Record the deployed v11 pin that allows the T03 review acts.
Assistant: grok Assistant-Session: 01a106a5-fc07-78c2-b64f-8e04cea25daf
This commit is contained in:
parent
91b117c6a7
commit
5dd68eb8c1
4 changed files with 604 additions and 2 deletions
|
|
@ -3,8 +3,8 @@
|
|||
"policy": {
|
||||
"origin": "http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080",
|
||||
"package": "informed-decision.compact-sitting",
|
||||
"version": "v10",
|
||||
"package_digest": "sha256:ede11f888d57809dfce1b04d2323708c7244f36187fd5a58dd738437a05e7e91",
|
||||
"version": "v11",
|
||||
"package_digest": "sha256:4fd1961a2ab564a7b3306757ebd5c2c1487c33b29715a3bbf599ad9b79a48fa4",
|
||||
"pod_name": "flex-auth-informed-decision-sitting"
|
||||
},
|
||||
"keycape_egress_ips": [
|
||||
|
|
|
|||
52
docs/batches/2026-10-04-t03-review-act/DEPLOY-v11.md
Normal file
52
docs/batches/2026-10-04-t03-review-act/DEPLOY-v11.md
Normal file
|
|
@ -0,0 +1,52 @@
|
|||
# T03 review acts — deployed 2026-10-04
|
||||
|
||||
Founder authorized ("Yes, deploy it"). Helm revision 11 is deployed on
|
||||
`flex-auth-informed-decision-sitting` with image
|
||||
`sha256:feae06d5cd6c68296437d9df344ab76e44c178b8671ac76bf2d6e83e8ac1f645`
|
||||
(CI build of access-engine `1aae59f`; pin commit `c0f3f25`). Review runtime
|
||||
ConfigMap `informed-decision-runtime-f4755c6df69b` is live. Public health and
|
||||
readiness returned 200. No memo was accepted, declined, or sealed, and hub
|
||||
decision `62aa95e4-3ccc-4867-8806-5e3db005b483` was not resolved.
|
||||
|
||||
The prepared package follows.
|
||||
|
||||
The live sitting policy v10 lists `SECRETS-WP-0010-T03-apply`, `-verify`,
|
||||
and `-exec` and refuses `read` and `accept`. v11 adds one act rule for those
|
||||
three records only.
|
||||
|
||||
## Pins
|
||||
|
||||
| Item | Value |
|
||||
|---|---|
|
||||
| Policy source | access-engine `1aae59f`, pin `c0f3f25` |
|
||||
| Policy version | `v11` |
|
||||
| Package digest | `sha256:4fd1961a2ab564a7b3306757ebd5c2c1487c33b29715a3bbf599ad9b79a48fa4` |
|
||||
| Runtime input | `proposed/sitting-admission-v11.json` |
|
||||
| New ConfigMap | `informed-decision-runtime-f4755c6df69b` in `proposed/review-rollout-v11.json` |
|
||||
| Review image | unchanged `sha256:ccca0b377bb8ba6af52a37edc453b5b51c96e380840ec8243ffaab3ac2170885` |
|
||||
| Policy image | `sha256:feae06d5cd6c68296437d9df344ab76e44c178b8671ac76bf2d6e83e8ac1f645` |
|
||||
|
||||
Acts `read`, `acknowledge`, `accept`, `return`, `discuss`, and `decline`
|
||||
allow only when the memo id, memo version 3, approval id, and binding digest
|
||||
all match. The 900-second KeyCape bar is the same as the version-1 act rule.
|
||||
`list` stays `operator_admitted_overview_list`. Version 2, a foreign approval
|
||||
id, and a wrong digest stay denied. The version-1 sitting records stay on
|
||||
`operator_admitted_compact_sitting`.
|
||||
|
||||
| Memo | Approval | Binding digest |
|
||||
|---|---|---|
|
||||
| `SECRETS-WP-0010-T03-apply` | `b5fcbfcc-ad56-456f-bc36-c823052e9917` | `sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5` |
|
||||
| `SECRETS-WP-0010-T03-verify` | `4e9ff881-d59f-4143-9155-929afbe8dd43` | `sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2` |
|
||||
| `SECRETS-WP-0010-T03-exec` | `a24e0898-b3c5-4e50-85a8-18a2c2aa229e` | `sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8` |
|
||||
|
||||
Those approvals expire `2026-10-05T14:24:25Z`.
|
||||
|
||||
## Checks already run
|
||||
|
||||
`go test ./internal/policy/ -run 'TestT03ReviewActs|TestInformedDecisionAttributeAdmission|TestWP0094ExactRecords|TestAdmissionSetGenerator|TestSittingImagePinMatchesRecordedBuild'` passed. `TestT03ReviewActs` covers all six acts and `list` for each of the three memos, refuses version 2 and a wrong digest, and keeps the v9 sitting record on the old act rule.
|
||||
|
||||
## Deployed
|
||||
|
||||
Image `forgejo.coulomb.social/coulomb/flex-auth@sha256:feae06d5cd6c68296437d9df344ab76e44c178b8671ac76bf2d6e83e8ac1f645` matches the policy bytes of `1aae59f`. Helm revision 11 is deployed. The review site serves package digest `sha256:4fd1961a2ab564a7b3306757ebd5c2c1487c33b29715a3bbf599ad9b79a48fa4`, version `v11`. `deploy/sitting-admission.json` records that pin.
|
||||
|
||||
Rollback: `helm rollback flex-auth-informed-decision-sitting 10 -n flex-auth`, then point the review volume back at ConfigMap `informed-decision-runtime-75ab117cc787`.
|
||||
|
|
@ -0,0 +1,531 @@
|
|||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "List",
|
||||
"items": [
|
||||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "ServiceAccount",
|
||||
"metadata": {
|
||||
"name": "review",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
}
|
||||
},
|
||||
"automountServiceAccountToken": false
|
||||
},
|
||||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "PersistentVolumeClaim",
|
||||
"metadata": {
|
||||
"name": "informed-decision-data",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"accessModes": [
|
||||
"ReadWriteOnce"
|
||||
],
|
||||
"storageClassName": "local-path",
|
||||
"resources": {
|
||||
"requests": {
|
||||
"storage": "1Gi"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "ConfigMap",
|
||||
"metadata": {
|
||||
"name": "informed-decision-runtime-f4755c6df69b",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
}
|
||||
},
|
||||
"immutable": true,
|
||||
"data": {
|
||||
"runtime.json": "{\"approval_origin\":\"http://approval-engine.approval-engine.svc.cluster.local:8080\",\"audit\":{\"origin\":\"http://audit-core.audit-core.svc.cluster.local:8080\",\"sender_token_file\":\"/var/run/secrets/informed-decision/audit/token\"},\"evidence_db\":\"/data/private/review.sqlite\",\"ordinary_approval_ids\":[\"2ce76d7f-01c3-4b63-8476-8d1230679769\",\"c2af4bcf-15b4-4305-aac1-acc7e4dcb099\",\"dc22666a-d5d7-46bc-9490-ebe9fe09dc38\"],\"policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.compact-sitting\",\"package_digest\":\"sha256:4fd1961a2ab564a7b3306757ebd5c2c1487c33b29715a3bbf599ad9b79a48fa4\",\"version\":\"v11\"},\"schema\":\"informed-decision.review-runtime.v1\"}"
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "apps/v1",
|
||||
"kind": "Deployment",
|
||||
"metadata": {
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"replicas": 1,
|
||||
"strategy": {
|
||||
"type": "Recreate"
|
||||
},
|
||||
"progressDeadlineSeconds": 600,
|
||||
"selector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"template": {
|
||||
"metadata": {
|
||||
"labels": {
|
||||
"app.kubernetes.io/name": "informed-decision",
|
||||
"app.kubernetes.io/component": "review"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"automountServiceAccountToken": false,
|
||||
"serviceAccountName": "review",
|
||||
"terminationGracePeriodSeconds": 45,
|
||||
"securityContext": {
|
||||
"runAsNonRoot": true,
|
||||
"runAsUser": 10001,
|
||||
"runAsGroup": 10001,
|
||||
"fsGroup": 10001,
|
||||
"fsGroupChangePolicy": "OnRootMismatch",
|
||||
"seccompProfile": {
|
||||
"type": "RuntimeDefault"
|
||||
}
|
||||
},
|
||||
"containers": [
|
||||
{
|
||||
"name": "informed-decision",
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:ccca0b377bb8ba6af52a37edc453b5b51c96e380840ec8243ffaab3ac2170885",
|
||||
"securityContext": {
|
||||
"allowPrivilegeEscalation": false,
|
||||
"readOnlyRootFilesystem": true,
|
||||
"capabilities": {
|
||||
"drop": [
|
||||
"ALL"
|
||||
]
|
||||
}
|
||||
},
|
||||
"env": [
|
||||
{
|
||||
"name": "INFD_KEYCAPE_ISSUER",
|
||||
"value": "https://kc.coulomb.social"
|
||||
},
|
||||
{
|
||||
"name": "INFD_CONTAINER_CONFIG",
|
||||
"value": "/configuration/runtime.json"
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"name": "http",
|
||||
"containerPort": 8080
|
||||
}
|
||||
],
|
||||
"startupProbe": {
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"timeoutSeconds": 2,
|
||||
"failureThreshold": 12
|
||||
},
|
||||
"readinessProbe": {
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"livenessProbe": {
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"resources": {
|
||||
"requests": {
|
||||
"cpu": "5m",
|
||||
"memory": "64Mi"
|
||||
},
|
||||
"limits": {
|
||||
"cpu": "500m",
|
||||
"memory": "256Mi"
|
||||
}
|
||||
},
|
||||
"volumeMounts": [
|
||||
{
|
||||
"name": "data",
|
||||
"mountPath": "/data"
|
||||
},
|
||||
{
|
||||
"name": "runtime",
|
||||
"mountPath": "/run/informed-decision"
|
||||
},
|
||||
{
|
||||
"name": "tmp",
|
||||
"mountPath": "/tmp"
|
||||
},
|
||||
{
|
||||
"name": "configuration",
|
||||
"mountPath": "/configuration",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"name": "caller",
|
||||
"mountPath": "/var/run/secrets/informed-decision/policy",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"name": "audit",
|
||||
"mountPath": "/var/run/secrets/informed-decision/audit",
|
||||
"readOnly": true
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"volumes": [
|
||||
{
|
||||
"name": "data",
|
||||
"persistentVolumeClaim": {
|
||||
"claimName": "informed-decision-data"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "runtime",
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "tmp",
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "configuration",
|
||||
"configMap": {
|
||||
"name": "informed-decision-runtime-f4755c6df69b",
|
||||
"defaultMode": 292
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "caller",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"path": "token",
|
||||
"audience": "flex-auth",
|
||||
"expirationSeconds": 3600
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "audit",
|
||||
"secret": {
|
||||
"secretName": "informed-decision-audit",
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "token",
|
||||
"path": "token"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "Service",
|
||||
"metadata": {
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"type": "ClusterIP",
|
||||
"selector": {
|
||||
"app.kubernetes.io/name": "informed-decision",
|
||||
"app.kubernetes.io/component": "review"
|
||||
},
|
||||
"ports": [
|
||||
{
|
||||
"name": "http",
|
||||
"port": 80,
|
||||
"targetPort": "http",
|
||||
"protocol": "TCP"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "networking.k8s.io/v1",
|
||||
"kind": "NetworkPolicy",
|
||||
"metadata": {
|
||||
"name": "informed-decision-review",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision",
|
||||
"app.kubernetes.io/component": "review"
|
||||
}
|
||||
},
|
||||
"policyTypes": [
|
||||
"Ingress",
|
||||
"Egress"
|
||||
],
|
||||
"ingress": [
|
||||
{
|
||||
"from": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "kube-system"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "traefik"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8080
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"egress": [
|
||||
{
|
||||
"to": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "kube-system"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"k8s-app": "kube-dns"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "UDP",
|
||||
"port": 53
|
||||
},
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 53
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"to": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "approval-engine"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "approval-engine"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "audit-core"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "audit-core"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "flex-auth"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "flex-auth-informed-decision-sitting"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8080
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"to": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "kube-system"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "traefik"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8443
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"to": [
|
||||
{
|
||||
"ipBlock": {
|
||||
"cidr": "92.205.62.239/32"
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 443
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "networking.k8s.io/v1",
|
||||
"kind": "NetworkPolicy",
|
||||
"metadata": {
|
||||
"name": "informed-decision-review-ingress",
|
||||
"namespace": "approval-engine",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08",
|
||||
"informed-decision.coulomb.social/owner-review": "APPROVAL-WP-0002-T01"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "approval-engine"
|
||||
}
|
||||
},
|
||||
"policyTypes": [
|
||||
"Ingress"
|
||||
],
|
||||
"ingress": [
|
||||
{
|
||||
"from": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision",
|
||||
"app.kubernetes.io/component": "review"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8080
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "networking.k8s.io/v1",
|
||||
"kind": "NetworkPolicy",
|
||||
"metadata": {
|
||||
"name": "informed-decision-review-ingress",
|
||||
"namespace": "flex-auth",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08",
|
||||
"informed-decision.coulomb.social/owner-review": "INFD-WP-0001-T08 policy-owner return"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "flex-auth-informed-decision-sitting"
|
||||
}
|
||||
},
|
||||
"policyTypes": [
|
||||
"Ingress"
|
||||
],
|
||||
"ingress": [
|
||||
{
|
||||
"from": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision",
|
||||
"app.kubernetes.io/component": "review"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8080
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:ccca0b377bb8ba6af52a37edc453b5b51c96e380840ec8243ffaab3ac2170885",
|
||||
"policy": {
|
||||
"origin": "http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080",
|
||||
"package": "informed-decision.compact-sitting",
|
||||
"version": "v11",
|
||||
"package_digest": "sha256:4fd1961a2ab564a7b3306757ebd5c2c1487c33b29715a3bbf599ad9b79a48fa4",
|
||||
"pod_name": "flex-auth-informed-decision-sitting"
|
||||
},
|
||||
"keycape_egress_ips": [
|
||||
"92.205.62.239"
|
||||
],
|
||||
"storage_class": "local-path",
|
||||
"ordinary_approval_ids": [
|
||||
"2ce76d7f-01c3-4b63-8476-8d1230679769",
|
||||
"c2af4bcf-15b4-4305-aac1-acc7e4dcb099",
|
||||
"dc22666a-d5d7-46bc-9490-ebe9fe09dc38"
|
||||
]
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue