coulomb/audit-core
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
audit-core/deploy/README.md
tegwick 4fcf7c6474
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
AUDIT-WP-0018-T03: pin receiver image sha256:5f3d01c8 built from 2b8c909 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 482098@bnt-lap001
Assistant-Session: 9643c95a-a398-4f4a-b56a-6119be4e845e
2026-11-03 22:07:31 +01:00

2.9 KiB
Raw Blame History

railiance01 package

Target: railiance01 only. The workstation kubeconfig that talks to that API is the k3s-api-railiance01 tunnel (local port 16444). ~/.kube/config-hosteurope currently points at 16443 (coulombcore); rewrite the server port or export a copy before applying.

Apply order is documented in docs/operator-runbook.md. Do not apply the Deployment until:

  1. The image digest is pinned (currently sha256:5f3d01c8… built from source commit 2b8c9097adaef67c88f329452e42eca1d74b65a7, AUDIT-WP-0018-T03).
  2. Secrets audit-core-database, audit-core-database-migrate, and audit-core-senders exist. ConfigMap audit-core-senders-scope is applied (deploy/senders-scope.yaml) before the Deployment mounts it.
  3. Apply deploy/migrate-egress.yaml before starting the migration Job. The default-deny policy selects every pod, while the receiver egress policy deliberately selects component receiver only. Migration pods need their own exact component migrate exception: DNS TCP/UDP53 to kube-dns in kube-system and PostgreSQL TCP5432 to platform-pg pods in databases. No API-server access or service account token is needed.
  4. Job audit-core-migrate has completed and ledger includes 0007-import-receipts before the current receiver image is released.
make image-build
make deploy-dry-run

The 2026-10-15 NK-WP-0035 migration retries exposed this missing dedicated egress exception: the first two attempts could not resolve/reach PostgreSQL. The bounded policy is retained as source so future releases do not depend on an undocumented repair. Both receiver and migration Job pin immutable image forgejo.coulomb.social/coulomb/audit-core@sha256:b479801b0bc76df66a36a85376c45aaf399c6d82feade9ba81430b774c4a8271, built from source 5227fb14e47f26a01930be4611360fd90f740662; this follow-up changes deployment configuration only and requires no image rebuild. Migration 0007 adds import receipts and indexes without changing existing event rows.

AUDIT-WP-0013-T07 (2026-11-03) re-pins receiver and migration Job to forgejo.coulomb.social/coulomb/audit-core@sha256:304cfb83daa873e5790a2f262f6c4ccd56498b6e9e1a390368dcf0d407256300, built from 818589359ae343d821a009413823f4456962c0d1. It carries the T06 independent full-scope reconciliation reader and the AUDIT-WP-0018-T02 reject-only secret_policy overlay. No migration beyond 0007 is added, so no migration Job run is required; rollback to b479801b… stays schema-compatible.

AUDIT-WP-0018-T03 (2026-11-03) re-pins receiver and migration Job to forgejo.coulomb.social/coulomb/audit-core@sha256:5f3d01c8a1f90411a1429451b46c66a9ac9262fc7fce68790c16e22eeb7871a6, built from 2b8c9097adaef67c88f329452e42eca1d74b65a7. It adds the opening_without_closing stream finding (closing_classes). No schema change and no migration Job rerun are needed. Rollback to 304cfb83… is compatible: the older image ignores the closing_classes overlay key.