tegwick
c9ad5c2dd7
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1046e-fdbf-7b93-a267-5f72b9b24526
69 lines
4.1 KiB
Markdown
69 lines
4.1 KiB
Markdown
# Deployment gates
|
|
|
|
The StatefulSet is deployed as of 2026-09-14. The metadata receipt is
|
|
`docs/evidence/2026-09-14-approval-engine-deployment.json`. SQLite is intentionally limited to one replica, `ReadWriteOnce`
|
|
storage, and an `OnDelete` update: never start two writers against a copied
|
|
database.
|
|
|
|
**Image: pinned, published and deployed.** Both `image:` references carry
|
|
`sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49`
|
|
(registry tag `0.1.0-hfact-be1a388`, source `be1a388`). Both references MUST stay
|
|
identical immutable digests: migration and server share one database.
|
|
|
|
The deployed artifact carries schema v5 and predates schema v6 in this source.
|
|
Schema v6 records verified `entries.tenant_source`; it requires a new scanned,
|
|
published image, identical migration/server pins, backup and an approved rollout.
|
|
The existing deployed image records:
|
|
`entries.principal_type` and explicit `approvals.human_control`. Its release scan
|
|
found zero HIGH/CRITICAL vulnerabilities. Disposable on-disk v4-to-v5 migration,
|
|
negative service/agent binding, human binding/consumption and restart persistence
|
|
passed inside the non-root container with no network and a read-only root.
|
|
See [the image evidence](../docs/evidence/2026-09-10-human-control-image.json).
|
|
This is artifact evidence; native identity, audit delivery and production restore
|
|
remain deployment gates. Never roll the old v3 image over a v5 database; use the
|
|
matching verified pre-migration backup for rollback.
|
|
|
|
The existing KeyCape consumer registration and CCR-2026-0021 audit projection
|
|
were already verified by their owners. Live inspection confirmed the projection
|
|
Ready, exact key name, receiver c82e0442 and existing producer ingress; custody
|
|
was reused without reading or rotating its value. Added the exact namespace AND
|
|
pod-label ingress to KeyCape for JWKS (`deploy/keycape-ingress.yaml`).
|
|
|
|
The pod requests 25m CPU/64Mi with unchanged 500m/256Mi limits: the node had
|
|
3975m of its 4000m CPU reserved, so the prior 50m request could not schedule.
|
|
Initial native observation was 1m CPU/20Mi. No other workload was resized.
|
|
Kubernetes token automount is disabled; the service uses no Kubernetes API.
|
|
|
|
The live service passed schema-v5 integrity, current JWKS reachability, anonymous
|
|
and invalid-bearer 401, first heartbeat delivery with zero pending outbox,
|
|
pod replacement with unchanged persisted outbox, verified online backup and an
|
|
isolated restore opened by the actual engine. An independent 0600 backup copy
|
|
was inspected locally. No live database was overwritten. The initial backup
|
|
copies are test evidence, not a long-term backup schedule or disaster-recovery
|
|
acceptance. Capacity and independent retention remain operational follow-up.
|
|
|
|
The real PEP adoption is still T05: CCR-2026-0019's operator group/reader,
|
|
requesting identity and real human approval are not supplied by deployment.
|
|
|
|
For a future reinstall or release:
|
|
|
|
1. Register the exact `approval-engine` audience, caller scopes, and service
|
|
clients in KeyCape. Confirm the in-cluster JWKS endpoint and configured
|
|
issuer match the manifest.
|
|
2. Register `approval-engine` as an audit-core sender, add matching audit-core
|
|
ingress, and provision `approval-engine-audit` through the credential owner.
|
|
The Secret must contain key `audit-token`; never commit its value.
|
|
3. For a new release only: `make image-release` (build, scan, push — the scan
|
|
gate fails the build on any CRITICAL or HIGH, so a failing scan blocks the
|
|
push), then pin both `image:` references to the returned registry digest and
|
|
run `make deploy-dry-run`. The current digest is already pinned; skip to 4
|
|
unless you are cutting a new image.
|
|
4. Take a verified backup. Roll out by deleting the sole pod, then prove
|
|
readiness, restart persistence, outbox drain, heartbeat, and restore.
|
|
5. Enable a caller namespace only by applying label
|
|
`railiance.io/approval-engine-client=true`; JWT scope checks remain the inner
|
|
boundary.
|
|
|
|
The audit-core receiver-side registration, cadence findings, and accepted-count
|
|
reconciliation are tracked by `AUDIT-WP-0009-T04/T06/T09` and cannot be closed
|
|
from this repository.
|