From 0db2e1404d33c4b958a7060ac65f815e10ef749d Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 1 Oct 2026 21:38:03 +0200 Subject: [PATCH] NK-WP-0039-T04: retire runtime.yaml to owner pointers; finish NK-WP-0039 tenant-engine disposition TEN-DEC-2026-003. Co-Authored-By: Claude Sonnet 5.5 Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 6969@bnt-lap001 Assistant-Session: e8ae73f2-8385-4c9c-b714-94c3c52cdbc0 --- sso-mfa/k8s/README.md | 5 +- sso-mfa/k8s/tenant-engine/README.md | 17 +++-- sso-mfa/k8s/tenant-engine/runtime.yaml | 75 +++---------------- ...ex-auth-access-engine-coordinate-intake.md | 17 +++-- 4 files changed, 34 insertions(+), 80 deletions(-) diff --git a/sso-mfa/k8s/README.md b/sso-mfa/k8s/README.md index 40af842..e8586ee 100644 --- a/sso-mfa/k8s/README.md +++ b/sso-mfa/k8s/README.md @@ -54,9 +54,8 @@ verification and recovery procedure for those claims. Start with the owning package's current declaration, immutable image and reviewed rollout/rollback procedure. Do not recursively apply this tree. -`tenant-engine/runtime.yaml` remains **REFERENCE ONLY — DO NOT APPLY** while -its owner decides the disposition of the five retained historical objects. -Its obsolete flex-auth objects have been replaced with owner pointers. +`tenant-engine/runtime.yaml` is retired (NK-WP-0039-T04) and holds owner pointers only, no +objects; the Tenant Engine and flex-auth declarations live with their owners. The scripts and manifests elsewhere in this directory have individual scopes; their presence here does not make them current production repair commands. diff --git a/sso-mfa/k8s/tenant-engine/README.md b/sso-mfa/k8s/tenant-engine/README.md index 05b8d9f..361cb9d 100644 --- a/sso-mfa/k8s/tenant-engine/README.md +++ b/sso-mfa/k8s/tenant-engine/README.md @@ -1,13 +1,16 @@ # Tenant Engine integration references -`runtime.yaml` is **REFERENCE ONLY — DO NOT APPLY**. Its five remaining -Tenant Engine objects are historical and differ from the live deployment in -image, storage, strategy, environment and egress. Their disposition awaits the -Tenant Engine owner under -[NK-WP-0039-T04](../../../workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md). +`runtime.yaml` is **retired** and now holds pointers only, no Kubernetes +objects (NK-WP-0039-T04, 2026-10-01). NetKingdom does not own the Tenant Engine +or flex-auth runtime (ADR-0015); do not recreate a copy here. -The obsolete flex-auth objects were removed on 2026-09-28 with the owner's -agreement. Use the owner's maintained declarations and deployment procedure: +Tenant Engine: [`deploy/base/tenant-engine.yaml`](../../../../tenant-engine/deploy/base/tenant-engine.yaml) +(`kubectl apply -k deploy/`) with the promotion contract in +[`railiance/app.toml`](../../../../tenant-engine/railiance/app.toml) +(TEN-DEC-2026-003). + +The flex-auth objects were removed on 2026-09-28 with the owner's +agreement. For flex-auth consumers use the owner's maintained declarations and deployment procedure: | Consumer | Authoritative values in the flex-auth repository | | --- | --- | diff --git a/sso-mfa/k8s/tenant-engine/runtime.yaml b/sso-mfa/k8s/tenant-engine/runtime.yaml index 779f8b9..75025a0 100644 --- a/sso-mfa/k8s/tenant-engine/runtime.yaml +++ b/sso-mfa/k8s/tenant-engine/runtime.yaml @@ -1,68 +1,13 @@ -# REFERENCE ONLY - DO NOT APPLY. Not the runtime source of truth (ADR-0015). -# Only historical tenant-engine objects remain, pending its owner's disposition. -# Live tenant-engine differs in image, storage, strategy, environment and egress. -# The obsolete flex-auth objects were removed under NK-WP-0039-T04. -# Authoritative flex-auth declarations (repository: coulomb/access-engine, formerly flex-auth): +# RETIRED - POINTERS ONLY. This file holds no Kubernetes objects. DO NOT APPLY. +# NetKingdom does not own the tenant-engine or flex-auth runtime (ADR-0015). +# Retired 2026-10-01 under NK-WP-0039-T04 with both owners' agreement. +# +# tenant-engine (TEN-DEC-2026-003, tenant-engine@6c137c1): +# declaration: tenant-engine/deploy/base/tenant-engine.yaml +# (kubectl apply -k deploy/, TEN-WP-0008) +# promotion contract: tenant-engine/railiance/app.toml +# flex-auth consumers (repository: coulomb/access-engine, formerly flex-auth): # values/tenant-engine.yaml # values/user-engine.yaml # Rendered by that repository's charts/flex-auth, including caller enforcement. -# See README.md for owner links, retained runtime names and the remaining gate. -apiVersion: v1 -kind: Namespace -metadata: {name: tenant-engine, labels: {net-kingdom/component: tenant-engine}} ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: {name: tenant-engine-data, namespace: tenant-engine} -spec: {accessModes: [ReadWriteOnce], resources: {requests: {storage: 1Gi}}} ---- -apiVersion: apps/v1 -kind: Deployment -metadata: {name: tenant-engine, namespace: tenant-engine} -spec: - replicas: 1 - strategy: {type: Recreate} - selector: {matchLabels: {app.kubernetes.io/name: tenant-engine}} - template: - metadata: {labels: {app.kubernetes.io/name: tenant-engine}} - spec: - automountServiceAccountToken: false - securityContext: {runAsNonRoot: true, fsGroup: 10001, seccompProfile: {type: RuntimeDefault}} - containers: - - name: tenant-engine - image: forgejo.coulomb.social/coulomb/tenant-engine@sha256:2249e8c6ee44ae36081cddc52daf9c3f63acd18a95a5d620ab4fa7ac85149207 - ports: [{name: http, containerPort: 8090}] - env: - - {name: TENANT_ENGINE_DATABASE_PATH, value: /data/tenant-engine.db} - - {name: TENANT_ENGINE_FLEX_AUTH_URL, value: "http://flex-auth-tenant-engine.flex-auth.svc.cluster.local:8080"} - volumeMounts: [{name: data, mountPath: /data}] - securityContext: {allowPrivilegeEscalation: false, capabilities: {drop: ["ALL"]}, readOnlyRootFilesystem: true} - resources: {requests: {cpu: 25m, memory: 48Mi}, limits: {cpu: 300m, memory: 192Mi}} - readinessProbe: {httpGet: {path: /health, port: http}, periodSeconds: 5} - livenessProbe: {httpGet: {path: /health, port: http}, periodSeconds: 20} - volumes: [{name: data, persistentVolumeClaim: {claimName: tenant-engine-data}}] ---- -apiVersion: v1 -kind: Service -metadata: {name: tenant-engine, namespace: tenant-engine} -spec: {selector: {app.kubernetes.io/name: tenant-engine}, ports: [{name: http, port: 8090, targetPort: http}]} ---- -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: {name: tenant-engine, namespace: tenant-engine} -spec: - podSelector: {matchLabels: {app.kubernetes.io/name: tenant-engine}} - policyTypes: [Ingress, Egress] - ingress: - - from: - - namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: user-engine}} - podSelector: {matchLabels: {app.kubernetes.io/name: user-engine}} - ports: [{protocol: TCP, port: 8090}] - egress: - - to: - - namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: flex-auth}} - podSelector: {matchLabels: {app.kubernetes.io/name: flex-auth-tenant-engine}} - ports: [{protocol: TCP, port: 8080}] - - to: - - namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: kube-system}} - ports: [{protocol: UDP, port: 53}, {protocol: TCP, port: 53}] +# See README.md for owner links and retained runtime names. diff --git a/workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md b/workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md index 870ecab..af85aaa 100644 --- a/workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md +++ b/workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md @@ -4,12 +4,12 @@ type: workplan title: "Take in the flex-auth to access-engine repository-coordinate rename" domain: infotech repo: net-kingdom -status: blocked +status: finished flavor: implementation owner: claude-code topic_slug: netkingdom created: "2026-09-23" -updated: "2026-09-28" +updated: "2026-10-01" related: [FLEX-WP-0020, FLEX-DEC-2026-013, NK-WP-0026] state_hub_workstream_id: "284a8ac2-61dc-5bee-b74a-0a62d9808edb" --- @@ -113,9 +113,7 @@ runtime/package names. NK-WP-0026 remains a historical record. ```task id: NK-WP-0039-T04 -status: wait -blocked_on: message-from:flex-auth -blocking_reason: "Retire-vs-reconcile answer routed to flex-auth (2c637dc9) and tenant-engine (9fc740da); act on whichever returns, do not pre-empt." +status: done priority: high state_hub_task_id: "2541f523-e433-5900-b119-5825f0e71ef3" ``` @@ -197,3 +195,12 @@ pack reads resolve there. Runtime and package names are untouched (`flex-auth` n audience, `cmd/flex-auth`, chart, `coulomb/flex-auth` image); no rollout. Historical records keep the old name. The three owned workloads were ready 1/1 after the change. T04 still waits on tenant-engine. + +## tenant-engine disposition — 2026-10-01 + +tenant-engine answered (`f074729d-41f8-4c5b-a9e0-5189aad78a8f`): retire, recorded as TEN-DEC-2026-003 +(tenant-engine@6c137c1). The five remaining tenant-engine objects are gone from +`sso-mfa/k8s/tenant-engine/runtime.yaml`, which now holds pointers only (it parses as no documents): +`tenant-engine/deploy/base/tenant-engine.yaml`, `tenant-engine/railiance/app.toml` and the access-engine +values files. Nothing here consumed the file. The README and `sso-mfa/k8s/README.md` say so and every link +resolves. No cluster change. T04 is closed and every task is done, so the plan is `finished`.