From 019e8f21a744664e8a00614f1f63a5c558f0c4bf Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 28 Sep 2026 11:11:34 +0200 Subject: [PATCH] Deploy explicit Railiance admin role mapping for alert receipts Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0e6f1-443f-7783-9920-a16b2ffc467f --- history/2026-09-28-telemetry-admin-role.md | 13 +++++++++++++ sso-mfa/k8s/keycape/deployment.yaml | 10 ++++------ 2 files changed, 17 insertions(+), 6 deletions(-) create mode 100644 history/2026-09-28-telemetry-admin-role.md diff --git a/history/2026-09-28-telemetry-admin-role.md b/history/2026-09-28-telemetry-admin-role.md new file mode 100644 index 0000000..77e3579 --- /dev/null +++ b/history/2026-09-28-telemetry-admin-role.md @@ -0,0 +1,13 @@ +# Railiance alert admin — 2026-09-28 + +Under existing RTEL-WP-0002-T04 user authorization, native identity-provisioner +verified tegwick email matches bernd.worsch@gmail.com and added railiance-admins, +preserving other memberships. KeyCape source 1164f65 maps only that explicit +group to railiance-admin; it does not imply platform-operator. + +Owner deployment updated to published digest +sha256:6f79a2af1c695d39480173fad013facd84d21e7732860366af519302a2c496b8. +Server dry-run passed; diff showed only image and generated metadata changes. +Native rollout succeeded. Prior digest remains documented for rollback. +No Secret values were read. Real signed-role login and the telemetry OIDC client +registration remain pending under the existing telemetry task; no new workplan. diff --git a/sso-mfa/k8s/keycape/deployment.yaml b/sso-mfa/k8s/keycape/deployment.yaml index 2e48472..693de7e 100644 --- a/sso-mfa/k8s/keycape/deployment.yaml +++ b/sso-mfa/k8s/keycape/deployment.yaml @@ -51,12 +51,10 @@ spec: containers: - name: keycape # Image published to the self-hosted Forgejo OCI registry (KEY-WP-0002). - # key-cape@8be8065: the provider-metadata/JWKS discovery fetch now - # carries the same split-horizon X-Forwarded-Proto/Host headers as - # the token exchange (ADHOC-2026-09-27-T02) -- the prior image - # (911e9de) broke every login on Authelia 4.38 without this. - # Rollback: sha256:248e449a031c972529f829ff36aa3faa92f8894a41e873beadcb0de34e7c3b9e - image: forgejo.coulomb.social/coulomb/key-cape@sha256:61b5f222a35c6ee1dc0273ea581bdad3d8d98e58b2c37327ac169639252e8ef5 + # key-cape@1164f65: explicit railiance-admins group maps to + # railiance-admin; retains the 8be8065 split-horizon discovery fix. + # Rollback: sha256:61b5f222a35c6ee1dc0273ea581bdad3d8d98e58b2c37327ac169639252e8ef5 + image: forgejo.coulomb.social/coulomb/key-cape@sha256:6f79a2af1c695d39480173fad013facd84d21e7732860366af519302a2c496b8 imagePullPolicy: IfNotPresent ports: