coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Pin deployed secrets-engine tenant policy v2
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb
This commit is contained in:
tegwick 2026-09-06 21:39:10 +02:00
parent cc311056b9
commit a96e970007
3 changed files with 22 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
railiance/README.md
View file

@ -121,3 +121,9 @@ by immutable digest, caller-auth warn, and ingress restricted to namespace
secrets-engine/pod label app.kubernetes.io/name=secrets-engine. Do not promote secrets-engine/pod label app.kubernetes.io/name=secrets-engine. Do not promote
to enforce until the consumer identity is adopted and verified. See to enforce until the consumer identity is adopted and verified. See
FLEX-WP-0021 for positive/negative policy and network evidence. FLEX-WP-0021 for positive/negative policy and network evidence.
The secrets-engine pin is now revision 2, CI main-d98323b, policy v2, image
sha256:db1c4f7e621c7ea119489a321d7db0e05da09afc17be5f69d873b2b3c7f60cfc.
Live wrong_tenant denial and all six published requests pass. Revision 1 lacked
tenant enforcement and is not a safe rollback target. Workstation caller
access remains an adoption gate; warn is not authenticated production adoption.

4
values/secrets-engine.yaml
View file

@ -1,8 +1,8 @@
# Dedicated secrets-engine policy service; CI build main-dd3ce4c. # Dedicated secrets-engine policy service; CI build main-d98323b.
name: flex-auth-secrets-engine name: flex-auth-secrets-engine
image: image:
repository: forgejo.coulomb.social/coulomb/flex-auth repository: forgejo.coulomb.social/coulomb/flex-auth
digest: sha256:89086c02c74a931068423e70937d03df7850fa0db9c63e70be56b3558f1756af digest: sha256:db1c4f7e621c7ea119489a321d7db0e05da09afc17be5f69d873b2b3c7f60cfc
args: args:
- serve - serve
- --addr - --addr

14
workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md
View file

@ -299,3 +299,17 @@ waiting on consumer configuration/adoption and the owner handoff. Approval
service, KeyCape clients and real credential-lane activation are not supplied service, KeyCape clients and real credential-lane activation are not supplied
by this deployment. First-install rollback is removal of this dedicated Helm by this deployment. First-install rollback is removal of this dedicated Helm
release, leaving the three existing consumers untouched. release, leaving the three existing consumers untouched.
## v2 production correction applied — 2026-09-06
Glas applied the existing operator production authorization to correct the
reported v1 tenant fail-open. Helm revision 2 uses CI main-d98323b digest
sha256:db1c4f7e621c7ea119489a321d7db0e05da09afc17be5f69d873b2b3c7f60cfc.
Lint/server dry-run/rollout passed. Six published Check requests on the live
service returned expected two allows/four denies, including wrong_tenant;
all matched_policy_version values are v2. Other consumer Deployment specs
are unchanged. Values pin updated. Caller authentication remains warn;
workstation consumer access/adoption remains outstanding despite T05 closure.
Glas has sent a follow-up requesting an explicit live owner work record for
that gate. Do not roll back to known over-permissive v1; stop this dedicated
release if v2 cannot be served.