coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish FLEX-WP-0015: both pins enforce, live A2 probes, AuthZEN deferred
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
flex-auth-tenant-engine Helm rev 2 is enforce on sha256:138aa347 after
tenant-engine 2063470 started sending a projected caller token
(sha256:7dc9d7bf). Probe 200/401/403. tenancy.current.A is 2. T04
cancelled: AuthZEN waits for a PEP we do not control.
This commit is contained in:
tegwick 2026-08-19 14:35:27 +02:00
parent 9514522b77
commit 6d85f95c8b
9 changed files with 41 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

32
workplans/FLEX-WP-0015-tenancy-posture-conformance.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Tenancy posture declaration and inbound caller authentication"
domain: infotech
repo: flex-auth
status: active
status: finished
owner: claude
topic_slug: netkingdom
planning_priority: P1
@ -67,7 +67,7 @@ corrections. Done 2026-08-17.
```task
id: FLEX-WP-0015-T02
status: progress
status: done
priority: high
state_hub_task_id: "b2e87a81-b63d-4be4-ad44-01426b7e6f74"
```
@ -164,14 +164,23 @@ would delay user-engine A2 evidence for no safety gain. Sequence:
was `0440 root:root` and uid 10001 could not send it — persist that
in rapp-user-engine `manifests/runtime.yaml`.
5. Flip tenant-engine to enforce only after its warn logs are clean.
**Done 2026-08-19.** Live tenant-engine image `sha256:44ca65f3…` did not
send Authorization; source had the client uncommitted. Committed as
tenant-engine `2063470`, CI image `sha256:7dc9d7bf…`, then patched the
live Deployment with ServiceAccount `tenant-engine`, projected token,
`TENANT_ENGINE_FLEX_AUTH_TOKEN_FILE`, and `runAsUser/runAsGroup/fsGroup
10001`. flex-auth-tenant-engine Helm rev 2 is enforce on
`sha256:138aa347…`. Probe from `tenant-engine-6c6dcbddbb-4v26w`:
(1) Bearer → 200 `decision:ef18e8bbd2dead6a`;
(2) no Authorization → **401** `unauthenticated`;
(3) `resource.system=user-engine` → **403** `forbidden`.
6. Only then may `policy.enabled` flip anywhere — `ops-warden` names that
the real deadline, and it is the same gate as FLEX-WP-0007.
the real deadline, and it is the same gate as FLEX-WP-0007. Not done
here; FLEX-WP-0007 remains that gate.
**Operator gate.** Default `KUBECONFIG` pointed at HostEurope and is
Unauthorized. railiance01 is `~/.kube/config-railiance01`. user-engine
warn→enforce used that kubeconfig. tenant-engine warn-then-enforce is
the remaining operator step. Promotion follows FLEX-WP-0011 and the CI
image, not a hand-built image.
**Operator note.** railiance01 kubeconfig is
`~/.kube/config-railiance01`. Both production pins are Helm-managed
(`flex-auth-user-engine` rev 4, `flex-auth-tenant-engine` rev 2).
`RISK-F-0001` (risk-nexus) tracks this A0 externally. Their NetworkPolicy
question was answered 2026-08-18: both Deployments carry an ingress policy
@ -208,7 +217,7 @@ live-role policy must introduce the dependency explicitly.
```task
id: FLEX-WP-0015-T04
status: wait
status: cancel
priority: low
state_hub_task_id: "06432560-c28c-4de2-a672-87e74be54a6a"
```
@ -221,6 +230,11 @@ beside `/v1/check`, non-breaking.
control, or a delegated backend under FLEX-WP-0004 needs uniform addressing.
Until one of those, A4 buys swappability nobody can use.
Cancelled 2026-08-19 so this workplan can finish. The workplan's own scope
says it does not adopt AuthZEN. The trigger above still holds: file a new
workplan when a PEP we do not control, or a FLEX-WP-0004 backend, needs
`POST /access/v1/evaluation`.
Note when starting: AuthZEN standardises the envelope, not the action
vocabulary — it does not end action-string copying between repos. The cheaper
fix for that is serving `registry.Actions` read-only, which is independent of