coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Enforce caller-auth on flex-auth-user-engine and record the live A2 probe
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Helm-adopted the kubectl-managed user-engine pin, promoted sha256:138aa347
warn then enforce. Reviewer volume needs fsGroup 65532; reviewer tokens
must use the API default audiences or TokenReview 401s on this k3s.
Live probe from user-engine-8569d7cb87-fp7px: 200 / 401 / 403. tenant-engine
is unchanged. tenancy.current.A stays 0 until that pin moves.
This commit is contained in:
tegwick 2026-08-19 14:00:53 +02:00
parent ebde4ecba6
commit b2431e3cad
12 changed files with 60 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

27
workplans/FLEX-WP-0015-tenancy-posture-conformance.md
View file

@ -67,7 +67,7 @@ corrections. Done 2026-08-17.
```task
id: FLEX-WP-0015-T02
status: wait
status: progress
priority: high
state_hub_task_id: "b2e87a81-b63d-4be4-ad44-01426b7e6f74"
```
@ -134,6 +134,13 @@ would delay user-engine A2 evidence for no safety gain. Sequence:
flex-auth-<consumer> charts/flex-auth --namespace flex-auth -f
values/<consumer>.yaml`. Isolated canary may boot the same digest with
caller-auth disabled. Do not `kubectl apply` an enforce manifest.
**user-engine done 2026-08-19** (Helm release `flex-auth-user-engine`
rev 4). Live objects were kubectl-managed; they were labelled for Helm
adoption first. Two production bugs had to be fixed during warn: the
reviewer volume needed `fsGroup: 65532`, and the reviewer token must
use the API server's default audiences (a custom
`https://kubernetes.default.svc` audience 401s TokenReview on this
k3s). tenant-engine is still the old digest.
3. Confirm warn logs per consumer. `user-engine` is migrated and deployed
as of 2026-08-18 (image `sha256:c501aeb2…`, token at
`/var/run/secrets/flex-auth-caller/token`). On 2026-08-19 they confirmed
@ -148,15 +155,23 @@ would delay user-engine A2 evidence for no safety gain. Sequence:
written in user-engine `docs/flex-auth-caller-identity.md`; they must
not run against warn, because "no token returns 401" would still be a
decision.
**Done 2026-08-19** from pod `user-engine-8569d7cb87-fp7px`:
(1) Bearer projected token → 200 `decision:350b46fb42989606`;
(2) no Authorization → **401** `unauthenticated`;
(3) `resource.system=tenant-engine` → **403** `forbidden`.
Digests: flex-auth `sha256:138aa347…`, user-engine `sha256:c501aeb2…`.
Live user-engine also needed `fsGroup: 10001` or the projected token
was `0440 root:root` and uid 10001 could not send it — persist that
in rapp-user-engine `manifests/runtime.yaml`.
5. Flip tenant-engine to enforce only after its warn logs are clean.
6. Only then may `policy.enabled` flip anywhere — `ops-warden` names that
the real deadline, and it is the same gate as FLEX-WP-0007.
**Operator gate.** Steps 2–5 need cluster credentials this session does not
have: `kubectl` returns `Unauthorized` and the context is `default`, which
`tenant-engine` documented on 2026-08-16 as indistinguishable from a
wrong-cluster KUBECONFIG. Promotion follows FLEX-WP-0011 and the CI image,
not a hand-built image.
**Operator gate.** Default `KUBECONFIG` pointed at HostEurope and is
Unauthorized. railiance01 is `~/.kube/config-railiance01`. user-engine
warn→enforce used that kubeconfig. tenant-engine warn-then-enforce is
the remaining operator step. Promotion follows FLEX-WP-0011 and the CI
image, not a hand-built image.
`RISK-F-0001` (risk-nexus) tracks this A0 externally. Their NetworkPolicy
question was answered 2026-08-18: both Deployments carry an ingress policy