tegwick
b36552545d
Carries the T06 independent full-scope reconciliation reader and the AUDIT-WP-0018-T02 reject-only secret_policy overlay. No migration beyond 0007; the migration Job needs no rerun. Full suite incl. PostgreSQL backend: 373 passed (1 unrelated live-catalog env failure). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 482098@bnt-lap001 Assistant-Session: 9643c95a-a398-4f4a-b56a-6119be4e845e
43 lines
2.5 KiB
Markdown
43 lines
2.5 KiB
Markdown
# railiance01 package
|
|
|
|
Target: railiance01 only. The workstation kubeconfig that talks to that API
|
|
is the `k3s-api-railiance01` tunnel (local port **16444**).
|
|
`~/.kube/config-hosteurope` currently points at 16443 (coulombcore); rewrite
|
|
the server port or export a copy before applying.
|
|
|
|
Apply order is documented in `docs/operator-runbook.md`. Do not apply the
|
|
Deployment until:
|
|
|
|
1. The image digest is pinned (currently `sha256:304cfb83…` built from source commit `818589359ae343d821a009413823f4456962c0d1`, AUDIT-WP-0013-T07).
|
|
2. Secrets `audit-core-database`, `audit-core-database-migrate`, and
|
|
`audit-core-senders` exist. ConfigMap `audit-core-senders-scope` is
|
|
applied (`deploy/senders-scope.yaml`) before the Deployment mounts it.
|
|
3. Apply `deploy/migrate-egress.yaml` before starting the migration Job.
|
|
The default-deny policy selects every pod, while the receiver egress policy
|
|
deliberately selects component `receiver` only. Migration pods need their
|
|
own exact component `migrate` exception: DNS TCP/UDP53 to kube-dns in
|
|
kube-system and PostgreSQL TCP5432 to platform-pg pods in databases.
|
|
No API-server access or service account token is needed.
|
|
4. Job `audit-core-migrate` has completed and ledger includes
|
|
`0007-import-receipts` before the current receiver image is released.
|
|
|
|
```bash
|
|
make image-build
|
|
make deploy-dry-run
|
|
```
|
|
|
|
The 2026-10-15 NK-WP-0035 migration retries exposed this missing dedicated
|
|
egress exception: the first two attempts could not resolve/reach PostgreSQL.
|
|
The bounded policy is retained as source so future releases do not depend on
|
|
an undocumented repair. Both receiver and migration Job pin immutable image
|
|
`forgejo.coulomb.social/coulomb/audit-core@sha256:b479801b0bc76df66a36a85376c45aaf399c6d82feade9ba81430b774c4a8271`,
|
|
built from source `5227fb14e47f26a01930be4611360fd90f740662`; this follow-up
|
|
changes deployment configuration only and requires no image rebuild. Migration
|
|
0007 adds import receipts and indexes without changing existing event rows.
|
|
|
|
AUDIT-WP-0013-T07 (2026-11-03) re-pins receiver and migration Job to
|
|
`forgejo.coulomb.social/coulomb/audit-core@sha256:304cfb83daa873e5790a2f262f6c4ccd56498b6e9e1a390368dcf0d407256300`,
|
|
built from `818589359ae343d821a009413823f4456962c0d1`. It carries the T06
|
|
independent full-scope reconciliation reader and the AUDIT-WP-0018-T02
|
|
reject-only secret_policy overlay. No migration beyond 0007 is added, so no
|
|
migration Job run is required; rollback to `b479801b…` stays schema-compatible.
|