coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Pin caller-auth digest in warn on independently rollable overlay pins
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
The sanctioned Helm chart could not promote ADR 0004 at all, and the
emergency manifests selected enforce. That made a FLEX-WP-0011 apply
either a no-op or a global 401. First production pin is now warn, per
consumer, on CI digest sha256:138aa347… . Enforce stays a later
per-consumer flip so USER-WP-0023-T03 can close without waiting on
tenant-engine.
This commit is contained in:
tegwick 2026-08-19 12:31:08 +02:00
parent 3de72fe6f5
commit fa278674c1
22 changed files with 268 additions and 55 deletions
Download patch file Download diff file Expand all files Collapse all files

24
tools/verify-posture.sh
View file

@ -26,14 +26,36 @@ fail() {
exit 1
}
caller_mode_from_manifest() {
awk '
$0 ~ /--caller-auth-mode/ { getline; gsub(/^[[:space:]-]+/, ""); print; exit }
' "$1"
}
caller_mode_from_values() {
awk '
$1 == "callerAuth:" { in_block=1; next }
in_block && /^[^[:space:]#]/ { exit }
in_block && $1 == "mode:" { print $2; exit }
' "$1"
}
if grep -q 'authenticator.Authorize' "$main"; then
[[ "${declared_a:-0}" -ge 2 ]] || fail "caller authentication exists but current/implemented A is below 2"
for manifest in deploy/flex-auth-user-engine.yaml deploy/flex-auth-tenant-engine.yaml; do
grep -q -- '--caller-auth-mode' "$root/$manifest" || fail "$manifest omits caller auth mode"
grep -q 'enforce' "$root/$manifest" || fail "$manifest does not select enforce mode"
mode="$(caller_mode_from_manifest "$root/$manifest")"
[[ "$mode" == "warn" || "$mode" == "enforce" ]] || fail "$manifest caller-auth-mode is ${mode:-empty}, not warn or enforce"
grep -q -- '--caller-binding' "$root/$manifest" || fail "$manifest omits the exact system binding"
grep -q 'flex-auth-reviewer' "$root/$manifest" || fail "$manifest omits the reviewer token projection"
done
[[ -f "$root/deploy/caller-auth-rbac.yaml" ]] || fail "TokenReview RBAC manifest is absent"
grep -q 'tokenreviews' "$root/charts/flex-auth/templates/rbac.yaml" || fail "overlay TokenReview RBAC template is absent"
for values in values/user-engine.yaml values/tenant-engine.yaml; do
mode="$(caller_mode_from_values "$root/$values")"
[[ "$mode" == "warn" || "$mode" == "enforce" ]] || fail "$values callerAuth.mode is ${mode:-empty}, not warn or enforce"
grep -q 'binding:' "$root/$values" || fail "$values omits callerAuth.binding"
done
else
[[ "${declared_a:-0}" -lt 2 ]] || fail "A2 is declared without a caller-authentication choke point"
fi