From 79582870c03be4e235d84643b730268aee381f62 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 16 Aug 2026 09:57:07 +0200 Subject: [PATCH] Pin flex-auth-tenant-engine to the nine-action policy image CI digest sha256:1bf060e6 (main-f304688) is live. Seven pre-existing actions still allow; guardrail.read/set match the FLEX-WP-0014 split. user-engine pin unchanged. Rollback target is sha256:9320df39. --- deploy/README.md | 3 ++- deploy/flex-auth-tenant-engine.yaml | 2 +- examples/tenant-engine/README.md | 22 ++++++++++++++---- railiance/README.md | 3 ++- railiance/app.toml | 2 +- values/tenant-engine.yaml | 2 +- ...WP-0014-tenant-guardrail-policy-actions.md | 23 +++++++++++++++++++ 7 files changed, 47 insertions(+), 10 deletions(-) diff --git a/deploy/README.md b/deploy/README.md index 4b03bb3..63039d1 100644 --- a/deploy/README.md +++ b/deploy/README.md @@ -86,7 +86,8 @@ last-known-good digest below. | Deployment | Last-known-good digest | Policy state | | --- | --- | --- | -| `flex-auth-tenant-engine` | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | **live 2026-08-16** — seven-action policy restored (FLEX-WP-0013); CI-built from `e9911eb` | +| `flex-auth-tenant-engine` | `sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc` | **live** — nine-action policy (FLEX-WP-0014), CI-built from `f304688` | +| `flex-auth-tenant-engine` *(previous)* | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | seven-action policy, FLEX-WP-0013 restore; guardrail actions deny `unknown_action` | | `flex-auth-tenant-engine` *(rollback)* | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | four-action policy; lifecycle actions deny `unknown_action` | | `flex-auth-user-engine` | `sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4` | **current** — FLEX-WP-0009-T04, nine fixtures (incl. registration-applicant) verified live 2026-08-16 | | `flex-auth-user-engine` *(previous)* | `sha256:a31961c45215aa6baf3bc748c6741ab703c2c8325e61aa7983a355026195e51b` | FLEX-WP-0009-T03, six fixtures verified live 2026-08-10 | diff --git a/deploy/flex-auth-tenant-engine.yaml b/deploy/flex-auth-tenant-engine.yaml index de25e54..c1104f6 100644 --- a/deploy/flex-auth-tenant-engine.yaml +++ b/deploy/flex-auth-tenant-engine.yaml @@ -23,7 +23,7 @@ spec: - /opt/flex-auth/examples/tenant-engine/registry_snapshot.json - --policy - /opt/flex-auth/examples/tenant-engine/policy_package.md - image: forgejo.coulomb.social/coulomb/flex-auth@sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7 + image: forgejo.coulomb.social/coulomb/flex-auth@sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc livenessProbe: httpGet: path: /healthz diff --git a/examples/tenant-engine/README.md b/examples/tenant-engine/README.md index 7616d73..147a4e2 100644 --- a/examples/tenant-engine/README.md +++ b/examples/tenant-engine/README.md @@ -110,11 +110,23 @@ unmodified `FlexAuthWriteAuthorizer`: | `PUT ...` actor=`flex-auth` | 403 `write_denied` | deny `action_not_granted` | | `PUT ...` actor=`ops` | 403 `write_denied` | deny `unknown_subject` | -**In source, not yet in the production image.** The live -`flex-auth-tenant-engine` Deployment still serves the seven-action -`sha256:9320df39` pin. A CI-built image from this commit plus a pin -restore is the remaining step before a live guardrail check succeeds -against the cluster Service. +**In production as of 2026-08-16.** The live `flex-auth-tenant-engine` +Deployment on railiance01 runs +`sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc` +(CI-built from `f304688`, tag `main-f304688`). Probed against the Service +after pin: + +| Request | Effect | Decision | +| --- | --- | --- | +| `tenant.create` | allow `write_api_policy_matched` | `decision:ef18e8bbd2dead6a` | +| `tenant.retire` | allow `write_api_policy_matched` | `decision:996663f6902d0762` | +| `tenant.guardrail.read` as flex-auth | allow `write_api_policy_matched` | `decision:9b9e540de13cf7cf` | +| `tenant.guardrail.set` as tenant-engine | allow `write_api_policy_matched` | `decision:20c82bc38501a343` | +| `tenant.guardrail.set` as flex-auth | deny `action_not_granted` | `decision:a057a7030df65208` | +| misspelled guardrail | deny `unknown_action` | `decision:18ae70a79c6d47c6` | + +Rollback target is `sha256:9320df39` (seven-action). `flex-auth-user-engine` +was not moved. ## Related diff --git a/railiance/README.md b/railiance/README.md index 66c075b..5663694 100644 --- a/railiance/README.md +++ b/railiance/README.md @@ -76,7 +76,8 @@ or re-apply the last-known-good digest in `deploy/README.md`. | Deployment | Last-known-good digest | Policy state | | --- | --- | --- | -| `flex-auth-tenant-engine` | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | **live 2026-08-16** — seven-action policy restored (FLEX-WP-0013) | +| `flex-auth-tenant-engine` | `sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc` | **live** — nine-action policy (FLEX-WP-0014), CI-built from `f304688` | +| `flex-auth-tenant-engine` *(previous)* | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | seven-action policy, FLEX-WP-0013 restore | | `flex-auth-tenant-engine` *(rollback)* | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | four-action policy; lifecycle actions deny `unknown_action` | | `flex-auth-user-engine` | `sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4` | FLEX-WP-0009-T04, nine fixtures, live 2026-08-16 | | `flex-auth-user-engine` *(previous)* | `sha256:a31961c45215aa6baf3bc748c6741ab703c2c8325e61aa7983a355026195e51b` | FLEX-WP-0009-T03, six fixtures | diff --git a/railiance/app.toml b/railiance/app.toml index 8c64099..3ab09fb 100644 --- a/railiance/app.toml +++ b/railiance/app.toml @@ -93,7 +93,7 @@ checks = ["stage2-accepted", "rollback-target", "operator-approval"] evidence = ["promotion command id", "recorded previous_stable digests", "post-promotion canary /healthz 200"] requires_approval = true promotion_mode = "release-replace" -previous_stable = "flex-auth-user-engine@sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4;flex-auth-tenant-engine@sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa" +previous_stable = "flex-auth-user-engine@sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4;flex-auth-tenant-engine@sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7" [[checks]] id = "unit-tests" diff --git a/values/tenant-engine.yaml b/values/tenant-engine.yaml index 2ec86e6..5ecac8d 100644 --- a/values/tenant-engine.yaml +++ b/values/tenant-engine.yaml @@ -2,7 +2,7 @@ name: flex-auth-tenant-engine image: repository: forgejo.coulomb.social/coulomb/flex-auth - digest: sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7 + digest: sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc args: - serve - --addr diff --git a/workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md b/workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md index 3975f8c..6e4ab2d 100644 --- a/workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md +++ b/workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md @@ -187,3 +187,26 @@ this commit plus a pin of `flex-auth-tenant-engine` is the remaining step before a live guardrail check succeeds against the cluster Service. tenant-engine's own TEN-WP-0006 surface is also not deployed, so the cluster path is not yet the binding one. + +Deployed 2026-08-16 after operator "sync and commit / deploy flex-auth": +CI image `main-f304688` / +`sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc` +is live on `flex-auth-tenant-engine`. Approval +`8d1efcea-93c7-436b-a749-e5d464e94a33`. Rollback target remains +`sha256:9320df39`. `flex-auth-user-engine` stayed on `sha256:1f529037`. + +Live `/v1/check` against the Service: + +| Request | Effect | Decision | +| --- | --- | --- | +| `tenant.create` | allow `write_api_policy_matched` | `decision:ef18e8bbd2dead6a` | +| `tenant.retire` | allow `write_api_policy_matched` | `decision:996663f6902d0762` | +| `tenant.guardrail.read` as flex-auth | allow `write_api_policy_matched` | `decision:9b9e540de13cf7cf` | +| `tenant.guardrail.set` as tenant-engine | allow `write_api_policy_matched` | `decision:20c82bc38501a343` | +| `tenant.guardrail.set` as flex-auth | deny `action_not_granted` | `decision:a057a7030df65208` | +| misspelled guardrail | deny `unknown_action` | `decision:18ae70a79c6d47c6` | +| unknown subject | deny `unknown_subject` | `decision:a98c59c6a34f84ad` | +| misspelled lifecycle | deny `unknown_action` | `decision:1b3012abb4e2b27d` | + +TEN-WP-0007 can pin the tenant-engine guardrail image. The seven +pre-existing actions still allow.