Follow the access-engine CLI rename: ./cmd/flex-auth -> ./cmd/access-engine
FLEX-DEC-2026-020; the old path is a stub that exits 2. Runtime names unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 736651@bnt-lap001 Assistant-Session: f6189624-fd64-4109-b53e-f8a59ca8a2d8
This commit is contained in:
parent
e2174cebaf
commit
1c2d0c2cf6
4 changed files with 49 additions and 20 deletions
|
|
@ -19,7 +19,7 @@ back, and is refused when the caller is wrong.
|
|||
## Prerequisites
|
||||
|
||||
- **[owner: flex-auth]** A local checkout of `flex-auth` with Go, to run
|
||||
`go run ./cmd/flex-auth`. Read `access-engine/docs/decision-record-contract.md`.
|
||||
`go run ./cmd/access-engine`. Read `access-engine/docs/decision-record-contract.md`.
|
||||
- **[owner: your system's repo]** A system id and a list of the things it
|
||||
protects and the actions it performs on them.
|
||||
- **[owner: railiance-platform / package owner, ADR-0015]** A Kubernetes
|
||||
|
|
@ -53,10 +53,10 @@ consumer running with caller auth in `warn` mode is not protected.
|
|||
fixtures covering every allow and every denial branch, including wrong
|
||||
tenant, unknown subject and unknown action.
|
||||
4. **[owner: flex-auth]** Validate and load offline:
|
||||
`go run ./cmd/flex-auth validate -kind policy -file <policy_package.md>`
|
||||
then `go run ./cmd/flex-auth load-registry -file <registry_snapshot.json>`.
|
||||
`go run ./cmd/access-engine validate -kind policy -file <policy_package.md>`
|
||||
then `go run ./cmd/access-engine load-registry -file <registry_snapshot.json>`.
|
||||
5. **[owner: flex-auth]** Evaluate a check request locally:
|
||||
`go run ./cmd/flex-auth check -registry <registry_snapshot.json> -policy <policy_package.md> -request <request.json>`.
|
||||
`go run ./cmd/access-engine check -registry <registry_snapshot.json> -policy <policy_package.md> -request <request.json>`.
|
||||
A request is `tenant`, `subject`, `action`, `resource` and `context`. The
|
||||
result is a decision envelope (`flex-auth.decision-record.v1`) with
|
||||
`effect`, `reason`, and a deterministic decision `id`.
|
||||
|
|
|
|||
|
|
@ -82,7 +82,7 @@ stages:
|
|||
title: Confirm the prerequisites
|
||||
actor: operator
|
||||
owner: workstation
|
||||
description: "A flex-auth checkout with Go, to run go run ./cmd/flex-auth (flex-auth); kubectl access to the cluster through the k3s-api tunnel (ops-bridge); the live pin runs with --caller-auth-mode enforce and its bound ServiceAccount exists (package owner, ADR-0015)."
|
||||
description: "A flex-auth checkout with Go, to run go run ./cmd/access-engine (flex-auth); kubectl access to the cluster through the k3s-api tunnel (ops-bridge); the live pin runs with --caller-auth-mode enforce and its bound ServiceAccount exists (package owner, ADR-0015)."
|
||||
idempotent: idempotent
|
||||
verify:
|
||||
done_when: All three prerequisites hold
|
||||
|
|
@ -105,11 +105,11 @@ stages:
|
|||
owner: flex-auth
|
||||
requires: [read-manifest]
|
||||
uses: [flexauth_home, example]
|
||||
command: cd {{flexauth_home}} && go run ./cmd/flex-auth validate -kind policy -file {{example}}/policy_package.md
|
||||
command: cd {{flexauth_home}} && go run ./cmd/access-engine validate -kind policy -file {{example}}/policy_package.md
|
||||
idempotent: idempotent
|
||||
verify:
|
||||
done_when: validate exits 0
|
||||
command: cd {{flexauth_home}} && go run ./cmd/flex-auth validate -kind policy -file {{example}}/policy_package.md
|
||||
command: cd {{flexauth_home}} && go run ./cmd/access-engine validate -kind policy -file {{example}}/policy_package.md
|
||||
expect: exit-0
|
||||
- id: load-registry
|
||||
title: Load the registry snapshot offline
|
||||
|
|
@ -117,11 +117,11 @@ stages:
|
|||
owner: flex-auth
|
||||
requires: [validate-policy]
|
||||
uses: [flexauth_home, example]
|
||||
command: cd {{flexauth_home}} && go run ./cmd/flex-auth load-registry -file {{example}}/registry_snapshot.json
|
||||
command: cd {{flexauth_home}} && go run ./cmd/access-engine load-registry -file {{example}}/registry_snapshot.json
|
||||
idempotent: idempotent
|
||||
verify:
|
||||
done_when: load-registry exits 0
|
||||
command: cd {{flexauth_home}} && go run ./cmd/flex-auth load-registry -file {{example}}/registry_snapshot.json
|
||||
command: cd {{flexauth_home}} && go run ./cmd/access-engine load-registry -file {{example}}/registry_snapshot.json
|
||||
expect: exit-0
|
||||
- id: check-allow
|
||||
title: A permitted request is allowed
|
||||
|
|
@ -130,12 +130,12 @@ stages:
|
|||
requires: [load-registry]
|
||||
uses: [flexauth_home, example]
|
||||
command: |
|
||||
cd {{flexauth_home}} && go run ./cmd/flex-auth check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_allow_rotate.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
|
||||
cd {{flexauth_home}} && go run ./cmd/access-engine check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_allow_rotate.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
|
||||
idempotent: idempotent
|
||||
verify:
|
||||
done_when: The decision is allow with reason catalog_lane_policy_matched
|
||||
command: |
|
||||
cd {{flexauth_home}} && go run ./cmd/flex-auth check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_allow_rotate.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
|
||||
cd {{flexauth_home}} && go run ./cmd/access-engine check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_allow_rotate.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
|
||||
expect: output-contains
|
||||
contains: allow catalog_lane_policy_matched
|
||||
- id: check-wrong-tenant
|
||||
|
|
@ -145,12 +145,12 @@ stages:
|
|||
requires: [load-registry]
|
||||
uses: [flexauth_home, example]
|
||||
command: |
|
||||
cd {{flexauth_home}} && go run ./cmd/flex-auth check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_wrong_tenant.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
|
||||
cd {{flexauth_home}} && go run ./cmd/access-engine check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_wrong_tenant.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
|
||||
idempotent: idempotent
|
||||
verify:
|
||||
done_when: The decision is deny with reason wrong_tenant
|
||||
command: |
|
||||
cd {{flexauth_home}} && go run ./cmd/flex-auth check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_wrong_tenant.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
|
||||
cd {{flexauth_home}} && go run ./cmd/access-engine check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_wrong_tenant.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
|
||||
expect: output-contains
|
||||
contains: deny wrong_tenant
|
||||
- id: check-unknown-action
|
||||
|
|
@ -160,12 +160,12 @@ stages:
|
|||
requires: [load-registry]
|
||||
uses: [flexauth_home, example]
|
||||
command: |
|
||||
cd {{flexauth_home}} && go run ./cmd/flex-auth check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_revoke_not_an_action.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
|
||||
cd {{flexauth_home}} && go run ./cmd/access-engine check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_revoke_not_an_action.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
|
||||
idempotent: idempotent
|
||||
verify:
|
||||
done_when: The decision is deny with reason unknown_action
|
||||
command: |
|
||||
cd {{flexauth_home}} && go run ./cmd/flex-auth check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_revoke_not_an_action.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
|
||||
cd {{flexauth_home}} && go run ./cmd/access-engine check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_revoke_not_an_action.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
|
||||
expect: output-contains
|
||||
contains: deny unknown_action
|
||||
- id: check-unknown-subject
|
||||
|
|
@ -175,12 +175,12 @@ stages:
|
|||
requires: [load-registry]
|
||||
uses: [flexauth_home, example]
|
||||
command: |
|
||||
cd {{flexauth_home}} && go run ./cmd/flex-auth check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_unknown_subject.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
|
||||
cd {{flexauth_home}} && go run ./cmd/access-engine check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_unknown_subject.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
|
||||
idempotent: idempotent
|
||||
verify:
|
||||
done_when: The decision is deny with reason unknown_subject
|
||||
command: |
|
||||
cd {{flexauth_home}} && go run ./cmd/flex-auth check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_unknown_subject.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
|
||||
cd {{flexauth_home}} && go run ./cmd/access-engine check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_unknown_subject.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))"
|
||||
expect: output-contains
|
||||
contains: deny unknown_subject
|
||||
gates:
|
||||
|
|
@ -191,7 +191,7 @@ stages:
|
|||
downstream_risk: A policy that allows what it should deny, or denies for the wrong reason, makes the live caller tests meaningless.
|
||||
checks:
|
||||
- done_when: The policy package validates and the registry loads
|
||||
command: cd {{flexauth_home}} && go run ./cmd/flex-auth validate -kind policy -file {{example}}/policy_package.md && go run ./cmd/flex-auth load-registry -file {{example}}/registry_snapshot.json
|
||||
command: cd {{flexauth_home}} && go run ./cmd/access-engine validate -kind policy -file {{example}}/policy_package.md && go run ./cmd/access-engine load-registry -file {{example}}/registry_snapshot.json
|
||||
expect: exit-0
|
||||
- done_when: One allow and three denials (wrong tenant, unknown action, unknown subject) each gave the expected decision and reason
|
||||
expect: manual
|
||||
|
|
|
|||
|
|
@ -26,8 +26,9 @@ owner; do not recreate a frozen deployment copy here.
|
|||
These links assume sibling checkouts. The repository is `coulomb/access-engine`
|
||||
(formerly `coulomb/flex-auth`; same Forge ID, renamed under FLEX-WP-0020). The
|
||||
product and runtime names stay `flex-auth`: the `flex-auth` namespace, Service
|
||||
DNS, caller-token audience, `cmd/flex-auth`, the chart name and the OCI package
|
||||
coordinate `coulomb/flex-auth` are unchanged (FLEX-DEC-2026-013).
|
||||
DNS, caller-token audience, the chart name and the OCI package coordinate
|
||||
`coulomb/flex-auth` are unchanged (FLEX-DEC-2026-013). The CLI is now
|
||||
`cmd/access-engine`; `cmd/flex-auth` is a stub that exits 2 (FLEX-DEC-2026-020).
|
||||
|
||||
Ownership follows [ADR-0015](../../../docs/adr/ADR-0015-netkingdom-railiance-workload-packaging-and-relational-platform.md).
|
||||
Removing references requires no cluster apply or rollout. Do not use the
|
||||
|
|
|
|||
28
workplans/ADHOC-2026-10-10.md
Normal file
28
workplans/ADHOC-2026-10-10.md
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
---
|
||||
id: NK-WP-ADHOC-2026-10-10
|
||||
type: workplan
|
||||
title: "Follow the access-engine CLI rename"
|
||||
domain: infotech
|
||||
repo: net-kingdom
|
||||
status: finished
|
||||
owner: claude-code
|
||||
topic_slug: net-kingdom
|
||||
created: "2026-10-10"
|
||||
updated: "2026-10-10"
|
||||
---
|
||||
|
||||
## Replace `./cmd/flex-auth` with `./cmd/access-engine`
|
||||
|
||||
```task
|
||||
id: NK-WP-ADHOC-2026-10-10-T01
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
access-engine renamed its CLI (FLEX-DEC-2026-020, access-engine 0ced299,
|
||||
message `e2f1aac9`): `./cmd/flex-auth` is now a stub that exits 2. The
|
||||
protected-system runbook pack and tutorial now call `go run ./cmd/access-engine`
|
||||
(subcommands and flags unchanged), and the tenant-engine README no longer lists
|
||||
`cmd/flex-auth` among the unchanged runtime names. Runtime names (namespace,
|
||||
Service DNS, audience, chart, OCI package) stay `flex-auth` until FLEX-WP-0036.
|
||||
`make runbooks-validate` passes; historical records are left as they were.
|
||||
Loading…
Add table
Add a link
Reference in a new issue