coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Pin caller-auth digest in warn on independently rollable overlay pins
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
The sanctioned Helm chart could not promote ADR 0004 at all, and the
emergency manifests selected enforce. That made a FLEX-WP-0011 apply
either a no-op or a global 401. First production pin is now warn, per
consumer, on CI digest sha256:138aa347… . Enforce stays a later
per-consumer flip so USER-WP-0023-T03 can close without waiting on
tenant-engine.
This commit is contained in:
tegwick 2026-08-19 12:31:08 +02:00
parent 3de72fe6f5
commit fa278674c1
22 changed files with 268 additions and 55 deletions
Download patch file Download diff file Expand all files Collapse all files

32
railiance/README.md
View file

@ -45,6 +45,32 @@ $RAILIANCE rollback . --apply --approval-id <state-hub-id> --revision <helm-rev>
The canary Service is `flex-auth-canary.flex-auth.svc.cluster.local:8080`.
Production consumers keep calling their own Service names.
## Caller-auth promotion (FLEX-WP-0015-T02)
The two production pins are independently rollable. Do not flip both to
`enforce` in one apply. The first pin of digest
`sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b`
is **warn** on each consumer.
```bash
# Warn pin (safe if a caller still sends no token)
helm upgrade --install flex-auth-user-engine charts/flex-auth \
--namespace flex-auth -f values/user-engine.yaml --wait --timeout 2m
helm upgrade --install flex-auth-tenant-engine charts/flex-auth \
--namespace flex-auth -f values/tenant-engine.yaml --wait --timeout 2m
# Confirm warn logs: "caller authentication warning:" must be absent for a
# migrated caller. user-engine is migrated; tenant-engine live status is
# unconfirmed. Isolated canary keeps callerAuth.mode=disabled.
# Then set values/user-engine.yaml callerAuth.mode: enforce and upgrade only
# that release. USER-WP-0023-T03 runs only after that flip. tenant-engine
# stays warn until its logs are clean.
```
Emergency kubectl path is also warn. Applying it in enforce is the hazard
the warn pin exists to prevent.
## Rolling a production pin
Policy is baked into the image. Do not build images on a workstation.
@ -76,8 +102,10 @@ or re-apply the last-known-good digest in `deploy/README.md`.
| Deployment | Last-known-good digest | Policy state |
| --- | --- | --- |
| `flex-auth-tenant-engine` | `sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc` | **live** — nine-action policy (FLEX-WP-0014), CI-built from `f304688` |
| `flex-auth-tenant-engine` | `sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b` | **pin, not live** — caller-auth warn (FLEX-WP-0015-T02), CI `main-3de72fe` |
| `flex-auth-tenant-engine` *(live until warn promote)* | `sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc` | nine-action policy (FLEX-WP-0014), CI-built from `f304688` |
| `flex-auth-tenant-engine` *(previous)* | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | seven-action policy, FLEX-WP-0013 restore |
| `flex-auth-tenant-engine` *(rollback)* | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | four-action policy; lifecycle actions deny `unknown_action` |
| `flex-auth-user-engine` | `sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4` | FLEX-WP-0009-T04, nine fixtures, live 2026-08-16 |
| `flex-auth-user-engine` | `sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b` | **pin, not live** — caller-auth warn (FLEX-WP-0015-T02), CI `main-3de72fe` |
| `flex-auth-user-engine` *(live until warn promote)* | `sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4` | FLEX-WP-0009-T04, nine fixtures, live 2026-08-16 |
| `flex-auth-user-engine` *(previous)* | `sha256:a31961c45215aa6baf3bc748c6741ab703c2c8325e61aa7983a355026195e51b` | FLEX-WP-0009-T03, six fixtures |