2026-08-13 00:58:49 +02:00
|
|
|
# railiance01 package
|
|
|
|
|
|
|
|
|
|
Target: railiance01 only. The workstation kubeconfig that talks to that API
|
|
|
|
|
is the `k3s-api-railiance01` tunnel (local port **16444**).
|
|
|
|
|
`~/.kube/config-hosteurope` currently points at 16443 (coulombcore); rewrite
|
|
|
|
|
the server port or export a copy before applying.
|
|
|
|
|
|
|
|
|
|
Apply order is documented in `docs/operator-runbook.md`. Do not apply the
|
|
|
|
|
Deployment until:
|
|
|
|
|
|
2026-10-15 21:32:15 +02:00
|
|
|
1. The image digest is pinned (currently `sha256:b479801b…` built from source commit `5227fb14e47f26a01930be4611360fd90f740662`).
|
2026-08-13 00:58:49 +02:00
|
|
|
2. Secrets `audit-core-database`, `audit-core-database-migrate`, and
|
2026-08-16 00:24:33 +02:00
|
|
|
`audit-core-senders` exist. ConfigMap `audit-core-senders-scope` is
|
|
|
|
|
applied (`deploy/senders-scope.yaml`) before the Deployment mounts it.
|
2026-10-15 21:32:15 +02:00
|
|
|
3. Apply `deploy/migrate-egress.yaml` before starting the migration Job.
|
|
|
|
|
The default-deny policy selects every pod, while the receiver egress policy
|
|
|
|
|
deliberately selects component `receiver` only. Migration pods need their
|
|
|
|
|
own exact component `migrate` exception: DNS TCP/UDP53 to kube-dns in
|
|
|
|
|
kube-system and PostgreSQL TCP5432 to platform-pg pods in databases.
|
|
|
|
|
No API-server access or service account token is needed.
|
|
|
|
|
4. Job `audit-core-migrate` has completed and ledger includes
|
|
|
|
|
`0007-import-receipts` before the current receiver image is released.
|
2026-08-13 00:58:49 +02:00
|
|
|
|
|
|
|
|
```bash
|
|
|
|
|
make image-build
|
|
|
|
|
make deploy-dry-run
|
|
|
|
|
```
|
2026-10-15 21:32:15 +02:00
|
|
|
|
|
|
|
|
The 2026-10-15 NK-WP-0035 migration retries exposed this missing dedicated
|
|
|
|
|
egress exception: the first two attempts could not resolve/reach PostgreSQL.
|
|
|
|
|
The bounded policy is retained as source so future releases do not depend on
|
|
|
|
|
an undocumented repair. Both receiver and migration Job pin immutable image
|
|
|
|
|
`forgejo.coulomb.social/coulomb/audit-core@sha256:b479801b0bc76df66a36a85376c45aaf399c6d82feade9ba81430b774c4a8271`,
|
|
|
|
|
built from source `5227fb14e47f26a01930be4611360fd90f740662`; this follow-up
|
|
|
|
|
changes deployment configuration only and requires no image rebuild. Migration
|
|
|
|
|
0007 adds import receipts and indexes without changing existing event rows.
|
