From a96e970007e906844497434530f800086df6821d Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 6 Sep 2026 21:39:10 +0200 Subject: [PATCH] Pin deployed secrets-engine tenant policy v2 Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb --- railiance/README.md | 6 ++++++ values/secrets-engine.yaml | 4 ++-- ...-WP-0021-secrets-engine-consumer-policy-gate.md | 14 ++++++++++++++ 3 files changed, 22 insertions(+), 2 deletions(-) diff --git a/railiance/README.md b/railiance/README.md index 313d974..d0a417f 100644 --- a/railiance/README.md +++ b/railiance/README.md @@ -121,3 +121,9 @@ by immutable digest, caller-auth warn, and ingress restricted to namespace secrets-engine/pod label app.kubernetes.io/name=secrets-engine. Do not promote to enforce until the consumer identity is adopted and verified. See FLEX-WP-0021 for positive/negative policy and network evidence. + +The secrets-engine pin is now revision 2, CI main-d98323b, policy v2, image +sha256:db1c4f7e621c7ea119489a321d7db0e05da09afc17be5f69d873b2b3c7f60cfc. +Live wrong_tenant denial and all six published requests pass. Revision 1 lacked +tenant enforcement and is not a safe rollback target. Workstation caller +access remains an adoption gate; warn is not authenticated production adoption. diff --git a/values/secrets-engine.yaml b/values/secrets-engine.yaml index fae2e6f..a28dabb 100644 --- a/values/secrets-engine.yaml +++ b/values/secrets-engine.yaml @@ -1,8 +1,8 @@ -# Dedicated secrets-engine policy service; CI build main-dd3ce4c. +# Dedicated secrets-engine policy service; CI build main-d98323b. name: flex-auth-secrets-engine image: repository: forgejo.coulomb.social/coulomb/flex-auth - digest: sha256:89086c02c74a931068423e70937d03df7850fa0db9c63e70be56b3558f1756af + digest: sha256:db1c4f7e621c7ea119489a321d7db0e05da09afc17be5f69d873b2b3c7f60cfc args: - serve - --addr diff --git a/workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md b/workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md index abead43..897b61e 100644 --- a/workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md +++ b/workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md @@ -299,3 +299,17 @@ waiting on consumer configuration/adoption and the owner handoff. Approval service, KeyCape clients and real credential-lane activation are not supplied by this deployment. First-install rollback is removal of this dedicated Helm release, leaving the three existing consumers untouched. + +## v2 production correction applied — 2026-09-06 + +Glas applied the existing operator production authorization to correct the +reported v1 tenant fail-open. Helm revision 2 uses CI main-d98323b digest +sha256:db1c4f7e621c7ea119489a321d7db0e05da09afc17be5f69d873b2b3c7f60cfc. +Lint/server dry-run/rollout passed. Six published Check requests on the live +service returned expected two allows/four denies, including wrong_tenant; +all matched_policy_version values are v2. Other consumer Deployment specs +are unchanged. Values pin updated. Caller authentication remains warn; +workstation consumer access/adoption remains outstanding despite T05 closure. +Glas has sent a follow-up requesting an explicit live owner work record for +that gate. Do not roll back to known over-permissive v1; stop this dedicated +release if v2 cannot be served.