# railiance01 package

Target: railiance01 only. The workstation kubeconfig that talks to that API
is the `k3s-api-railiance01` tunnel (local port **16444**).
`~/.kube/config-hosteurope` currently points at 16443 (coulombcore); rewrite
the server port or export a copy before applying.

Apply order is documented in `docs/operator-runbook.md`. Do not apply the
Deployment until:

1. The image digest is pinned (currently `sha256:b479801b…` built from source commit `5227fb14e47f26a01930be4611360fd90f740662`).
2. Secrets `audit-core-database`, `audit-core-database-migrate`, and
   `audit-core-senders` exist. ConfigMap `audit-core-senders-scope` is
   applied (`deploy/senders-scope.yaml`) before the Deployment mounts it.
3. Apply `deploy/migrate-egress.yaml` before starting the migration Job.
   The default-deny policy selects every pod, while the receiver egress policy
   deliberately selects component `receiver` only. Migration pods need their
   own exact component `migrate` exception: DNS TCP/UDP53 to kube-dns in
   kube-system and PostgreSQL TCP5432 to platform-pg pods in databases.
   No API-server access or service account token is needed.
4. Job `audit-core-migrate` has completed and ledger includes
   `0007-import-receipts` before the current receiver image is released.

```bash
make image-build
make deploy-dry-run
```

The 2026-10-15 NK-WP-0035 migration retries exposed this missing dedicated
egress exception: the first two attempts could not resolve/reach PostgreSQL.
The bounded policy is retained as source so future releases do not depend on
an undocumented repair. Both receiver and migration Job pin immutable image
`forgejo.coulomb.social/coulomb/audit-core@sha256:b479801b0bc76df66a36a85376c45aaf399c6d82feade9ba81430b774c4a8271`,
built from source `5227fb14e47f26a01930be4611360fd90f740662`; this follow-up
changes deployment configuration only and requires no image rebuild. Migration
0007 adds import receipts and indexes without changing existing event rows.