tegwick
f758381cea
- module path renamed (no external importers); golangci local-prefixes - ACCESS_ENGINE_RUN_TOPAZ_INTEGRATION replaces FLEX_AUTH_RUN_TOPAZ_INTEGRATION - README title and identity paragraph reflect the landed renames - docs/runtime-rename-inventory.md: per-consumer references by kind and order - chart name, image package and /opt paths deliberately left for T05 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 735967@bnt-lap001 Assistant-Session: 5971967f-77f8-4ced-9e02-c6ef67040ffc
108 lines
5.1 KiB
Markdown
108 lines
5.1 KiB
Markdown
# Runtime rename inventory (FLEX-WP-0036-T02)
|
|
|
|
Derived 2026-10-10 by searching each consumer checkout for `flex-auth` and
|
|
`FLEX_AUTH` in code and config (`.py .go .yaml .yml .toml .json .sh .ts`).
|
|
Git, venv, history and archived paths are excluded. Tests are listed only where
|
|
they run the binary. Historical evidence and batch files under `docs/` are
|
|
counted but are not to be rewritten: they record what was live at the time.
|
|
|
|
Re-derive before T06 with the same search. This is a snapshot, not a register.
|
|
|
|
## What a consumer has to change, by kind
|
|
|
|
| Kind | Breaks if changed before the PDP accepts it? | Order |
|
|
| --- | --- | --- |
|
|
| Service URL `flex-auth-<c>.flex-auth.svc…` | Yes: the new name resolves only once T05 has run | T05, then the consumer |
|
|
| Egress NetworkPolicy naming namespace `flex-auth` | Yes: drops traffic to the old pin | Add `access-engine`, switch, then remove `flex-auth` |
|
|
| Projected-token audience `flex-auth` | Yes: 401 until T03 accepts `access-engine` | T03, then the consumer |
|
|
| `resource.system` / `owner_repo` = `flex-auth` | Yes: `not_applicable`, i.e. deny (`FLEX-DEC-2026-015`) | T03, then the consumer |
|
|
| Consumer-owned env var names (`<C>_FLEX_AUTH_URL` …) | No: the consumer's own vocabulary | Consumer's choice; not required |
|
|
| Builds or runs our binary | Already changed (`FLEX-DEC-2026-020`): the stub exits 2 | Consumer builds `./cmd/access-engine` |
|
|
|
|
## Per consumer
|
|
|
|
### ops-warden
|
|
|
|
Live pins: `flex-auth-ops-warden` (sign), `flex-auth-ops-warden-fetch`.
|
|
|
|
- URLs: `examples/warden.production.example.yaml` (sign and fetch); live
|
|
config under the operator. Workstation tunnels
|
|
`flex-auth-ops-warden-railiance01` (:19090) and
|
|
`flex-auth-ops-warden-fetch-railiance01` (:19091) in ops-bridge
|
|
`tunnels.yaml` point at ClusterIPs, which change with the new Services.
|
|
- Audience: `examples/warden.production.example.yaml`.
|
|
- `resource.system`: lane `flex-auth-policy-check`, `owner_repo: flex-auth`
|
|
in `registry/routing/catalog.yaml`.
|
|
- Binary: `scripts/policy_gate_production_smoke.sh` (`FLEX_AUTH_BIN`,
|
|
default `/tmp/flex-auth`).
|
|
- Also: `scripts/build_flex_auth_registry.py`,
|
|
`scripts/check_flex_auth_manifest_coverage.py`, `pep-stance.yaml`,
|
|
`layer.yaml`, `tenancy.yaml`, and `src/warden/{policy,access,caller_identity}.py`.
|
|
These are names, not runtime addresses.
|
|
|
|
### secrets-engine
|
|
|
|
Live pin: `flex-auth-secrets-engine`.
|
|
|
|
- URLs appear in docs and tests only. secrets-engine is a CLI, and its
|
|
operator access path is still open (`FLEX-WP-0023`).
|
|
- Binary: `tools/exercise_approval_identity.py` builds `./cmd/flex-auth`
|
|
(notified 2026-10-10, message `ad4b1b3e`).
|
|
- `pep-stance.yaml` names the PDP.
|
|
|
|
### user-engine (deployment sources in net-kingdom)
|
|
|
|
Live pins: `flex-auth-user-engine` (check), `flex-auth-application-readback`.
|
|
|
|
- URL, audience and egress: `net-kingdom/sso-mfa/k8s/user-engine/runtime.yaml`
|
|
(`USER_ENGINE_FLEX_AUTH_URL`, token audience `flex-auth`, egress namespace
|
|
`flex-auth`), plus the readback URL promised on 2026-10-10 (message
|
|
`5460cee2`).
|
|
- Env vars: `USER_ENGINE_FLEX_AUTH_{URL,TOKEN_FILE,TIMEOUT}` and
|
|
`USER_ENGINE_READBACK_TOKEN_FILE` in `src/user_engine/runtime.py` and
|
|
`adapters/local.py`. These are the consumer's own names.
|
|
|
|
### tenant-engine
|
|
|
|
Live pin: `flex-auth-tenant-engine`.
|
|
|
|
- URL, audience and egress: `deploy/base/tenant-engine.yaml`, `railiance/app.toml`.
|
|
- Env vars: `TENANT_ENGINE_FLEX_AUTH_{URL,TOKEN_FILE,TIMEOUT_SECONDS}` in
|
|
`src/tenant_engine/config.py`; `pep-stance.yaml`.
|
|
|
|
### informed-decision
|
|
|
|
Live pins: `flex-auth-informed-decision-lifecycle`, `-sitting`, `-t03`.
|
|
|
|
- URLs and audience: `deploy/sitting-admission.json`, `deploy/t03-admission.json`,
|
|
`deploy/lifecycle/{admission,service}.candidate.json`, and
|
|
`tools/render_deployment.py`. The live egress policy `informed-decision-review`
|
|
names namespace `flex-auth`.
|
|
- Binary: `tests/browser_fixture.py`, `tests/test_lifecycle_policy_component.py`,
|
|
`tests/test_review_component.py` and `tests/test_lifecycle_review.py` take
|
|
`INFD_FLEX_AUTH_BINARY` / `INFD_FLEX_AUTH_SOURCE`. A binary built from current
|
|
source must come from `./cmd/access-engine`. Doc
|
|
`docs/protected-browser-review.md` notified (message `9b15c762`).
|
|
- `docs/batches/**` and `docs/evidence/**` are historical. Leave them.
|
|
|
|
### net-kingdom
|
|
|
|
- Owns user-engine's deployment source (above).
|
|
- `runbooks/protected-system-flex-auth/pack.yaml` and
|
|
`docs/tutorials/protected-system-flex-auth.md` run `go run ./cmd/flex-auth`
|
|
(notified, message `e2f1aac9`).
|
|
|
|
### Others with references, not consumers of a pin
|
|
|
|
- `state-hub/repository_rename_workplan.py`: tooling from `FLEX-WP-0020`.
|
|
- `railiance-platform/scripts/credential.py`: `FLEX_AUTH_{URL,PATH,SUBJECT_TYPES}`.
|
|
Check whether it calls a live pin before T06.
|
|
- `the-custodian`: docs only.
|
|
- Hub repo record `local_path` is `/home/worsch/flex-auth`, but the checkout is
|
|
`/home/worsch/access-engine` (`FLEX-WP-0020-T11` residual).
|
|
|
|
## Owner handoffs
|
|
|
|
Requested after T01 fixes the target names, so each owner gets one message
|
|
with the exact new URL and audience: `ops-warden`, `secrets-engine`,
|
|
`user-engine` with `net-kingdom`, `tenant-engine`, and `informed-decision`.
|