coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(authz): bind decisions to exact actions
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 37s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81
This commit is contained in:
tegwick 2026-08-23 13:18:26 +02:00
parent 7323dd1a60
commit c473f1971d
28 changed files with 644 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

19
deploy/README.md
View file

@ -22,17 +22,20 @@ Manifests for the two cluster-local flex-auth policy-decision services.
Each file is a three-document manifest: `Deployment`, `Service`, and a
default-deny `NetworkPolicy` whose ingress is restricted to the one approved
consumer workload and which permits no egress.
consumer workload. Pins with caller authentication enabled permit TCP egress
to ports 443 and 6443 so TokenReview can reach the Kubernetes API; the rules
have no destination selector, so they permit those ports to any destination.
Pins without caller authentication permit no egress.
### A harmless diff on apply
`kubectl apply` reports the two NetworkPolicies as `configured` rather than
`unchanged`, every time. That is not drift: the manifests carry an explicit
`egress: []`, which the API server normalises away on read. With
`policyTypes: [Ingress, Egress]` and no egress rules, deny-all egress holds
either way. The empty list is kept because it states the intent to a reader
instead of leaving it implicit. Deployments and Services do round-trip as
`unchanged`.
For a pin with caller authentication disabled, `kubectl apply` may report its
NetworkPolicy as `configured` rather than `unchanged`. That is not drift: the
manifest carries an explicit `egress: []`, which the API server normalises
away on read. With `policyTypes: [Ingress, Egress]` and no egress rules,
deny-all egress holds either way. Caller-authenticated pins instead render the
443/6443 egress rule described above. Deployments and Services otherwise
round-trip as `unchanged`.
## One image, two deployments