diff --git a/docs/batches/2026-10-03-provisioning-window/DEPLOY-v7.md b/docs/batches/2026-10-03-provisioning-window/DEPLOY-v7.md new file mode 100644 index 0000000..495374d --- /dev/null +++ b/docs/batches/2026-10-03-provisioning-window/DEPLOY-v7.md @@ -0,0 +1,49 @@ +# p01 admission rollout candidate — awaiting founder approval + +Authority required: ADMINISTER @ realm:kubernetes/railiance01, +activation=APPROVED, for the two changes below. No live rollout has run. + +1. Helm release `flex-auth-informed-decision-sitting`, namespace `flex-auth`: + update only its image to the CI build of access-engine commit `f946c7b`: + `sha256:f6fa2062f7095e66c7a91f20cd130914b5481d46d9d909339e028f7ecdf0065d`. + The v7 package admits p01's exact native approval pin and preserves existing + records. Actual published-image evaluation confirms the package digest + `sha256:2490955f175c52574543e210be06f468a01e56c778d38d4fdcad731875e37cc7`. +2. Create immutable ConfigMap `informed-decision-runtime-b800648bd80b` and + update Deployment `informed-decision` to reference it. Only the policy + version/digest change; its current application image, storage and resource + requests are retained. Recreate causes a brief review-service interruption. + +Preparation evidence: CI image and smoke checks succeeded; published-image +synthetic p01 read allowed; 795 candidate policy checks passed; both server +preflights passed in their explicit namespaces. Client diff for the policy +shows only the image change beyond apply bookkeeping; review diff shows only +its configuration reference and the new ConfigMap. Node requests: 3445m of +4000m CPU, enough for the policy's 5m surge. Recheck before live execution. +No ArgoCD application targeting these two namespaces was observed. + +Deploy through Helm on railiance01, with the access-engine chart and pinned +`values/informed-decision-sitting.yaml` copied to a temporary directory: + +```bash +export KUBECONFIG=/etc/rancher/k3s/k3s.yaml +helm upgrade --install flex-auth-informed-decision-sitting \ + /tmp/infd-p01-rollout/charts/flex-auth \ + -f /tmp/infd-p01-rollout/values/informed-decision-sitting.yaml \ + --namespace flex-auth --atomic --timeout 5m +kubectl -n flex-auth rollout status deployment/flex-auth-informed-decision-sitting --timeout=120s +``` + +Verify the served package before the review-service update. Then apply only +`review-rollout-v7.json` on the node, and wait for review health/readiness. +Update `deploy/sitting-admission.json` to the reviewed +`review-admission-v7.json` in the same session as the actual rollout. + +Recovery: Helm rollback to the pre-rollout revision if needed; restore the +review Deployment's old config reference +`informed-decision-runtime-5c11925287fa` if the config update fails. Retain the +old ConfigMap and private evidence volume. + +A5 (attach/load the memo) and A6 (fresh-MFA human answer) follow verified +rollout. These operations are not performed by publishing the CI image. The +approval expires 2026-10-04 17:08 UTC; no automatic approval recreation. diff --git a/docs/batches/2026-10-03-provisioning-window/policy-rollout-v7.yaml b/docs/batches/2026-10-03-provisioning-window/policy-rollout-v7.yaml new file mode 100644 index 0000000..f6c23cb --- /dev/null +++ b/docs/batches/2026-10-03-provisioning-window/policy-rollout-v7.yaml @@ -0,0 +1,186 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: flex-auth-informed-decision-sitting + labels: + app.kubernetes.io/name: flex-auth-informed-decision-sitting + app.kubernetes.io/instance: flex-auth-informed-decision-sitting + app.kubernetes.io/part-of: flex-auth + namespace: flex-auth +spec: + podSelector: + matchLabels: + app.kubernetes.io/name: flex-auth-informed-decision-sitting + policyTypes: + - Ingress + - Egress + egress: + - ports: + - port: 443 + protocol: TCP + - port: 6443 + protocol: TCP + ingress: + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: informed-decision + podSelector: + matchLabels: + app.kubernetes.io/name: informed-decision + ports: + - port: 8080 + protocol: TCP +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: flex-auth-informed-decision-sitting + labels: + app.kubernetes.io/name: flex-auth-informed-decision-sitting + app.kubernetes.io/instance: flex-auth-informed-decision-sitting + app.kubernetes.io/part-of: flex-auth + namespace: flex-auth +automountServiceAccountToken: false +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: flex-auth-informed-decision-sitting-tokenreviewer + labels: + app.kubernetes.io/name: flex-auth-informed-decision-sitting + app.kubernetes.io/instance: flex-auth-informed-decision-sitting + app.kubernetes.io/part-of: flex-auth +rules: +- apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: flex-auth-informed-decision-sitting-tokenreviewer + labels: + app.kubernetes.io/name: flex-auth-informed-decision-sitting + app.kubernetes.io/instance: flex-auth-informed-decision-sitting + app.kubernetes.io/part-of: flex-auth +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: flex-auth-informed-decision-sitting-tokenreviewer +subjects: +- kind: ServiceAccount + name: flex-auth-informed-decision-sitting + namespace: flex-auth +--- +apiVersion: v1 +kind: Service +metadata: + name: flex-auth-informed-decision-sitting + labels: + app.kubernetes.io/name: flex-auth-informed-decision-sitting + app.kubernetes.io/instance: flex-auth-informed-decision-sitting + app.kubernetes.io/part-of: flex-auth + namespace: flex-auth +spec: + selector: + app.kubernetes.io/name: flex-auth-informed-decision-sitting + ports: + - name: http + port: 8080 + targetPort: http +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: flex-auth-informed-decision-sitting + labels: + app.kubernetes.io/name: flex-auth-informed-decision-sitting + app.kubernetes.io/instance: flex-auth-informed-decision-sitting + app.kubernetes.io/part-of: flex-auth + namespace: flex-auth +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: flex-auth-informed-decision-sitting + template: + metadata: + labels: + app.kubernetes.io/name: flex-auth-informed-decision-sitting + app.kubernetes.io/instance: flex-auth-informed-decision-sitting + app.kubernetes.io/part-of: flex-auth + spec: + automountServiceAccountToken: false + serviceAccountName: flex-auth-informed-decision-sitting + securityContext: + runAsNonRoot: true + runAsUser: 65532 + runAsGroup: 65532 + fsGroup: 65532 + seccompProfile: + type: RuntimeDefault + containers: + - name: flex-auth + image: forgejo.coulomb.social/coulomb/flex-auth@sha256:f6fa2062f7095e66c7a91f20cd130914b5481d46d9d909339e028f7ecdf0065d + imagePullPolicy: IfNotPresent + args: + - serve + - --addr + - 0.0.0.0:8080 + - --registry + - /opt/flex-auth/examples/informed-decision-sitting/registry.json + - --policy + - /opt/flex-auth/examples/informed-decision-sitting/policy.md + - --caller-auth-mode + - enforce + - --caller-kubernetes-url + - https://10.43.0.1 + - --caller-binding + - informed-decision=system:serviceaccount:informed-decision:review + ports: + - name: http + containerPort: 8080 + livenessProbe: + httpGet: + path: /healthz + port: http + periodSeconds: 20 + readinessProbe: + httpGet: + path: /healthz + port: http + periodSeconds: 5 + resources: + limits: + cpu: 300m + memory: 192Mi + requests: + cpu: 5m + memory: 32Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + volumeMounts: + - mountPath: /var/run/secrets/flex-auth-reviewer + name: flex-auth-reviewer + readOnly: true + volumes: + - name: flex-auth-reviewer + projected: + defaultMode: 288 + sources: + - serviceAccountToken: + expirationSeconds: 3600 + path: token + - configMap: + name: kube-root-ca.crt + items: + - key: ca.crt + path: ca.crt diff --git a/docs/batches/2026-10-03-provisioning-window/review-admission-v7.json b/docs/batches/2026-10-03-provisioning-window/review-admission-v7.json new file mode 100644 index 0000000..14c80dc --- /dev/null +++ b/docs/batches/2026-10-03-provisioning-window/review-admission-v7.json @@ -0,0 +1,19 @@ +{ + "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:0557edffb0efccc2e283cb878bc3f85deacd8165b45eefde830c21f6f02710c8", + "policy": { + "origin": "http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080", + "package": "informed-decision.compact-sitting", + "version": "v7", + "package_digest": "sha256:2490955f175c52574543e210be06f468a01e56c778d38d4fdcad731875e37cc7", + "pod_name": "flex-auth-informed-decision-sitting" + }, + "keycape_egress_ips": [ + "92.205.62.239" + ], + "storage_class": "local-path", + "ordinary_approval_ids": [ + "2ce76d7f-01c3-4b63-8476-8d1230679769", + "c2af4bcf-15b4-4305-aac1-acc7e4dcb099", + "dc22666a-d5d7-46bc-9490-ebe9fe09dc38" + ] +} diff --git a/docs/batches/2026-10-03-provisioning-window/review-rollout-v7.json b/docs/batches/2026-10-03-provisioning-window/review-rollout-v7.json new file mode 100644 index 0000000..558bede --- /dev/null +++ b/docs/batches/2026-10-03-provisioning-window/review-rollout-v7.json @@ -0,0 +1,219 @@ +{ + "apiVersion": "v1", + "kind": "List", + "items": [ + { + "apiVersion": "v1", + "kind": "ConfigMap", + "metadata": { + "name": "informed-decision-runtime-b800648bd80b", + "namespace": "informed-decision", + "annotations": { + "informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08" + } + }, + "immutable": true, + "data": { + "runtime.json": "{\"approval_origin\":\"http://approval-engine.approval-engine.svc.cluster.local:8080\",\"audit\":{\"origin\":\"http://audit-core.audit-core.svc.cluster.local:8080\",\"sender_token_file\":\"/var/run/secrets/informed-decision/audit/token\"},\"evidence_db\":\"/data/private/review.sqlite\",\"ordinary_approval_ids\":[\"2ce76d7f-01c3-4b63-8476-8d1230679769\",\"c2af4bcf-15b4-4305-aac1-acc7e4dcb099\",\"dc22666a-d5d7-46bc-9490-ebe9fe09dc38\"],\"policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.compact-sitting\",\"package_digest\":\"sha256:2490955f175c52574543e210be06f468a01e56c778d38d4fdcad731875e37cc7\",\"version\":\"v7\"},\"schema\":\"informed-decision.review-runtime.v1\"}" + } + }, + { + "apiVersion": "apps/v1", + "kind": "Deployment", + "metadata": { + "name": "informed-decision", + "namespace": "informed-decision", + "annotations": { + "informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08" + } + }, + "spec": { + "replicas": 1, + "strategy": { + "type": "Recreate" + }, + "progressDeadlineSeconds": 600, + "selector": { + "matchLabels": { + "app.kubernetes.io/name": "informed-decision" + } + }, + "template": { + "metadata": { + "labels": { + "app.kubernetes.io/name": "informed-decision", + "app.kubernetes.io/component": "review" + } + }, + "spec": { + "automountServiceAccountToken": false, + "serviceAccountName": "review", + "terminationGracePeriodSeconds": 45, + "securityContext": { + "runAsNonRoot": true, + "runAsUser": 10001, + "runAsGroup": 10001, + "fsGroup": 10001, + "fsGroupChangePolicy": "OnRootMismatch", + "seccompProfile": { + "type": "RuntimeDefault" + } + }, + "containers": [ + { + "name": "informed-decision", + "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:0557edffb0efccc2e283cb878bc3f85deacd8165b45eefde830c21f6f02710c8", + "securityContext": { + "allowPrivilegeEscalation": false, + "readOnlyRootFilesystem": true, + "capabilities": { + "drop": [ + "ALL" + ] + } + }, + "env": [ + { + "name": "INFD_KEYCAPE_ISSUER", + "value": "https://kc.coulomb.social" + }, + { + "name": "INFD_CONTAINER_CONFIG", + "value": "/configuration/runtime.json" + } + ], + "ports": [ + { + "name": "http", + "containerPort": 8080 + } + ], + "startupProbe": { + "httpGet": { + "path": "/healthz", + "port": "http" + }, + "periodSeconds": 10, + "timeoutSeconds": 2, + "failureThreshold": 12 + }, + "readinessProbe": { + "httpGet": { + "path": "/healthz", + "port": "http" + }, + "periodSeconds": 10, + "timeoutSeconds": 2 + }, + "livenessProbe": { + "httpGet": { + "path": "/healthz", + "port": "http" + }, + "periodSeconds": 10, + "timeoutSeconds": 2 + }, + "resources": { + "requests": { + "cpu": "5m", + "memory": "64Mi" + }, + "limits": { + "cpu": "500m", + "memory": "256Mi" + } + }, + "volumeMounts": [ + { + "name": "data", + "mountPath": "/data" + }, + { + "name": "runtime", + "mountPath": "/run/informed-decision" + }, + { + "name": "tmp", + "mountPath": "/tmp" + }, + { + "name": "configuration", + "mountPath": "/configuration", + "readOnly": true + }, + { + "name": "caller", + "mountPath": "/var/run/secrets/informed-decision/policy", + "readOnly": true + }, + { + "name": "audit", + "mountPath": "/var/run/secrets/informed-decision/audit", + "readOnly": true + } + ] + } + ], + "volumes": [ + { + "name": "data", + "persistentVolumeClaim": { + "claimName": "informed-decision-data" + } + }, + { + "name": "runtime", + "emptyDir": { + "medium": "Memory", + "sizeLimit": "16Mi" + } + }, + { + "name": "tmp", + "emptyDir": { + "medium": "Memory", + "sizeLimit": "16Mi" + } + }, + { + "name": "configuration", + "configMap": { + "name": "informed-decision-runtime-b800648bd80b", + "defaultMode": 292 + } + }, + { + "name": "caller", + "projected": { + "defaultMode": 288, + "sources": [ + { + "serviceAccountToken": { + "path": "token", + "audience": "flex-auth", + "expirationSeconds": 3600 + } + } + ] + } + }, + { + "name": "audit", + "secret": { + "secretName": "informed-decision-audit", + "defaultMode": 288, + "items": [ + { + "key": "token", + "path": "token" + } + ] + } + } + ] + } + } + } + } + ] +} diff --git a/docs/evidence/2026-10-03-provisioning-window-ci-image.json b/docs/evidence/2026-10-03-provisioning-window-ci-image.json new file mode 100644 index 0000000..c508852 --- /dev/null +++ b/docs/evidence/2026-10-03-provisioning-window-ci-image.json @@ -0,0 +1,9 @@ +{ + "source_commit": "f946c7b709e259e22b078b3e78b0c06fd2eea038", + "ci_status": "success", + "policy_image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:f6fa2062f7095e66c7a91f20cd130914b5481d46d9d909339e028f7ecdf0065d", + "policy_package_digest": "sha256:2490955f175c52574543e210be06f468a01e56c778d38d4fdcad731875e37cc7", + "policy_version": "v7", + "p01_synthetic_read": "allow", + "scope": "offline published-image evaluator; no live rollout or human binding" +} diff --git a/workplans/ADHOC-2026-10-03.md b/workplans/ADHOC-2026-10-03.md index 0dde9d3..79ce908 100644 --- a/workplans/ADHOC-2026-10-03.md +++ b/workplans/ADHOC-2026-10-03.md @@ -71,3 +71,12 @@ validation/tests also passed. Candidate package digest: `sha256:2490955f175c52574543e210be06f468a01e56c778d38d4fdcad731875e37cc7`. Evidence: `docs/evidence/2026-10-03-provisioning-window-policy-candidate-checks.json` and `docs/evidence/2026-10-03-provisioning-window-admission-candidate.json`. + +A4 publication: founder applied the tested patch. Access-engine committed and +synced it as `f946c7b`; CI published image +`sha256:f6fa2062f7095e66c7a91f20cd130914b5481d46d9d909339e028f7ecdf0065d`. +Published-image evaluation confirms v7 and the expected package digest. +Deployment values are pinned in access-engine commit `20ea612`. +`docs/batches/2026-10-03-provisioning-window/DEPLOY-v7.md` records the concrete +policy/review rollout candidate, namespace-scoped preflight and rollback. +Live rollout awaits founder approval. Load and human disposition remain open.