INFD-WP-0010-T02: release candidate for present_existing with compact-sitting v14
Candidate files: review policy pin v14 (sha256:8911458f...), the nk-bind-executor present_existing registry row (daily limit 10), and an 8081 ingress peer for exactly sso + app.kubernetes.io/name=bounded-executor. The state-hub row is unchanged and outcome_read stays off. The image pin stays at the live f5588f49 because no owner-CI full-service image exists yet; the founder runbook (deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md) gates the release on it. Adds a side-effect-free present_existing probe and release tests. Nothing applied. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
This commit is contained in:
parent
3b7031ae39
commit
0ef57537ac
9 changed files with 457 additions and 6 deletions
|
|
@ -210,3 +210,13 @@ container checks pass. Both scans have zero HIGH/CRITICAL findings. Fresh
|
|||
schema-5 backup: 8ac7bbe79de7cdcff5ebc9fa8adc9c49498bf8a3298c8fbc9bd7501be1a379bb.
|
||||
Rollback, if needed: owner Helm prior revision 12 and Argo source dfcef87 together,
|
||||
retaining the current schema-5 database. Evidence: docs/evidence/2026-10-05-lifecycle-discovery/.
|
||||
|
||||
## Present-existing release candidate — prepared 2026-11-01 (not applied)
|
||||
|
||||
INFD-WP-0010-T02, together with access-engine compact-sitting v14. The candidate files carry the v14 review pin
|
||||
(`sha256:8911458f…fc300fde`), the `nk-bind-executor` present_existing registry row (daily limit 10) and an 8081
|
||||
ingress peer for exactly `sso` + `app.kubernetes.io/name=bounded-executor`. The state-hub row is unchanged and
|
||||
outcome_read stays off. **The image pin is still the live `f5588f49…`, because no owner-CI full-service image
|
||||
exists yet. Do not sync this candidate until it is replaced:** the live image rejects the new registry row,
|
||||
which would fail all intake. Founder runbook, verification and rollback:
|
||||
[RELEASE-INFD-WP-0010-T02.md](RELEASE-INFD-WP-0010-T02.md).
|
||||
|
|
|
|||
219
deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md
Normal file
219
deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md
Normal file
|
|
@ -0,0 +1,219 @@
|
|||
# Release runbook: present_existing for nk-bind-executor + compact-sitting v14 (INFD-WP-0010-T02)
|
||||
|
||||
Prepared 2026-11-01 by the informed-decision owner agent. **Nothing in this file has been applied.**
|
||||
Founder approval (2026-11-01, relayed by the net-kingdom coordinator): release present_existing together with
|
||||
access-engine compact-sitting v14. Every command below is founder-run, with
|
||||
`export KUBECONFIG=$HOME/.kube/config-railiance01`.
|
||||
|
||||
## Status: blocked on the service image (gate G0)
|
||||
|
||||
No CI image exists for current `main`. This repository has no Forgejo workflow that builds the full service
|
||||
image. Its two workflows build single-purpose overlays on fixed base digests:
|
||||
|
||||
- `.forgejo/workflows/purpose-overlay-image.yaml` swaps one module, `policy.py`, on base `7f5c6cb2…`, and
|
||||
checks it against the pinned hash `9d7c1be4…`. Commit `80ef840` changed `policy.py` (now `912ad3a3…`), so
|
||||
run 5 (head `e617bb5`, 2026-11-01T03:07Z) failed at that check. That is the intended behaviour. Even if the
|
||||
hash were updated, the overlay could not carry this release: it touches nine modules (`intake.py`,
|
||||
`intake_service.py`, `intake_approval.py`, `outcome.py` (new), `policy.py`, `requester.py`, `review.py`,
|
||||
`store.py`, `workload.py`).
|
||||
- `.forgejo/workflows/zlib-overlay-image.yaml` upgrades zlib only, on base `763c3640…`.
|
||||
|
||||
The registry has no tag for `3b7031a`, `main` or `latest`. `docker buildx imagetools inspect` returns
|
||||
not found for each.
|
||||
|
||||
Before this release can go out, an owner-CI full-image build from the release source must exist. It needs
|
||||
its own workflow, and it must keep zlib at `1.3.2-r1` or later. A plain rebuild of `Containerfile` uses the
|
||||
pinned `python:3.12-alpine@sha256:b64631e0…` base and only adds `libuuid`. That would reintroduce the zlib
|
||||
finding that the live image `f5588f49…` remediated. Then pin the image as in step 0.
|
||||
|
||||
**Do not sync this candidate with the current image.** The live image `f5588f49…` accepts only the four basic
|
||||
registry keys: `set(row) != {submitter_id, memo_classes, review_groups, daily_limit}`. It would reject the
|
||||
executor row, so every intake request would fail with 503 `intake_configuration_unavailable`, State Hub's
|
||||
included. It also does not send `approval_action`.
|
||||
|
||||
## Pins
|
||||
|
||||
| | Current, live (rollback target) | Candidate |
|
||||
| --- | --- | --- |
|
||||
| Argo `informed-decision` targetRevision | `312ab97e876e17341bf16f9e95397e14c2ac2720` | `<RELEASE_SHA>` (step 0) |
|
||||
| Service image | `…/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23` | `<IMAGE_DIGEST>` (G0) |
|
||||
| Runtime ConfigMap | `informed-decision-runtime-6c221878d051` | `informed-decision-runtime-b488b96a0953` |
|
||||
| Review policy pin | compact-sitting `v13` `sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873` | `v14` `sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde` |
|
||||
| Helm `flex-auth-informed-decision-sitting` (access-engine) | revision 13, image `6c6dc263…`, v13 policy path | access-engine's v14 release (`2de0f86`), prepared in parallel |
|
||||
| Lifecycle policy pin | `informed-decision.lifecycle` v2 `da01e045…` | unchanged |
|
||||
| Store schema | 5 | 5 (no migration) |
|
||||
|
||||
Candidate source changes in this commit:
|
||||
|
||||
- `admission.candidate.json`: the policy pin moves to v14, and the workload peer `{namespace: sso, app: bounded-executor}`
|
||||
is added. `service.candidate.json` is re-rendered with `tools/render_deployment.py`.
|
||||
- `informed-decision-review` NetworkPolicy: the 8081 ingress rule `from` now lists exactly two peers:
|
||||
`state-hub/app.kubernetes.io/name=state-hub` (unchanged) and `kubernetes.io/metadata.name=sso` AND
|
||||
`app.kubernetes.io/name=bounded-executor`. No other sso pod is admitted, and nothing new is admitted on 8080.
|
||||
- `intake-submitters.json` (projected into `registries.candidate.json`): new row
|
||||
`system:serviceaccount:sso:nk-bind-executor` → `nk-bind-executor`, memo class `bounded-execution`, review group
|
||||
`net-kingdom-admins`, `daily_limit: 10`, `present_existing {approval_actor: service:nk-bind-executor, actions:
|
||||
[bounded-execution]}`. The state-hub row is byte-identical, and `outcome_read` stays off (T05 waits for STATE-WP-0101).
|
||||
|
||||
## Step 0: pin the image (after G0; owner agent or founder)
|
||||
|
||||
```bash
|
||||
cd ~/informed-decision
|
||||
docker buildx imagetools inspect forgejo.coulomb.social/coulomb/informed-decision:<CI_TAG> # read the digest
|
||||
# set "image" in deploy/lifecycle/admission.candidate.json to forgejo.coulomb.social/coulomb/informed-decision@<IMAGE_DIGEST>
|
||||
python3 tools/render_deployment.py --input deploy/lifecycle/admission.candidate.json \
|
||||
--output deploy/lifecycle/service.candidate.json
|
||||
.venv/bin/python -m pytest -q # expect 0 failures
|
||||
python3 tools/smoke_container.py --image forgejo.coulomb.social/coulomb/informed-decision@<IMAGE_DIGEST> \
|
||||
--receipt docs/evidence/<date>-present-existing-release/container.json --workload
|
||||
git commit -am "INFD-WP-0010-T02: pin service image <IMAGE_DIGEST> for the v14 release" && git push
|
||||
RELEASE_SHA=$(git rev-parse HEAD)
|
||||
```
|
||||
|
||||
Only the image line and the re-rendered `service.candidate.json` change. The runtime ConfigMap name stays
|
||||
`…b488b96a0953` because the image is not part of runtime.json.
|
||||
|
||||
## Step 1: preflight (read-only)
|
||||
|
||||
```bash
|
||||
export KUBECONFIG=$HOME/.kube/config-railiance01
|
||||
kubectl -n argocd get application informed-decision \
|
||||
-o jsonpath='{.spec.source.targetRevision} {.status.sync.status} {.status.health.status}{"\n"}'
|
||||
# expect 312ab97e876e17341bf16f9e95397e14c2ac2720, Healthy (OutOfSync is the known orphan ConfigMap
|
||||
# informed-decision-runtime-c81577741a09; prune stays off)
|
||||
kubectl -n informed-decision get deploy informed-decision -o jsonpath='{.spec.template.spec.containers[0].image}{"\n"}'
|
||||
helm -n flex-auth history flex-auth-informed-decision-sitting --max 3 # expect revision 13 deployed
|
||||
kubectl -n sso get sa nk-bind-executor
|
||||
kubectl -n informed-decision exec deploy/informed-decision -- \
|
||||
informed-decision-admin inspect --db /data/private/review.sqlite # record counts (schema 5)
|
||||
# Server dry-run of the exact release source (no persistence):
|
||||
git -C ~/informed-decision checkout --detach "$RELEASE_SHA"
|
||||
kubectl apply --dry-run=server -k ~/informed-decision/deploy/lifecycle
|
||||
kubectl diff -k ~/informed-decision/deploy/lifecycle # expect: image, runtime ConfigMap name/new ConfigMap,
|
||||
# registry ConfigMap, review NetworkPolicy (+ Argo annotations)
|
||||
git -C ~/informed-decision checkout main
|
||||
```
|
||||
|
||||
## Step 2: backup (schema is unchanged, but the release convention still requires it)
|
||||
|
||||
```bash
|
||||
STAMP=$(date -u +%Y%m%dT%H%M%SZ)
|
||||
kubectl -n informed-decision exec deploy/informed-decision -- \
|
||||
informed-decision-admin backup --db /data/private/review.sqlite --output /data/private/review-$STAMP-pre-v14.sqlite
|
||||
mkdir -p -m 0700 ~/informed-decision/.private-backups/$STAMP-pre-v14
|
||||
kubectl -n informed-decision exec deploy/informed-decision -- cat /data/private/review-$STAMP-pre-v14.sqlite \
|
||||
> ~/informed-decision/.private-backups/$STAMP-pre-v14/review.sqlite
|
||||
chmod 0600 ~/informed-decision/.private-backups/$STAMP-pre-v14/review.sqlite
|
||||
sha256sum ~/informed-decision/.private-backups/$STAMP-pre-v14/review.sqlite
|
||||
```
|
||||
|
||||
## Step 3: one window, access-engine first, then informed-decision
|
||||
|
||||
The service checks the PDP's provenance on every review call: `policy_package`, `policy_version`,
|
||||
`policy_package_digest` and `matched_policy_version` must all equal its pin. Between the two steps, the
|
||||
version mismatch makes human review reads and acts **fail closed**. No review is lost, but pages refuse.
|
||||
Workload intake (`POST /v1/memos`) does not consult the PDP, so State Hub posing continues throughout. Keep
|
||||
the gap to minutes.
|
||||
|
||||
**3a. access-engine v14** follows access-engine's own release runbook (FLEX-WP-0040-T07,
|
||||
`access-engine/docs/compact-sitting-v14-present-existing.md`, "Live steps"). It runs a Helm upgrade of
|
||||
`flex-auth-informed-decision-sitting` with `--atomic`: a new image built from `2de0f86` or later, and
|
||||
`--policy /opt/flex-auth/examples/informed-decision-present-existing-review/policy.md`. Check:
|
||||
|
||||
```bash
|
||||
helm -n flex-auth history flex-auth-informed-decision-sitting --max 2 # expect revision 14 deployed
|
||||
kubectl -n flex-auth rollout status deploy/flex-auth-informed-decision-sitting --timeout=180s
|
||||
```
|
||||
|
||||
If the `--atomic` upgrade rolls itself back, stop here. Do not run 3b. Nothing on the informed-decision side has changed.
|
||||
|
||||
**3b. informed-decision**, through the manually pinned Argo application:
|
||||
|
||||
```bash
|
||||
kubectl -n argocd patch application informed-decision --type merge \
|
||||
-p "{\"spec\":{\"source\":{\"targetRevision\":\"$RELEASE_SHA\"}}}"
|
||||
kubectl -n argocd patch application informed-decision --type merge \
|
||||
-p "{\"operation\":{\"initiatedBy\":{\"username\":\"founder\"},\"sync\":{\"revision\":\"$RELEASE_SHA\",\"prune\":false,\"syncOptions\":[\"ApplyOutOfSyncOnly=true\"]}}}"
|
||||
kubectl -n argocd get application informed-decision \
|
||||
-o jsonpath='{.status.operationState.phase} {.status.sync.revision} {.status.health.status}{"\n"}'
|
||||
kubectl -n informed-decision rollout status deploy/informed-decision --timeout=300s # Recreate: short restart
|
||||
```
|
||||
|
||||
## Step 4: verification
|
||||
|
||||
Possible without the executor:
|
||||
|
||||
1. **Pins live.** Check the Deployment image and that its `configuration` volume names
|
||||
`informed-decision-runtime-b488b96a0953`:
|
||||
```bash
|
||||
kubectl -n informed-decision get deploy informed-decision \
|
||||
-o jsonpath='{.spec.template.spec.containers[0].image} {.spec.template.spec.volumes[?(@.name=="configuration")].configMap.name}{"\n"}'
|
||||
kubectl -n informed-decision get networkpolicy informed-decision-review -o jsonpath='{.spec.ingress[1].from}{"\n"}'
|
||||
# expect exactly the state-hub peer and the sso + app.kubernetes.io/name=bounded-executor peer
|
||||
```
|
||||
2. **Public surface.** `curl -s -o /dev/null -w '%{http_code}\n' https://decisions.coulomb.social/healthz` and
|
||||
`/readyz` return 200. `/v1/memos` and `/v1/decisions` on the public origin return 404.
|
||||
3. **v14 pin match (human, aal2).** Open `https://decisions.coulomb.social/` and one existing memo you were
|
||||
presented. The page loads only if the PDP's v14 provenance equals the new pin. A refusal mentioning policy
|
||||
or provenance means 3a and 3b disagree: roll back (step 5).
|
||||
4. **Store unchanged.** Run the `informed-decision-admin inspect` command from step 1 again. Schema 5, and
|
||||
the counts are no lower than the preflight.
|
||||
5. **Executor path, synthetic and side-effect free.** Run this from a temporary pod that carries the
|
||||
executor's identity and label. It is a founder-run kubectl write: a short-lived pod in sso, removed by
|
||||
`--rm`. The probe pins a deliberately wrong binding digest, so even a successful approval read ends in a
|
||||
409. No memo is stored, no budget is spent, and nothing is created, entered or consumed in approval-engine.
|
||||
```bash
|
||||
cd ~/informed-decision
|
||||
IMAGE=forgejo.coulomb.social/coulomb/informed-decision@<IMAGE_DIGEST>
|
||||
NAME=infd-probe-$(date -u +%H%M%S) # --overrides (merge patch) replaces the generated container: it carries name and image
|
||||
OVR='{"spec":{"serviceAccountName":"nk-bind-executor","automountServiceAccountToken":false,
|
||||
"securityContext":{"runAsNonRoot":true,"runAsUser":10001,"seccompProfile":{"type":"RuntimeDefault"}},
|
||||
"containers":[{"name":"'$NAME'","image":"'$IMAGE'","command":["python","-"],"stdin":true,"stdinOnce":true,
|
||||
"securityContext":{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"capabilities":{"drop":["ALL"]}},
|
||||
"volumeMounts":[{"name":"intake","mountPath":"/var/run/secrets/informed-decision-intake","readOnly":true}]}],
|
||||
"volumes":[{"name":"intake","projected":{"sources":[{"serviceAccountToken":{"path":"token",
|
||||
"audience":"informed-decision-intake","expirationSeconds":600}}]}}]}}'
|
||||
.venv/bin/python tools/present_existing_probe.py --approval-id "$(python3 -c 'import uuid;print(uuid.uuid4())')" --program \
|
||||
| kubectl -n sso run "$NAME" --rm -i --restart=Never --image="$IMAGE" \
|
||||
--labels=app.kubernetes.io/name=bounded-executor,app.kubernetes.io/component=release-probe --overrides="$OVR"
|
||||
```
|
||||
Expected result for a random UUID: `503 {"error": "approval_unreadable"}`. Getting there proves the
|
||||
NetworkPolicy admits the sso executor label on 8081, TokenReview accepts `nk-bind-executor` with audience
|
||||
`informed-decision-intake`, the reloaded registry parses (so the state-hub row is also loaded), the
|
||||
`present_existing` profile and envelope validation pass, and the reservation is released.
|
||||
- If you know an approval id in approval-engine that no informed-decision memo has presented yet (for example
|
||||
one created during NK-WP-0056 executor testing), use it in place of the random UUID. Expect a 409 with an
|
||||
`approval_*` reason (`approval_digest_mismatch` or an earlier one). That proves the read through KeyCape
|
||||
`approval:read` as well.
|
||||
- Negative check: rerun with `"serviceAccountName":"default"` and expect `403 submitter_unknown`.
|
||||
- Other outcomes: `401 workload_authentication_failed` points to the token or audience. A timeout points to the
|
||||
NetworkPolicy (check the executor egress policy too). `503 intake_configuration_unavailable` means the
|
||||
registry did not parse: roll back.
|
||||
|
||||
Needs the executor (this is T02's own done-when): the executor creates an approval as `service:nk-bind-executor` and
|
||||
presents it, the founder accepts at aal2 on `/review`, and the executor consumes it. That is the
|
||||
NK-WP-0056 pilot run. It is not part of this release window.
|
||||
|
||||
## Step 5: rollback to the current release
|
||||
|
||||
The database is retained and stays on schema 5, so this is not a downgrade. Do both halves in the same window:
|
||||
|
||||
```bash
|
||||
kubectl -n argocd patch application informed-decision --type merge \
|
||||
-p '{"spec":{"source":{"targetRevision":"312ab97e876e17341bf16f9e95397e14c2ac2720"}}}'
|
||||
kubectl -n argocd patch application informed-decision --type merge \
|
||||
-p '{"operation":{"initiatedBy":{"username":"founder"},"sync":{"revision":"312ab97e876e17341bf16f9e95397e14c2ac2720","prune":false,"syncOptions":["ApplyOutOfSyncOnly=true"]}}}'
|
||||
kubectl -n informed-decision rollout status deploy/informed-decision --timeout=300s
|
||||
helm -n flex-auth rollback flex-auth-informed-decision-sitting 13 --wait # access-engine's v13 release
|
||||
```
|
||||
|
||||
This restores image `f5588f49…`, runtime ConfigMap `…6c221878d051` (v13 pin), the registry without the executor
|
||||
row, and the NetworkPolicy without the sso peer. The new immutable ConfigMap `…b488b96a0953` is left in place
|
||||
because prune is off. It is harmless. Any present-existing memo posed during the window stays in the store but
|
||||
cannot be reviewed under v13 (`unknown_submitter`): it fails closed. Record it, and do not delete it.
|
||||
|
||||
## Step 6: record
|
||||
|
||||
Write `docs/evidence/<date>-present-existing-release/` (pins, Argo revision, Helm revision, backup sha256,
|
||||
probe outputs without tokens) and append a "Present-existing release" section to `deploy/lifecycle/README.md`.
|
||||
Then update INFD-WP-0010-T02.
|
||||
|
|
@ -3,8 +3,8 @@
|
|||
"policy": {
|
||||
"origin": "http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080",
|
||||
"package": "informed-decision.compact-sitting",
|
||||
"version": "v13",
|
||||
"package_digest": "sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873",
|
||||
"version": "v14",
|
||||
"package_digest": "sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde",
|
||||
"pod_name": "flex-auth-informed-decision-sitting"
|
||||
},
|
||||
"keycape_egress_ips": [
|
||||
|
|
@ -34,6 +34,10 @@
|
|||
{
|
||||
"namespace": "state-hub",
|
||||
"app": "state-hub"
|
||||
},
|
||||
{
|
||||
"namespace": "sso",
|
||||
"app": "bounded-executor"
|
||||
}
|
||||
],
|
||||
"api_egress": [
|
||||
|
|
|
|||
|
|
@ -8,5 +8,21 @@
|
|||
"net-kingdom-admins"
|
||||
],
|
||||
"daily_limit": 50
|
||||
},
|
||||
"system:serviceaccount:sso:nk-bind-executor": {
|
||||
"submitter_id": "nk-bind-executor",
|
||||
"memo_classes": [
|
||||
"bounded-execution"
|
||||
],
|
||||
"review_groups": [
|
||||
"net-kingdom-admins"
|
||||
],
|
||||
"daily_limit": 10,
|
||||
"present_existing": {
|
||||
"approval_actor": "service:nk-bind-executor",
|
||||
"actions": [
|
||||
"bounded-execution"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@
|
|||
},
|
||||
"data": {
|
||||
"lifecycle-callers.json": "{\n \"system:serviceaccount:state-hub:state-hub\": {\n \"tenant\": \"tenant:platform\"\n }\n}\n",
|
||||
"intake-submitters.json": "{\n \"system:serviceaccount:state-hub:state-hub\": {\n \"submitter_id\": \"state-hub\",\n \"memo_classes\": [\n \"decision-record\"\n ],\n \"review_groups\": [\n \"net-kingdom-admins\"\n ],\n \"daily_limit\": 50\n }\n}\n",
|
||||
"intake-submitters.json": "{\n \"system:serviceaccount:state-hub:state-hub\": {\n \"submitter_id\": \"state-hub\",\n \"memo_classes\": [\n \"decision-record\"\n ],\n \"review_groups\": [\n \"net-kingdom-admins\"\n ],\n \"daily_limit\": 50\n },\n \"system:serviceaccount:sso:nk-bind-executor\": {\n \"submitter_id\": \"nk-bind-executor\",\n \"memo_classes\": [\n \"bounded-execution\"\n ],\n \"review_groups\": [\n \"net-kingdom-admins\"\n ],\n \"daily_limit\": 10,\n \"present_existing\": {\n \"approval_actor\": \"service:nk-bind-executor\",\n \"actions\": [\n \"bounded-execution\"\n ]\n }\n }\n}\n",
|
||||
"review-groups.json": "{\n \"net-kingdom-admins\": {\n \"subject\": \"uid=platform-root,ou=people,dc=netkingdom,dc=local\",\n \"display_name\": \"Platform reviewer\"\n }\n}\n"
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -40,7 +40,7 @@
|
|||
"apiVersion": "v1",
|
||||
"kind": "ConfigMap",
|
||||
"metadata": {
|
||||
"name": "informed-decision-runtime-6c221878d051",
|
||||
"name": "informed-decision-runtime-b488b96a0953",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
|
|
@ -48,7 +48,7 @@
|
|||
},
|
||||
"immutable": true,
|
||||
"data": {
|
||||
"runtime.json": "{\"approval_origin\":\"http://approval-engine.approval-engine.svc.cluster.local:8080\",\"audit\":{\"origin\":\"http://audit-core.audit-core.svc.cluster.local:8080\",\"sender_token_file\":\"/var/run/secrets/informed-decision/audit/token\"},\"evidence_db\":\"/data/private/review.sqlite\",\"intake_attributes\":true,\"intake_delivery\":{\"hub_origin\":\"http://state-hub.state-hub.svc.cluster.local:8000\"},\"lifecycle_delivery\":true,\"lifecycle_policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-lifecycle.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.lifecycle\",\"package_digest\":\"sha256:da01e045fc108adec6b489e5d51f7e57366793016c5a64776963780a6aae457c\",\"version\":\"v2\"},\"ordinary_approval_ids\":[\"2ce76d7f-01c3-4b63-8476-8d1230679769\",\"c2af4bcf-15b4-4305-aac1-acc7e4dcb099\",\"dc22666a-d5d7-46bc-9490-ebe9fe09dc38\"],\"policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.compact-sitting\",\"package_digest\":\"sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873\",\"version\":\"v13\"},\"schema\":\"informed-decision.review-runtime.v1\",\"workload_api\":{\"intake\":{\"groups_file\":\"/workload-registry/review-groups.json\",\"secret_file\":\"/var/run/secrets/informed-decision/requester/client-secret\",\"submitters_file\":\"/workload-registry/intake-submitters.json\"},\"lifecycle_callers_file\":\"/workload-registry/lifecycle-callers.json\",\"token_review\":{\"ca_file\":\"/var/run/secrets/informed-decision/kubernetes/ca.crt\",\"origin\":\"https://kubernetes.default.svc:443\",\"token_file\":\"/var/run/secrets/informed-decision/kubernetes/token\"}}}"
|
||||
"runtime.json": "{\"approval_origin\":\"http://approval-engine.approval-engine.svc.cluster.local:8080\",\"audit\":{\"origin\":\"http://audit-core.audit-core.svc.cluster.local:8080\",\"sender_token_file\":\"/var/run/secrets/informed-decision/audit/token\"},\"evidence_db\":\"/data/private/review.sqlite\",\"intake_attributes\":true,\"intake_delivery\":{\"hub_origin\":\"http://state-hub.state-hub.svc.cluster.local:8000\"},\"lifecycle_delivery\":true,\"lifecycle_policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-lifecycle.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.lifecycle\",\"package_digest\":\"sha256:da01e045fc108adec6b489e5d51f7e57366793016c5a64776963780a6aae457c\",\"version\":\"v2\"},\"ordinary_approval_ids\":[\"2ce76d7f-01c3-4b63-8476-8d1230679769\",\"c2af4bcf-15b4-4305-aac1-acc7e4dcb099\",\"dc22666a-d5d7-46bc-9490-ebe9fe09dc38\"],\"policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.compact-sitting\",\"package_digest\":\"sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde\",\"version\":\"v14\"},\"schema\":\"informed-decision.review-runtime.v1\",\"workload_api\":{\"intake\":{\"groups_file\":\"/workload-registry/review-groups.json\",\"secret_file\":\"/var/run/secrets/informed-decision/requester/client-secret\",\"submitters_file\":\"/workload-registry/intake-submitters.json\"},\"lifecycle_callers_file\":\"/workload-registry/lifecycle-callers.json\",\"token_review\":{\"ca_file\":\"/var/run/secrets/informed-decision/kubernetes/ca.crt\",\"origin\":\"https://kubernetes.default.svc:443\",\"token_file\":\"/var/run/secrets/informed-decision/kubernetes/token\"}}}"
|
||||
}
|
||||
},
|
||||
{
|
||||
|
|
@ -231,7 +231,7 @@
|
|||
{
|
||||
"name": "configuration",
|
||||
"configMap": {
|
||||
"name": "informed-decision-runtime-6c221878d051",
|
||||
"name": "informed-decision-runtime-b488b96a0953",
|
||||
"defaultMode": 292
|
||||
}
|
||||
},
|
||||
|
|
@ -397,6 +397,18 @@
|
|||
"app.kubernetes.io/name": "state-hub"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "sso"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "bounded-executor"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue