coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

deploy: add verified secrets-engine production policy pin
Some checks are pending
CI Smoke / host-smoke (push) Waiting to run
Details
CI Smoke / container-smoke (push) Waiting to run
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb
This commit is contained in:
tegwick 2026-09-06 19:45:40 +02:00
parent b7cc96b7b2
commit 0b4e5c28bc
3 changed files with 59 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

28
workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md
View file

@ -168,7 +168,7 @@ consumer asserting it is always present would pass on one and fail on the other.
```task
id: FLEX-WP-0021-T04
status: wait
status: done
priority: high
state_hub_task_id: "f4e8709a-65dd-5172-97ae-e7c3432afb22"
```
@ -232,3 +232,29 @@ Owner: `flex-auth`.
Gate: secrets-engine can set its required configuration to published values and
reach a pin; nothing about the fallback-free shape of that configuration changed.
## Production deployment — 2026-09-06
User authorized production deployment in the Glas session. Installed dedicated
Helm release `flex-auth-secrets-engine`, namespace `flex-auth`, revision 1,
using values/secrets-engine.yaml. CI tag main-dd3ce4c resolves to immutable
digest sha256:89086c02c74a931068423e70937d03df7850fa0db9c63e70be56b3558f1756af.
Chart lint and server dry-run passed; deployment available 1/1. Existing three
consumer deployment specifications were compared before/after and unchanged.
Five published requests returned two allows and three expected denies via
local port-forward. Network probes: namespace secrets-engine with pod label
app.kubernetes.io/name=secrets-engine succeeded after initial propagation
retry; wrong pod label and wrong namespace remained denied across retries.
All six temporary probes and the port-forward were removed. Created the
secrets-engine namespace for the intended consumer identity; no workload or
credential was installed there.
Service: http://flex-auth-secrets-engine.flex-auth.svc.cluster.local:8080.
Policy: secrets-engine.catalog-lane.lifecycle / v1. Caller authentication is
warn, per this task's rollout plan; this is not enforced caller authentication.
Network ingress admits only the specified namespace/pod selector. T05 remains
waiting on consumer configuration/adoption and the owner handoff. Approval
service, KeyCape clients and real credential-lane activation are not supplied
by this deployment. First-install rollback is removal of this dedicated Helm
release, leaving the three existing consumers untouched.