coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Deploy explicit Railiance admin role mapping for alert receipts
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 12s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e6f1-443f-7783-9920-a16b2ffc467f
This commit is contained in:
tegwick 2026-09-28 11:11:34 +02:00
parent 7896e99935
commit 019e8f21a7
2 changed files with 17 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

13
history/2026-09-28-telemetry-admin-role.md Normal file
View file

@ -0,0 +1,13 @@
# Railiance alert admin — 2026-09-28
Under existing RTEL-WP-0002-T04 user authorization, native identity-provisioner
verified tegwick email matches bernd.worsch@gmail.com and added railiance-admins,
preserving other memberships. KeyCape source 1164f65 maps only that explicit
group to railiance-admin; it does not imply platform-operator.
Owner deployment updated to published digest
sha256:6f79a2af1c695d39480173fad013facd84d21e7732860366af519302a2c496b8.
Server dry-run passed; diff showed only image and generated metadata changes.
Native rollout succeeded. Prior digest remains documented for rollback.
No Secret values were read. Real signed-role login and the telemetry OIDC client
registration remain pending under the existing telemetry task; no new workplan.

10
sso-mfa/k8s/keycape/deployment.yaml
View file

@ -51,12 +51,10 @@ spec:
containers: containers:
- name: keycape - name: keycape
# Image published to the self-hosted Forgejo OCI registry (KEY-WP-0002). # Image published to the self-hosted Forgejo OCI registry (KEY-WP-0002).
# key-cape@8be8065: the provider-metadata/JWKS discovery fetch now # key-cape@1164f65: explicit railiance-admins group maps to
# carries the same split-horizon X-Forwarded-Proto/Host headers as # railiance-admin; retains the 8be8065 split-horizon discovery fix.
# the token exchange (ADHOC-2026-09-27-T02) -- the prior image # Rollback: sha256:61b5f222a35c6ee1dc0273ea581bdad3d8d98e58b2c37327ac169639252e8ef5
# (911e9de) broke every login on Authelia 4.38 without this. image: forgejo.coulomb.social/coulomb/key-cape@sha256:6f79a2af1c695d39480173fad013facd84d21e7732860366af519302a2c496b8
# Rollback: sha256:248e449a031c972529f829ff36aa3faa92f8894a41e873beadcb0de34e7c3b9e
image: forgejo.coulomb.social/coulomb/key-cape@sha256:61b5f222a35c6ee1dc0273ea581bdad3d8d98e58b2c37327ac169639252e8ef5
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
ports: ports: