coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0056-T16 done: both owner ingress rules live; netcheck reaches every endpoint
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 523928@bnt-lap001
Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350
This commit is contained in:
tegwick 2026-11-04 07:10:42 +01:00
parent 7cc69d194a
commit 03836dd1f8
3 changed files with 21 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -358,7 +358,7 @@
| task | NK-WP-0056-T13 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
| task | NK-WP-0056-T14 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
| task | NK-WP-0056-T15 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
| task | NK-WP-0056-T16 | wait | — | workplans/NK-WP-0056-bounded-executor-path.md |
| task | NK-WP-0056-T16 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
| task | NK-WP-0056-T17 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
| task | NK-WP-0056-T18 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
| task | NK-WP-0056-T19 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |

15
docs/evidence/2026-11-04-nk56-t16-owner-ingress/README.md Normal file
View file

@ -0,0 +1,15 @@
# NK-WP-0056-T16: owner ingress for the executor pod, live (2026-11-04)
Founder-run, guided by claude-code (T06 runbook section 1). Each policy object was applied on its own, server
dry-run first.
| Step | Result |
| --- | --- |
| approval-engine `approval-engine-bounded-executor` (source `e9e9f93`) | created. Read back: only `sso` pods labelled `app.kubernetes.io/name=bounded-executor`, TCP 8080 (one ANDed peer) |
| audit-core `audit-core-nk-bounded-executor-ingress` (source `7728fde`) | created |
| audit-core live scope ConfigMap | `nk-bounded-executor`: source `net-kingdom.bounded-executor`, tenants `[platform]`, write-only, `reject`, load-bearing, closing class within 7200 s |
| audit-core receiver image | `sha256:5f3d01c8…71a6` (AUDIT-WP-0018-T03 release) |
| rapp `make netcheck` (image `2926d7d9`, executor labels, no token) | t=0: all refused (k3s applies NetworkPolicy about 3 s after pod start, known since T10); from t=3.1 s to 43.3 s, 14 rows, all `openbao_health` 200, `approval_engine_health` 200, `audit_core_health` 200, `informed_decision_tcp` ok, `keycape_tcp` ok, `authelia_tcp` ok |
Network admission is not authority. The executor still needs its KeyCape token (approval-engine) and its sender
bearer (audit-core): T06 sections 3 and 4.

7
workplans/NK-WP-0056-bounded-executor-path.md
View file

@ -880,10 +880,9 @@ audit-core accepts the `started` event and the receipt only from a registered se
```task
id: NK-WP-0056-T16
status: wait
status: done
priority: medium
assignee: claude-code
blocked_on: human
depends_on: [NK-WP-0056-T10]
state_hub_task_id: "a08c6b82-be3f-5dca-82f7-b2a0ced6b335"
```
@ -902,6 +901,10 @@ executor pod.
- Founder steps: T06 runbook (`sso-mfa/k8s/bounded-executor/T06-PILOT-RUNBOOK.md`) section 1. Each object is applied
on its own, because live approval-engine has a policy that its file lacks.
**Done 2026-11-04** ([evidence](../docs/evidence/2026-11-04-nk56-t16-owner-ingress/README.md)). The founder applied
both rules. `make netcheck` from an executor-labelled pod reaches approval-engine and audit-core (`/healthz` 200),
informed-decision:8081, OpenBao, KeyCape and Authelia from 3 s on.
## Founder approval path at aal2
```task