coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add Railiance staged-promotion overlay for flex-auth
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned
Helm values for tenant-engine and user-engine, isolated canary cycle
(deploy/observe/promote/rollback), and emergency kubectl path retained.
T03 waits on the custodian drain-plan row.
This commit is contained in:
tegwick 2026-08-16 01:32:31 +02:00
parent 804251514c
commit 1d58f13eb8
19 changed files with 634 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

15
deploy/README.md
View file

@ -1,10 +1,13 @@
# flex-auth production deployment
The sanctioned promotion path is the Railiance overlay in
[`../railiance/`](../railiance/README.md) (`railiance/app.toml`,
`charts/flex-auth`, `values/*.yaml`). These flattened files are the
emergency kubectl path recovered on 2026-08-11 from live
`last-applied-configuration`, kept so a rollback does not depend on a
cluster annotation or on Helm history.
Manifests for the two cluster-local flex-auth policy-decision services.
Both were previously applied with `kubectl apply` from a file that lived
outside this repo; these were recovered from the live objects'
`kubectl.kubernetes.io/last-applied-configuration` on 2026-08-11 and
committed so that a rollback does not depend on a cluster annotation.
| File | Deployment | Consumer | Service DNS |
| --- | --- | --- | --- |
@ -83,8 +86,8 @@ last-known-good digest below.
| Deployment | Last-known-good digest | Policy state |
| --- | --- | --- |
| `flex-auth-tenant-engine` | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | **current** — seven-action policy, FLEX-WP-0010, CI-built from `e9911eb`, live 2026-08-11 |
| `flex-auth-tenant-engine` *(previous)* | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | four-action policy, pre-FLEX-WP-0010 (lifecycle actions deny `unknown_action`) |
| `flex-auth-tenant-engine` | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | **live 2026-08-16** — four-action policy; `tenant.retire`/`update`/`reactivate` deny `unknown_action` |
| `flex-auth-tenant-engine` *(FLEX-WP-0010)* | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | seven-action policy, CI-built from `e9911eb`; ReplicaSet present but scaled to 0 |
| `flex-auth-user-engine` | `sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4` | **current** — FLEX-WP-0009-T04, nine fixtures (incl. registration-applicant) verified live 2026-08-16 |
| `flex-auth-user-engine` *(previous)* | `sha256:a31961c45215aa6baf3bc748c6741ab703c2c8325e61aa7983a355026195e51b` | FLEX-WP-0009-T03, six fixtures verified live 2026-08-10 |

2
deploy/flex-auth-tenant-engine.yaml
View file

@ -23,7 +23,7 @@ spec:
- /opt/flex-auth/examples/tenant-engine/registry_snapshot.json
- --policy
- /opt/flex-auth/examples/tenant-engine/policy_package.md
image: forgejo.coulomb.social/coulomb/flex-auth@sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7
image: forgejo.coulomb.social/coulomb/flex-auth@sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa
livenessProbe:
httpGet:
path: /healthz