4c3c528644
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81
42 lines
1.1 KiB
Markdown
42 lines
1.1 KiB
Markdown
---
|
|
id: FLEX-WP-0018
|
|
type: workplan
|
|
title: "Inbound caller-auth and deployment documentation corrections"
|
|
domain: infotech
|
|
repo: flex-auth
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: netkingdom
|
|
planning_priority: P2
|
|
planning_order: 118
|
|
created: "2026-08-23"
|
|
updated: "2026-08-23"
|
|
state_hub_workstream_id: "8f301c7c-e3e2-5bd0-a6f2-0cb92c1d782f"
|
|
---
|
|
|
|
## Classify rejected TokenReview credentials as unauthenticated
|
|
|
|
```task
|
|
id: FLEX-WP-0018-T01
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "4a85c91f-6f34-5224-99b0-23b8eaa3bf7b"
|
|
```
|
|
|
|
Treat a successful TokenReview response that rejects a bearer token as an
|
|
authentication failure (HTTP 401), while retaining HTTP 503 for transport,
|
|
HTTP, and response-decode failures. Regression coverage exercises the reviewer
|
|
and authenticator seam.
|
|
|
|
## Correct NetworkPolicy egress documentation
|
|
|
|
```task
|
|
id: FLEX-WP-0018-T02
|
|
status: done
|
|
priority: low
|
|
state_hub_task_id: "5613aeb1-ad09-50e5-9933-ced39593dc54"
|
|
```
|
|
|
|
Document that caller-authenticated pins permit TCP 443 and 6443 without a
|
|
destination selector for Kubernetes TokenReview, while pins without caller
|
|
authentication retain deny-all egress.
|