tegwick
4c940d49ae
Apply the separate attestor identity, named-ConfigMap RBAC, attest egress and daily CronJob. Bootstrap an empty chain-head ConfigMap only because it was absent; drop the placeholder from the apply path so a later apply cannot overwrite a live head. One-shot job published a 59-event attestation; mounted readback and receiver write-denial passed. Offsite copy stays the operator path. Assistant: grok Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082
23 lines
892 B
JSON
23 lines
892 B
JSON
{
|
|
"task": "AUDIT-WP-0009-T12",
|
|
"observed_at": "2026-09-15T19:15:40+00:00",
|
|
"job": "audit-core-attest-t12",
|
|
"job_succeeded": true,
|
|
"image": "forgejo.coulomb.social/coulomb/audit-core@sha256:ec15f63d49226bfe507af2bc38ffbd5e83f549ba2c6d1ae7a338e7e053f34615",
|
|
"published": true,
|
|
"schema": "audit-core.chain-head.v1",
|
|
"event_count": 59,
|
|
"head_prefix": "bb0937f02a772d1c",
|
|
"mounted_readback": true,
|
|
"receiver_patch": "URLError",
|
|
"rbac": {
|
|
"default_sa_can_patch_chain_head": false,
|
|
"attest_sa_can_patch_chain_head": true,
|
|
"attest_sa_can_create_configmaps": false
|
|
},
|
|
"cronjob": "audit-core-attest-chain",
|
|
"schedule": "17 3 * * *",
|
|
"offsite_copy": "not_written_here",
|
|
"readyz_tamper_evidence": false,
|
|
"readyz_note": "live image reports last-known claim on /readyz; the mounted file is the live attestation. Offsite copy remains RESOURCE-WP-0002-T06."
|
|
}
|