 1.27.2",
|
||||
"severity": "HIGH"
|
||||
},
|
||||
{
|
||||
"target": "usr/local/bin/flex-auth",
|
||||
"id": "CVE-2026-97031",
|
||||
"pkg": "stdlib",
|
||||
"installed": "v1.26.7",
|
||||
"fixed": "1.26.9, 1.27.2",
|
||||
"severity": "HIGH"
|
||||
}
|
||||
]
|
||||
},
|
||||
"assessment": "Same four Go stdlib 1.26.7 CVEs (HIGH) in candidate and in the image in force; OS layer clean. The candidate does not regress, but the previous release gate (zero HIGH/CRITICAL) is not met. Fix = Go >= 1.26.10 toolchain bump and a rebuild (new digest). Founder decides."
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,43 @@
|
|||
{
|
||||
"id": "v14-verify-missing-action",
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "founder-human",
|
||||
"type": "human",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied",
|
||||
"groups": [
|
||||
"net-kingdom-admins"
|
||||
],
|
||||
"assurance": {
|
||||
"level": "aal2",
|
||||
"mfa": true,
|
||||
"source": "key-cape",
|
||||
"methods": [
|
||||
"pwd",
|
||||
"otp"
|
||||
],
|
||||
"at": 0
|
||||
}
|
||||
}
|
||||
},
|
||||
"resource": {
|
||||
"id": "memo:v14-release-verify",
|
||||
"type": "decision-memo",
|
||||
"system": "informed-decision",
|
||||
"tenant": "tenant:platform"
|
||||
},
|
||||
"action": "read",
|
||||
"context": {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "bounded-execution",
|
||||
"intake_submitter": "nk-bind-executor",
|
||||
"approval_requester": "service:nk-bind-executor",
|
||||
"approval_human_control": true,
|
||||
"memo_version": 1,
|
||||
"approval_id": "00000000-0000-4000-8000-000000000014",
|
||||
"approval_binding_digest": "sha256:0000000000000000000000000000000000000000000000000000000000000000"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,44 @@
|
|||
{
|
||||
"id": "v14-verify-self-approval",
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "service:nk-bind-executor",
|
||||
"type": "human",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied",
|
||||
"groups": [
|
||||
"net-kingdom-admins"
|
||||
],
|
||||
"assurance": {
|
||||
"level": "aal2",
|
||||
"mfa": true,
|
||||
"source": "key-cape",
|
||||
"methods": [
|
||||
"pwd",
|
||||
"otp"
|
||||
],
|
||||
"at": 0
|
||||
}
|
||||
}
|
||||
},
|
||||
"resource": {
|
||||
"id": "memo:v14-release-verify",
|
||||
"type": "decision-memo",
|
||||
"system": "informed-decision",
|
||||
"tenant": "tenant:platform"
|
||||
},
|
||||
"action": "read",
|
||||
"context": {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "bounded-execution",
|
||||
"intake_submitter": "nk-bind-executor",
|
||||
"approval_requester": "service:nk-bind-executor",
|
||||
"approval_human_control": true,
|
||||
"approval_action": "bounded-execution",
|
||||
"memo_version": 1,
|
||||
"approval_id": "00000000-0000-4000-8000-000000000014",
|
||||
"approval_binding_digest": "sha256:0000000000000000000000000000000000000000000000000000000000000000"
|
||||
}
|
||||
}
|
||||
2
go.mod
2
go.mod
|
|
@ -1,6 +1,6 @@
|
|||
module github.com/netkingdom/access-engine
|
||||
|
||||
go 1.26.7
|
||||
go 1.26.10
|
||||
|
||||
require (
|
||||
github.com/netkingdom/approval-engine/adapters/go/approvalfact v0.0.0
|
||||
|
|
|
|||
|
|
@ -102,12 +102,14 @@ func TestSittingImagePinMatchesRecordedBuild(t *testing.T) {
|
|||
}
|
||||
text := string(raw)
|
||||
// values/informed-decision-sitting.yaml records the founder-approved
|
||||
// INFD-WP-0007 / FLEX-WP-0033 cutover image of 2026-10-04 (64a22ab), which
|
||||
// serves the lifecycle-review package. The v11 pin (1aae59f) is superseded.
|
||||
if !strings.Contains(text, "sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99") {
|
||||
t.Fatal("sitting image digest differs from the recorded cutover build")
|
||||
// FLEX-WP-0040-T07 compact-sitting v14 release candidate (CI image of
|
||||
// 2de0f86, docs/compact-sitting-v14-release-runbook.md). The FLEX-WP-0034
|
||||
// v13 image (6c6dc263) is the rollback, kept in
|
||||
// values/informed-decision-lifecycle-review.candidate.yaml.
|
||||
if !strings.Contains(text, "sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776") {
|
||||
t.Fatal("sitting image digest differs from the recorded release candidate build")
|
||||
}
|
||||
if !strings.Contains(text, "/opt/flex-auth/examples/informed-decision-lifecycle-review/policy.md") {
|
||||
if !strings.Contains(text, "/opt/flex-auth/examples/informed-decision-present-existing-review/policy.md") {
|
||||
t.Fatal("sitting policy path changed")
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
name: access-engine-informed-decision-sitting
|
||||
image:
|
||||
repository: forgejo.coulomb.social/coulomb/flex-auth
|
||||
digest: sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99
|
||||
digest: sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776
|
||||
args:
|
||||
- serve
|
||||
- --addr
|
||||
|
|
@ -10,7 +10,7 @@ args:
|
|||
- --registry
|
||||
- /opt/flex-auth/examples/informed-decision-lifecycle-review/registry.json
|
||||
- --policy
|
||||
- /opt/flex-auth/examples/informed-decision-lifecycle-review/policy.md
|
||||
- /opt/flex-auth/examples/informed-decision-present-existing-review/policy.md
|
||||
callerAuth:
|
||||
mode: enforce
|
||||
kubernetesURL: https://10.43.0.1
|
||||
|
|
@ -23,7 +23,7 @@ consumer:
|
|||
resources:
|
||||
requests:
|
||||
cpu: 5m
|
||||
memory: 32Mi
|
||||
memory: 40Mi
|
||||
limits:
|
||||
cpu: 300m
|
||||
memory: 192Mi
|
||||
|
|
|
|||
|
|
@ -1,8 +1,12 @@
|
|||
# Founder-approved INFD-WP-0007 / FLEX-WP-0033 cutover, 2026-10-04.
|
||||
# FLEX-WP-0040-T07 release candidate (founder-approved 2026-11-01; NOT yet applied):
|
||||
# compact-sitting v14 sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde,
|
||||
# CI image main-2de0f86. Runbook: docs/compact-sitting-v14-release-runbook.md.
|
||||
# In force before this release (Helm rev 13, FLEX-WP-0034, v13): image 6c6dc263...168e,
|
||||
# exact values values/informed-decision-lifecycle-review.candidate.yaml (rollback).
|
||||
name: flex-auth-informed-decision-sitting
|
||||
image:
|
||||
repository: forgejo.coulomb.social/coulomb/flex-auth
|
||||
digest: sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99
|
||||
digest: sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776
|
||||
args:
|
||||
- serve
|
||||
- --addr
|
||||
|
|
@ -10,7 +14,7 @@ args:
|
|||
- --registry
|
||||
- /opt/flex-auth/examples/informed-decision-lifecycle-review/registry.json
|
||||
- --policy
|
||||
- /opt/flex-auth/examples/informed-decision-lifecycle-review/policy.md
|
||||
- /opt/flex-auth/examples/informed-decision-present-existing-review/policy.md
|
||||
callerAuth:
|
||||
mode: enforce
|
||||
kubernetesURL: https://10.43.0.1
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue