Integrate verified State Hub dispatcher into lifecycle release
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
parent
4898c9b764
commit
c084600082
10 changed files with 361 additions and 16 deletions
|
|
@ -15,7 +15,8 @@ humans and system:serviceaccount:state-hub:state-hub. **Not deployed.**
|
|||
sibling JSON registries. The policy YAML is Helm-rendered from Access Engine's
|
||||
FLEX-WP-0033 candidate values; it is a review artifact, not a second deployment
|
||||
owner. Existing Helm releases must be updated through their owning workflow.
|
||||
All 25 proposed objects passed Kubernetes server dry-run against railiance01.
|
||||
The original 25 objects and the three dispatcher objects passed Kubernetes
|
||||
server dry-run against railiance01.
|
||||
No Secret is included. Dry-run does not test reachability, credential delivery,
|
||||
policy caller identity, backup restoration or a human disposition.
|
||||
|
||||
|
|
@ -46,10 +47,11 @@ contract; neither is presented as a newly enforced control.
|
|||
under its separate live go, with exact identity/path negative proofs and
|
||||
mounted-file refresh/rotation evidence. Only the audit ExternalSecret was
|
||||
present in the live namespace at inspection.
|
||||
2. INFD-WP-0005-T08: State Hub owner supplies production forwarding and separate
|
||||
lifecycle/intake audience token projections. Its current dev fixture is not
|
||||
an activated forwarder. Confirm notification receiver reachability; keep
|
||||
resolution write-back disabled until its owner admission.
|
||||
2. INFD-WP-0005-T08 / STATE-WP-0096: the private dispatcher and separate
|
||||
lifecycle/intake token projections are prepared in dispatcher.candidate.json.
|
||||
Deploy after intake prerequisites. Explicit enqueue requires trusted workload
|
||||
execution; there is no new public delegate endpoint. Confirm notification
|
||||
receiver reachability; keep resolution write-back disabled.
|
||||
3. Refresh live image/config pins and unresolved-entry counts; complete the
|
||||
backup/restore steps below; obtain explicit approval of this concrete rollout.
|
||||
INFD-WP-0007-T07 and CCR-2026-0032 require this distinct go.
|
||||
|
|
@ -98,3 +100,22 @@ broader browser packet/binding profiles remain explicit workplan tasks.
|
|||
The final Access Engine pin is the Forgejo image built from commit d2d0b6f
|
||||
(run https://forgejo.coulomb.social/coulomb/access-engine/actions/runs/316).
|
||||
It supersedes the locally built candidate for the proposed deployment.
|
||||
|
||||
|
||||
## Private State Hub dispatcher continuation
|
||||
|
||||
The dispatcher is a separate Recreate workload with 5m CPU / 24Mi memory requests,
|
||||
one private 1Gi PVC, no Service/Ingress, and the existing state-hub service account.
|
||||
Its only egress is DNS and the exact informed-decision peer on 8081. Projected
|
||||
lifecycle and intake tokens each expire after 600 seconds. The dispatcher reads
|
||||
only the intake token and never binds. Its pod omits app=state-hub, so it is not
|
||||
selected by the existing Hub API Service.
|
||||
|
||||
Image: forgejo.coulomb.social/coulomb/state-hub-memo-dispatch@sha256:410fb6b6c9fd7a7ee0b63d727fd3249fb3ae13943421d6a5ce88b7ad2520bd2f
|
||||
Source: State Hub 4a59b23, built by the dedicated Forgejo workflow.
|
||||
Source integration proves queue/restart/lost-reply handling (one create, replayed
|
||||
receipt), subsequent human acceptance and independent audit delivery. All identity
|
||||
and credential inputs in that test are synthetic. Native acceptance remains open.
|
||||
|
||||
There is no new service-image build for this continuation. The service suite now
|
||||
passes 663 tests (1 skipped); State Hub forwarding/notification tests pass 28.
|
||||
|
|
|
|||
214
deploy/lifecycle/dispatcher.candidate.json
Normal file
214
deploy/lifecycle/dispatcher.candidate.json
Normal file
|
|
@ -0,0 +1,214 @@
|
|||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "List",
|
||||
"items": [
|
||||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "PersistentVolumeClaim",
|
||||
"metadata": {
|
||||
"name": "state-hub-memo-dispatch",
|
||||
"namespace": "state-hub",
|
||||
"annotations": {
|
||||
"state-hub.coulomb.social/admission": "proposal; STATE-WP-0096 / INFD-WP-0007 approved rollout required"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"accessModes": [
|
||||
"ReadWriteOnce"
|
||||
],
|
||||
"storageClassName": "local-path",
|
||||
"resources": {
|
||||
"requests": {
|
||||
"storage": "1Gi"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "apps/v1",
|
||||
"kind": "Deployment",
|
||||
"metadata": {
|
||||
"name": "state-hub-memo-dispatch",
|
||||
"namespace": "state-hub",
|
||||
"annotations": {
|
||||
"state-hub.coulomb.social/admission": "proposal; STATE-WP-0096 / INFD-WP-0007 approved rollout required"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"replicas": 1,
|
||||
"strategy": {
|
||||
"type": "Recreate"
|
||||
},
|
||||
"selector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "state-hub",
|
||||
"app.kubernetes.io/component": "memo-dispatch"
|
||||
}
|
||||
},
|
||||
"template": {
|
||||
"metadata": {
|
||||
"labels": {
|
||||
"app.kubernetes.io/name": "state-hub",
|
||||
"app.kubernetes.io/component": "memo-dispatch"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"serviceAccountName": "state-hub",
|
||||
"automountServiceAccountToken": false,
|
||||
"terminationGracePeriodSeconds": 15,
|
||||
"securityContext": {
|
||||
"runAsNonRoot": true,
|
||||
"runAsUser": 10001,
|
||||
"runAsGroup": 10001,
|
||||
"fsGroup": 10001,
|
||||
"fsGroupChangePolicy": "OnRootMismatch",
|
||||
"seccompProfile": {
|
||||
"type": "RuntimeDefault"
|
||||
}
|
||||
},
|
||||
"containers": [
|
||||
{
|
||||
"name": "dispatcher",
|
||||
"image": "forgejo.coulomb.social/coulomb/state-hub-memo-dispatch@sha256:410fb6b6c9fd7a7ee0b63d727fd3249fb3ae13943421d6a5ce88b7ad2520bd2f",
|
||||
"securityContext": {
|
||||
"allowPrivilegeEscalation": false,
|
||||
"readOnlyRootFilesystem": true,
|
||||
"capabilities": {
|
||||
"drop": [
|
||||
"ALL"
|
||||
]
|
||||
}
|
||||
},
|
||||
"resources": {
|
||||
"requests": {
|
||||
"cpu": "5m",
|
||||
"memory": "24Mi"
|
||||
},
|
||||
"limits": {
|
||||
"cpu": "100m",
|
||||
"memory": "96Mi"
|
||||
}
|
||||
},
|
||||
"volumeMounts": [
|
||||
{
|
||||
"name": "queue",
|
||||
"mountPath": "/data"
|
||||
},
|
||||
{
|
||||
"name": "intake-caller",
|
||||
"mountPath": "/var/run/secrets/state-hub/informed-decision",
|
||||
"readOnly": true
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"volumes": [
|
||||
{
|
||||
"name": "queue",
|
||||
"persistentVolumeClaim": {
|
||||
"claimName": "state-hub-memo-dispatch"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "intake-caller",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"audience": "informed-decision-intake",
|
||||
"expirationSeconds": 600,
|
||||
"path": "intake-token"
|
||||
}
|
||||
},
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"audience": "informed-decision-lifecycle",
|
||||
"expirationSeconds": 600,
|
||||
"path": "lifecycle-token"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "networking.k8s.io/v1",
|
||||
"kind": "NetworkPolicy",
|
||||
"metadata": {
|
||||
"name": "state-hub-memo-dispatch",
|
||||
"namespace": "state-hub",
|
||||
"annotations": {
|
||||
"state-hub.coulomb.social/admission": "proposal; STATE-WP-0096 / INFD-WP-0007 approved rollout required"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "state-hub",
|
||||
"app.kubernetes.io/component": "memo-dispatch"
|
||||
}
|
||||
},
|
||||
"policyTypes": [
|
||||
"Ingress",
|
||||
"Egress"
|
||||
],
|
||||
"ingress": [],
|
||||
"egress": [
|
||||
{
|
||||
"to": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "kube-system"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"k8s-app": "kube-dns"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "UDP",
|
||||
"port": 53
|
||||
},
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 53
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"to": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8081
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue