38 lines
931 B
Markdown
38 lines
931 B
Markdown
|
---
|
||
|
|
id: ADHOC-2026-08-23
|
||
|
|
type: workplan
|
||
|
|
title: "Inbound caller-auth and deployment documentation corrections"
|
||
|
|
domain: infotech
|
||
|
|
repo: flex-auth
|
||
|
|
status: finished
|
||
|
|
owner: codex
|
||
|
|
topic_slug: netkingdom
|
||
|
|
created: "2026-08-23"
|
||
|
|
updated: "2026-08-23"
|
||
|
|
---
|
||
|
|
|
||
|
|
## Classify rejected TokenReview credentials as unauthenticated
|
||
|
|
|
||
|
|
```task
|
||
|
|
id: ADHOC-2026-08-23-T01
|
||
|
|
status: done
|
||
|
|
priority: medium
|
||
|
|
```
|
||
|
|
|
||
|
|
Treat a successful TokenReview response that rejects a bearer token as an
|
||
|
|
authentication failure (HTTP 401), while retaining HTTP 503 for transport,
|
||
|
|
HTTP, and response-decode failures. Regression coverage exercises the reviewer
|
||
|
|
and authenticator seam.
|
||
|
|
|
||
|
|
## Correct NetworkPolicy egress documentation
|
||
|
|
|
||
|
|
```task
|
||
|
|
id: ADHOC-2026-08-23-T02
|
||
|
|
status: done
|
||
|
|
priority: low
|
||
|
|
```
|
||
|
|
|
||
|
|
Document that caller-authenticated pins permit TCP 443 and 6443 without a
|
||
|
|
destination selector for Kubernetes TokenReview, while pins without caller
|
||
|
|
authentication retain deny-all egress.
|