tegwick
2bd2d19a98
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a05e2e-805b-7042-a750-71f473bceea2
26 lines
1.3 KiB
Markdown
26 lines
1.3 KiB
Markdown
# Deployment gates
|
|
|
|
The checked-in StatefulSet is a reviewed release input, not evidence of a live
|
|
deployment. Replace both image placeholders with the same immutable digest.
|
|
SQLite is intentionally limited to one replica, `ReadWriteOnce` storage, and an
|
|
`OnDelete` update: never start two writers against a copied database.
|
|
|
|
Before applying:
|
|
|
|
1. Register the exact `approval-engine` audience, caller scopes, and service
|
|
clients in KeyCape. Confirm the in-cluster JWKS endpoint and configured
|
|
issuer match the manifest.
|
|
2. Register `approval-engine` as an audit-core sender, add matching audit-core
|
|
ingress, and provision `approval-engine-audit` through the credential owner.
|
|
The Secret must contain key `audit-token`; never commit its value.
|
|
3. Build and scan the image, replace `REPLACE_WITH_RELEASE_DIGEST`, then run
|
|
`make deploy-dry-run`.
|
|
4. Take a verified backup. Roll out by deleting the sole pod, then prove
|
|
readiness, restart persistence, outbox drain, heartbeat, and restore.
|
|
5. Enable a caller namespace only by applying label
|
|
`railiance.io/approval-engine-client=true`; JWT scope checks remain the inner
|
|
boundary.
|
|
|
|
The audit-core receiver-side registration, cadence findings, and accepted-count
|
|
reconciliation are tracked by `AUDIT-WP-0009-T04/T06/T09` and cannot be closed
|
|
from this repository.
|