coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Pin flex-auth-tenant-engine to the nine-action policy image
All checks were successful
CI Smoke / container-smoke (push) Successful in 1s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
Build and Publish Container Image / build-and-push (push) Successful in 35s
Details

Browse source 
CI digest sha256:1bf060e6 (main-f304688) is live. Seven pre-existing
actions still allow; guardrail.read/set match the FLEX-WP-0014 split.
user-engine pin unchanged. Rollback target is sha256:9320df39.
This commit is contained in:
tegwick 2026-08-16 09:57:07 +02:00
parent 0da6d3dee2
commit 79582870c0
7 changed files with 47 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

22
examples/tenant-engine/README.md
View file

@ -110,11 +110,23 @@ unmodified `FlexAuthWriteAuthorizer`:
| `PUT ...` actor=`flex-auth` | 403 `write_denied` | deny `action_not_granted` |
| `PUT ...` actor=`ops` | 403 `write_denied` | deny `unknown_subject` |
**In source, not yet in the production image.** The live
`flex-auth-tenant-engine` Deployment still serves the seven-action
`sha256:9320df39` pin. A CI-built image from this commit plus a pin
restore is the remaining step before a live guardrail check succeeds
against the cluster Service.
**In production as of 2026-08-16.** The live `flex-auth-tenant-engine`
Deployment on railiance01 runs
`sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc`
(CI-built from `f304688`, tag `main-f304688`). Probed against the Service
after pin:
| Request | Effect | Decision |
| --- | --- | --- |
| `tenant.create` | allow `write_api_policy_matched` | `decision:ef18e8bbd2dead6a` |
| `tenant.retire` | allow `write_api_policy_matched` | `decision:996663f6902d0762` |
| `tenant.guardrail.read` as flex-auth | allow `write_api_policy_matched` | `decision:9b9e540de13cf7cf` |
| `tenant.guardrail.set` as tenant-engine | allow `write_api_policy_matched` | `decision:20c82bc38501a343` |
| `tenant.guardrail.set` as flex-auth | deny `action_not_granted` | `decision:a057a7030df65208` |
| misspelled guardrail | deny `unknown_action` | `decision:18ae70a79c6d47c6` |
Rollback target is `sha256:9320df39` (seven-action). `flex-auth-user-engine`
was not moved.
## Related