coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0056: sso ingress for the bounded executor; README and handoff follow-up
All checks were successful
Build and Publish bounded-executor / build-and-push (push) Successful in 6s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Identity provider journey acceptance / provider (push) Successful in 37s
Details

Browse source 
netpol-sso.yaml admits only executor pods to LLDAP 17170, KeyCape 8080 and
Authelia 9091 (never LDAP 3890); test_netpol.py pins it. Prepared, not
applied. README reflects T13. Live reads: OpenBao open to all namespaces;
approval-engine and audit-core need pod-scoped rules (requested: hub messages
39a3bffa, deea5bf8).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
This commit is contained in:
tegwick 2026-10-31 18:27:30 +01:00
parent cd0ce905a2
commit 387f8b1c8b
4 changed files with 134 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

11
bounded-executor/README.md
View file

@ -2,7 +2,7 @@
Runs one founder-approved Bounded Execution Admission (`canon/standards/bounded-execution-admission_v0.1.md`)
exactly once. Founder decision 6d1adce9: net-kingdom writes the executor; `rapp-bounded-executor` deploys it as one
Job per admission in `sso` (T12).
Job per admission in `sso`.
`executor.py` is the core runner (T11):
@ -44,7 +44,14 @@ without guessing.
`synthetic_pilot.py` runs a rotation and a deliberate revert on the T08 stack plus OpenBao:
`uv run bounded-executor/synthetic_pilot.py`.
T13 adds the CLI, the Containerfile, the image workflow and the rapp package.
`cli.py` (T13) is the Job's entry point: one admission, one approval id, a non-secret config. Exit codes: `0`
completed, `3` reverted, `4` refused before any effect, `5` stopped, unknown or failed revert, `6` consumed but not in
custody. `Containerfile` builds the image, which `.forgejo/workflows/bounded-executor-image.yaml` publishes by digest.
Deployment is in `rapp-bounded-executor`, which pins the digest and renders one ConfigMap and Job per admission
(`make run`, founder-run). That package also holds the ServiceAccount and Role, copied from
`sso-mfa/k8s/bounded-executor/rbac.yaml`, and the executor's egress-only NetworkPolicy. The receiving side in `sso` is
`allow-bounded-executor-to-*` in `sso-mfa/k8s/network-policies/netpol-sso.yaml`.
```bash
python3 -m pytest bounded-executor/tests # or: make bounded-executor-test