coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
A policy-as-code capable authorization registry/control-plane service.
107 commits 1 branch 0 tags 1.3 MiB
Find a file
tegwick 2456287e8c Commit production deployment manifests and rollout runbook 
The two flex-auth Deployments were applied from a YAML file that lived
outside this repo, so the only surviving copy of their authored spec was
the last-applied-configuration annotation on the live objects. That made
rollback depend on a cluster annotation -- recovered them into deploy/
before the FLEX-WP-0010 rollout rather than after an incident.

Covers Deployment, Service, and the default-deny NetworkPolicy for both
flex-auth-tenant-engine and flex-auth-user-engine. Verified with
kubectl apply --dry-run=server: Deployments and Services round-trip as
unchanged. The NetworkPolicies report "configured" because the manifests
keep an explicit egress: [] that the API server normalises away -- same
deny-all semantics, documented so nobody chases it.

The runbook records that policy packages are baked into the image with no
hot reload, that both Deployments share one image repo at deliberately
different digests (so roll only the one whose policy changed), and pins
both last-known-good digests as rollback targets.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 02:21:06 +02:00
.claude/rules docs: workplan-first agent guidance prose (CUST-WP-0055 T04 batch 2) 2026-07-08 16:41:17 +02:00
.forgejo/workflows Add Forgejo CI smoke workflow (enablement template) 2026-07-08 12:32:37 +02:00
.github/workflows Land foundations: assessment, ADR-001/002/003, FLEX-WP-0005, Go skeleton 2026-05-16 01:54:44 +02:00
cmd/flex-auth FLEX-WP-0007: production registry fixture, tests, and sync runbook 2026-06-24 14:52:35 +02:00
deploy Commit production deployment manifests and rollout runbook 2026-08-11 02:21:06 +02:00
docs Authorize tenant-engine lifecycle actions (FLEX-WP-0010) 2026-08-10 20:52:10 +02:00
examples Record production gap for FLEX-WP-0010 and re-probe FLEX-WP-0009 2026-08-10 20:55:41 +02:00
internal FLEX-WP-0008 T03-T04: tenant-engine live-lookup context adapter, close 2026-07-23 23:33:34 +02:00
pkg/api FLEX-WP-0006: implement ops-warden signing gate policy 2026-06-23 21:17:42 +02:00
registry Add capability registry with seed entry from reuse-surface 2026-06-16 01:46:54 +02:00
schemas FLEX-WP-0006: implement ops-warden signing gate policy 2026-06-23 21:17:42 +02:00
workplans Record production gap for FLEX-WP-0010 and re-probe FLEX-WP-0009 2026-08-10 20:55:41 +02:00
.custodian-brief.md chore(consistency): sync task status from DB [auto] 2026-08-10 20:56:06 +02:00
.gitignore Land foundations: assessment, ADR-001/002/003, FLEX-WP-0005, Go skeleton 2026-05-16 01:54:44 +02:00
.golangci.yml Land foundations: assessment, ADR-001/002/003, FLEX-WP-0005, Go skeleton 2026-05-16 01:54:44 +02:00
.repo-classification.yaml Human-review .repo-classification.yaml (CUST-WP-0050 follow-up) 2026-06-22 17:56:17 +02:00
AGENTS.md Regenerate agent instructions from state-hub templates (CUST-WP-0055 T01) 2026-07-08 14:50:24 +02:00
CLAUDE.md Add credential routing instructions for all agent runtimes 2026-06-18 22:48:37 +02:00
Containerfile Package flex-auth policy service 2026-08-09 01:35:30 +02:00
go.mod Implement policy package loader 2026-05-17 05:30:40 +02:00
go.sum Implement policy package loader 2026-05-17 05:30:40 +02:00
INTENT.md docs(intent/scope): align with ops-warden as first shipped consumer 2026-06-27 20:37:07 +02:00
LICENSE Adopt Target Revenue Source License V1C1 (org-wide preliminary rollout) 2026-07-30 00:16:31 +02:00
Makefile Pin FlexAuthResourceManifest schema (resource-registration-v0) 2026-05-16 02:04:00 +02:00
README.md Refine workplans for CARING profile 2026-05-17 04:15:38 +02:00
SCOPE.md docs(scope): reflect baseline complete — all FLEX-WP-0001..0007 done 2026-06-30 01:40:19 +02:00
WORK-RECORDS.md Authorize tenant-engine lifecycle actions (FLEX-WP-0010) 2026-08-10 20:52:10 +02:00

README.md

flex-auth

Policy-as-code authorization registry and control plane for NetKingdom-aligned systems.

Start with INTENT.md for the project boundary and direction. Research notes and ADRs live in docs/ and docs/adr/.

The product boundary is captured in SCOPE.md, and the current Product Requirements Document is docs/ProductRequirementsDocument.md.

The 2026-05-15 pre-implementation assessment that shapes the current sequencing is in docs/pre-implementation-assessment.md.

The CARING reference-implementation approach is captured in docs/caring-architecture-blueprint.md.

Workplans live in workplans/, with sequencing captured in docs/workplan-planning-map.md.