coulomb/audit-core
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
audit-core/deploy
History
tegwick 7728fde9b4
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
AUDIT-WP-0018-T02 done: nk-bounded-executor sender scope and sso ingress prepared 
- deploy/senders-scope.{json,yaml}: nk-bounded-executor (source
  net-kingdom.bounded-executor, tenants [platform], write-only,
  secret_policy reject, load-bearing); inert until a token is seeded
- senders.py: the scope overlay may tighten secret_policy redact->reject,
  never relax it
- networkpolicies.yaml: audit-core-nk-bounded-executor-ingress (sso AND
  app.kubernetes.io/name=bounded-executor, TCP 8080); not applied
- tests on the executor's envelope shape: 202, 200 duplicate, 409, wrong
  source/tenant, secret-shaped step check 400
- T03 unblocked (window bound = admission window.not_after)
- docs: emitter defect: executor AuditCore.emit rejects 202

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
2026-10-31 23:02:44 +01:00
..
attest-cronjob.yaml Operate scheduled chain-head attestation (AUDIT-WP-0009-T12) 2026-09-15 21:18:17 +02:00
audit-core.yaml Wave-2 right-sizing: audit-core CPU request 50m->10m (AUDIT-WP-0016) 2026-10-22 00:00:33 +02:00
clustersecretstore.yaml Read mounted DB credentials from a Kubernetes snapshot 2026-08-13 12:25:32 +02:00
externalsecret-senders.yaml fix(security): prevent ESO copying source annotations (CUST-WP-0073) 2026-09-28 15:56:50 +02:00
externalsecrets.yaml Stand up railiance01 receiver without founder bao kv put 2026-08-13 10:27:13 +02:00
migrate-egress.yaml Retain narrow migration egress and pin cadence-capable receiver release 2026-10-15 21:32:15 +02:00
migrate-job.yaml Retain narrow migration egress and pin cadence-capable receiver release 2026-10-15 21:32:15 +02:00
networkpolicies.yaml AUDIT-WP-0018-T02 done: nk-bounded-executor sender scope and sso ingress prepared 2026-10-31 23:02:44 +01:00
qonto-collector-ingress.yaml Prepare guarded cadence registry updates and Qonto receiver admission 2026-10-15 21:19:05 +02:00
README.md Retain narrow migration egress and pin cadence-capable receiver release 2026-10-15 21:32:15 +02:00
senders-scope.json AUDIT-WP-0018-T02 done: nk-bounded-executor sender scope and sso ingress prepared 2026-10-31 23:02:44 +01:00
senders-scope.yaml AUDIT-WP-0018-T02 done: nk-bounded-executor sender scope and sso ingress prepared 2026-10-31 23:02:44 +01:00

README.md

railiance01 package

Target: railiance01 only. The workstation kubeconfig that talks to that API is the k3s-api-railiance01 tunnel (local port 16444). ~/.kube/config-hosteurope currently points at 16443 (coulombcore); rewrite the server port or export a copy before applying.

Apply order is documented in docs/operator-runbook.md. Do not apply the Deployment until:

  1. The image digest is pinned (currently sha256:b479801b… built from source commit 5227fb14e47f26a01930be4611360fd90f740662).
  2. Secrets audit-core-database, audit-core-database-migrate, and audit-core-senders exist. ConfigMap audit-core-senders-scope is applied (deploy/senders-scope.yaml) before the Deployment mounts it.
  3. Apply deploy/migrate-egress.yaml before starting the migration Job. The default-deny policy selects every pod, while the receiver egress policy deliberately selects component receiver only. Migration pods need their own exact component migrate exception: DNS TCP/UDP53 to kube-dns in kube-system and PostgreSQL TCP5432 to platform-pg pods in databases. No API-server access or service account token is needed.
  4. Job audit-core-migrate has completed and ledger includes 0007-import-receipts before the current receiver image is released.
make image-build
make deploy-dry-run

The 2026-10-15 NK-WP-0035 migration retries exposed this missing dedicated egress exception: the first two attempts could not resolve/reach PostgreSQL. The bounded policy is retained as source so future releases do not depend on an undocumented repair. Both receiver and migration Job pin immutable image forgejo.coulomb.social/coulomb/audit-core@sha256:b479801b0bc76df66a36a85376c45aaf399c6d82feade9ba81430b774c4a8271, built from source 5227fb14e47f26a01930be4611360fd90f740662; this follow-up changes deployment configuration only and requires no image rebuild. Migration 0007 adds import receipts and indexes without changing existing event rows.