coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Complete user-engine runtime custody
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source
This commit is contained in:
tegwick 2026-07-30 00:40:43 +02:00
parent a0bfb9c597
commit 39b71d6d96
5 changed files with 150 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

7
sso-mfa/k8s/user-engine/README.md
View file

@ -13,10 +13,13 @@ package read was verified without an image pull Secret; publishing still uses
the ExternalSecret-backed credential and temporary client state.
The CloudNativePG operator creates `user-engine-pg-app`, including its `uri`
field. `user-engine-runtime` contains only the generated edge marker and must
be replaced by an ExternalSecret before public exposure.
field. OpenBao is authoritative for the portal edge marker and provisioner
service token at `platform/workloads/user-engine/runtime`. The
`openbao-runtime.yaml` stores and ExternalSecrets deliver those values into the
existing namespaced Secret names without changing application interfaces.
```bash
kubectl apply -f openbao-runtime.yaml
kubectl apply -f runtime.yaml
kubectl -n user-engine rollout status deployment/user-engine
kubectl -n user-engine get cluster,pod,service,networkpolicy