From 6d85f95c8b03d87d95ca0d50cf2d770952f6b482 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 19 Aug 2026 14:35:27 +0200 Subject: [PATCH] Finish FLEX-WP-0015: both pins enforce, live A2 probes, AuthZEN deferred flex-auth-tenant-engine Helm rev 2 is enforce on sha256:138aa347 after tenant-engine 2063470 started sending a projected caller token (sha256:7dc9d7bf). Probe 200/401/403. tenancy.current.A is 2. T04 cancelled: AuthZEN waits for a PEP we do not control. --- deploy/README.md | 4 +-- deploy/flex-auth-tenant-engine.yaml | 2 +- .../adr/0004-inbound-caller-authentication.md | 2 +- docs/tenancy-posture-review.md | 2 +- railiance/README.md | 4 +-- tenancy.yaml | 13 ++++---- tests/stage1.sh | 3 +- values/tenant-engine.yaml | 6 ++-- ...LEX-WP-0015-tenancy-posture-conformance.md | 32 +++++++++++++------ 9 files changed, 41 insertions(+), 27 deletions(-) diff --git a/deploy/README.md b/deploy/README.md index bdfcdeb..615fba0 100644 --- a/deploy/README.md +++ b/deploy/README.md @@ -92,8 +92,8 @@ last-known-good digest below. | Deployment | Last-known-good digest | Policy state | | --- | --- | --- | -| `flex-auth-tenant-engine` | `sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b` | **pin, not live** — caller-auth **warn** (FLEX-WP-0015-T02), CI `main-3de72fe` | -| `flex-auth-tenant-engine` *(live until warn promote)* | `sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc` | nine-action policy (FLEX-WP-0014), CI-built from `f304688` | +| `flex-auth-tenant-engine` | `sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b` | **live** — caller-auth **enforce** (FLEX-WP-0015-T02), CI `main-3de72fe`, A2 probe 2026-08-19 | +| `flex-auth-tenant-engine` *(previous)* | `sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc` | nine-action policy (FLEX-WP-0014), CI-built from `f304688` | | `flex-auth-tenant-engine` *(previous)* | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | seven-action policy, FLEX-WP-0013 restore; guardrail actions deny `unknown_action` | | `flex-auth-tenant-engine` *(rollback)* | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | four-action policy; lifecycle actions deny `unknown_action` | | `flex-auth-user-engine` | `sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b` | **live** — caller-auth **enforce** (FLEX-WP-0015-T02), CI `main-3de72fe`, A2 probe 2026-08-19 | diff --git a/deploy/flex-auth-tenant-engine.yaml b/deploy/flex-auth-tenant-engine.yaml index 3b4fb8f..8b4cf5a 100644 --- a/deploy/flex-auth-tenant-engine.yaml +++ b/deploy/flex-auth-tenant-engine.yaml @@ -25,7 +25,7 @@ spec: - --policy - /opt/flex-auth/examples/tenant-engine/policy_package.md - --caller-auth-mode - - warn + - enforce - --caller-kubernetes-url - https://10.43.0.1 - --caller-binding diff --git a/docs/adr/0004-inbound-caller-authentication.md b/docs/adr/0004-inbound-caller-authentication.md index ae613a9..4f959b6 100644 --- a/docs/adr/0004-inbound-caller-authentication.md +++ b/docs/adr/0004-inbound-caller-authentication.md @@ -1,6 +1,6 @@ # ADR 0004 — authenticate and bind authorization callers -Status: accepted (source implemented; production promotion pending) +Status: accepted (both production pins enforce as of 2026-08-19) Date: 2026-08-18 diff --git a/docs/tenancy-posture-review.md b/docs/tenancy-posture-review.md index 6595b6c..58a11f0 100644 --- a/docs/tenancy-posture-review.md +++ b/docs/tenancy-posture-review.md @@ -271,7 +271,7 @@ volunteer. | Task | | |---|---| | T01 | Publish the posture vector and this review; reply to `rapp-postgres` | -| T02 | **Close the A0**: user-engine live enforce + A2 probe 2026-08-19; tenant-engine pin still unauthenticated | +| T02 | **Close the A0**: both pins live enforce + unbound-request 401 (2026-08-19) | | T03 | Deleted the unused tenant-engine live-roles adapter | | T04 | AuthZEN endpoint — `wait`, with a written trigger | | T05 | `make verify-posture` guards declaration/source/deployment drift | diff --git a/railiance/README.md b/railiance/README.md index 490b2d1..6f38fc5 100644 --- a/railiance/README.md +++ b/railiance/README.md @@ -102,8 +102,8 @@ or re-apply the last-known-good digest in `deploy/README.md`. | Deployment | Last-known-good digest | Policy state | | --- | --- | --- | -| `flex-auth-tenant-engine` | `sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b` | **pin, not live** — caller-auth warn (FLEX-WP-0015-T02), CI `main-3de72fe` | -| `flex-auth-tenant-engine` *(live until warn promote)* | `sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc` | nine-action policy (FLEX-WP-0014), CI-built from `f304688` | +| `flex-auth-tenant-engine` | `sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b` | **live** — caller-auth enforce (FLEX-WP-0015-T02), CI `main-3de72fe`, A2 probe 2026-08-19 | +| `flex-auth-tenant-engine` *(previous)* | `sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc` | nine-action policy (FLEX-WP-0014), CI-built from `f304688` | | `flex-auth-tenant-engine` *(previous)* | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | seven-action policy, FLEX-WP-0013 restore | | `flex-auth-tenant-engine` *(rollback)* | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | four-action policy; lifecycle actions deny `unknown_action` | | `flex-auth-user-engine` | `sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b` | **live** — caller-auth enforce (FLEX-WP-0015-T02), CI `main-3de72fe`, A2 probe 2026-08-19 | diff --git a/tenancy.yaml b/tenancy.yaml index a065b8b..3fdb02e 100644 --- a/tenancy.yaml +++ b/tenancy.yaml @@ -11,7 +11,7 @@ role: policy-decision-point tenancy: current: I: 1 - A: 0 + A: 2 E: 1 P: "n/a" R: "n/a" @@ -39,12 +39,11 @@ tenancy: decision point judges asserted claims, it cannot be the verifier of its own inputs. Not a defect and not a target for movement. A: >- - flex-auth-user-engine is live A2 as of 2026-08-19: digest - sha256:138aa347…, callerAuth.mode=enforce, unbound request returns - 401 and a cross-system token is 403. flex-auth-tenant-engine still - runs sha256:1bf060e6… with no caller authentication, so the service - declaration stays current A0 until that pin is warn-then-enforce. - Source and overlay implement A2 on both consumers. + Both production pins are live A2 as of 2026-08-19 on digest + sha256:138aa347… with callerAuth.mode=enforce. Unbound requests + return 401; a token bound to the other protected system returns 403. + user-engine probe from user-engine-8569d7cb87-fp7px; + tenant-engine probe from tenant-engine-6c6dcbddbb-4v26w. E: >- No tenant data at rest. Tenant scoping in decisions runs through one choke point (internal/decision/engine.go normalizeRequest and the diff --git a/tests/stage1.sh b/tests/stage1.sh index b1822e0..50af296 100755 --- a/tests/stage1.sh +++ b/tests/stage1.sh @@ -20,7 +20,8 @@ echo "$user_render" | grep -q tokenreviews || { echo "user-engine render omits T echo "$user_render" | grep -q flex-auth-reviewer || { echo "user-engine render omits reviewer projection" >&2; exit 1; } tenant_render="$(helm template flex-auth-tenant-engine charts/flex-auth -f values/tenant-engine.yaml --namespace flex-auth)" -echo "$tenant_render" | grep -A1 -- '--caller-auth-mode' | grep -q warn || { echo "tenant-engine first pin must be warn" >&2; exit 1; } +echo "$tenant_render" | grep -A1 -- '--caller-auth-mode' | grep -Eq 'warn|enforce' \ + || { echo "tenant-engine caller-auth-mode must be warn or enforce" >&2; exit 1; } echo "$tenant_render" | grep -q 'tenant-engine=system:serviceaccount:tenant-engine:tenant-engine' \ || { echo "tenant-engine render omits its exact binding" >&2; exit 1; } diff --git a/values/tenant-engine.yaml b/values/tenant-engine.yaml index a8ecb45..3715574 100644 --- a/values/tenant-engine.yaml +++ b/values/tenant-engine.yaml @@ -1,6 +1,6 @@ # Production pin for the tenant-engine policy service. Independently rollable. -# Warn is safe whether or not the live tenant-engine client already sends a -# token. Do not flip this pin to enforce until its warn logs are clean. +# Caller-auth pin. Warn logs on 2026-08-19 were clean for the tenant-engine +# projected token after image sha256:7dc9d7bf… started sending it. name: flex-auth-tenant-engine image: repository: forgejo.coulomb.social/coulomb/flex-auth @@ -14,7 +14,7 @@ args: - --policy - /opt/flex-auth/examples/tenant-engine/policy_package.md callerAuth: - mode: warn + mode: enforce kubernetesURL: https://10.43.0.1 binding: tenant-engine=system:serviceaccount:tenant-engine:tenant-engine consumer: diff --git a/workplans/FLEX-WP-0015-tenancy-posture-conformance.md b/workplans/FLEX-WP-0015-tenancy-posture-conformance.md index ed4ebe7..d6c5618 100644 --- a/workplans/FLEX-WP-0015-tenancy-posture-conformance.md +++ b/workplans/FLEX-WP-0015-tenancy-posture-conformance.md @@ -4,7 +4,7 @@ type: workplan title: "Tenancy posture declaration and inbound caller authentication" domain: infotech repo: flex-auth -status: active +status: finished owner: claude topic_slug: netkingdom planning_priority: P1 @@ -67,7 +67,7 @@ corrections. Done 2026-08-17. ```task id: FLEX-WP-0015-T02 -status: progress +status: done priority: high state_hub_task_id: "b2e87a81-b63d-4be4-ad44-01426b7e6f74" ``` @@ -164,14 +164,23 @@ would delay user-engine A2 evidence for no safety gain. Sequence: was `0440 root:root` and uid 10001 could not send it — persist that in rapp-user-engine `manifests/runtime.yaml`. 5. Flip tenant-engine to enforce only after its warn logs are clean. + **Done 2026-08-19.** Live tenant-engine image `sha256:44ca65f3…` did not + send Authorization; source had the client uncommitted. Committed as + tenant-engine `2063470`, CI image `sha256:7dc9d7bf…`, then patched the + live Deployment with ServiceAccount `tenant-engine`, projected token, + `TENANT_ENGINE_FLEX_AUTH_TOKEN_FILE`, and `runAsUser/runAsGroup/fsGroup + 10001`. flex-auth-tenant-engine Helm rev 2 is enforce on + `sha256:138aa347…`. Probe from `tenant-engine-6c6dcbddbb-4v26w`: + (1) Bearer → 200 `decision:ef18e8bbd2dead6a`; + (2) no Authorization → **401** `unauthenticated`; + (3) `resource.system=user-engine` → **403** `forbidden`. 6. Only then may `policy.enabled` flip anywhere — `ops-warden` names that - the real deadline, and it is the same gate as FLEX-WP-0007. + the real deadline, and it is the same gate as FLEX-WP-0007. Not done + here; FLEX-WP-0007 remains that gate. -**Operator gate.** Default `KUBECONFIG` pointed at HostEurope and is -Unauthorized. railiance01 is `~/.kube/config-railiance01`. user-engine -warn→enforce used that kubeconfig. tenant-engine warn-then-enforce is -the remaining operator step. Promotion follows FLEX-WP-0011 and the CI -image, not a hand-built image. +**Operator note.** railiance01 kubeconfig is +`~/.kube/config-railiance01`. Both production pins are Helm-managed +(`flex-auth-user-engine` rev 4, `flex-auth-tenant-engine` rev 2). `RISK-F-0001` (risk-nexus) tracks this A0 externally. Their NetworkPolicy question was answered 2026-08-18: both Deployments carry an ingress policy @@ -208,7 +217,7 @@ live-role policy must introduce the dependency explicitly. ```task id: FLEX-WP-0015-T04 -status: wait +status: cancel priority: low state_hub_task_id: "06432560-c28c-4de2-a672-87e74be54a6a" ``` @@ -221,6 +230,11 @@ beside `/v1/check`, non-breaking. control, or a delegated backend under FLEX-WP-0004 needs uniform addressing. Until one of those, A4 buys swappability nobody can use. +Cancelled 2026-08-19 so this workplan can finish. The workplan's own scope +says it does not adopt AuthZEN. The trigger above still holds: file a new +workplan when a PEP we do not control, or a FLEX-WP-0004 backend, needs +`POST /access/v1/evaluation`. + Note when starting: AuthZEN standardises the envelope, not the action vocabulary — it does not end action-string copying between repos. The cheaper fix for that is serving `registry.Actions` read-only, which is independent of