Adopt live flex-auth digests, record rename answers and NK-WP-0033 ruling
- runtime.yaml: declare the live flex-auth tenant-engine/user-engine digests confirmed by flex-auth, and mark the file reference-only (do not apply): live is ahead of it beyond the digests, including caller-auth enforce. - NK-WP-0039: T02 answered (package coordinate unchanged), T03 narrowed, new T04 to retire or reconcile the stale reference manifest. - NK-WP-0033: record the operator's predecessor-disposition ruling. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 299762@bnt-lap001 Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e
This commit is contained in:
parent
444f2b3fc3
commit
47c42f33fb
4 changed files with 65 additions and 8 deletions
|
|
@ -32,6 +32,7 @@
|
|||
| workplan | NK-WP-0036 | active | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| workplan | NK-WP-0037 | active | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
|
||||
| workplan | NK-WP-0038 | finished | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
|
||||
| workplan | NK-WP-0039 | active | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
|
||||
| task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md |
|
||||
| task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md |
|
||||
|
|
@ -141,6 +142,9 @@
|
|||
| task | NK-WP-0037-T02 | progress | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
|
||||
| task | NK-WP-0038-T01 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
|
||||
| task | NK-WP-0038-T02 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
|
||||
| task | NK-WP-0039-T01 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0039-T02 | wait | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0039-T03 | wait | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
|
||||
| intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
|
||||
| intake | NET-IN-0001 | open | — | intakes/intakes.md |
|
||||
|
|
|
|||
|
|
@ -1,3 +1,8 @@
|
|||
# REFERENCE ONLY - DO NOT APPLY. Not the runtime source of truth (ADR-0015).
|
||||
# flex-auth-* Deployments are owned by flex-auth (values/<consumer>.yaml) and
|
||||
# tenant-engine by its own repository. Live differs from this file beyond the
|
||||
# flex-auth image digests (caller-auth enforce args, tenant-engine image, PVC,
|
||||
# strategy, egress). Applying it would drop caller-auth enforcement. NK-WP-0039.
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata: {name: flex-auth, labels: {net-kingdom/component: flex-auth}}
|
||||
|
|
@ -19,7 +24,7 @@ spec:
|
|||
securityContext: {runAsNonRoot: true, seccompProfile: {type: RuntimeDefault}}
|
||||
containers:
|
||||
- name: flex-auth
|
||||
image: forgejo.coulomb.social/coulomb/flex-auth@sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa
|
||||
image: forgejo.coulomb.social/coulomb/flex-auth@sha256:05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd
|
||||
args: ["serve", "--addr", "0.0.0.0:8080", "--registry", "/opt/flex-auth/examples/tenant-engine/registry_snapshot.json", "--policy", "/opt/flex-auth/examples/tenant-engine/policy_package.md"]
|
||||
ports: [{name: http, containerPort: 8080}]
|
||||
securityContext: {allowPrivilegeEscalation: false, capabilities: {drop: ["ALL"]}, readOnlyRootFilesystem: true}
|
||||
|
|
@ -45,7 +50,7 @@ spec:
|
|||
securityContext: {runAsNonRoot: true, seccompProfile: {type: RuntimeDefault}}
|
||||
containers:
|
||||
- name: flex-auth
|
||||
image: forgejo.coulomb.social/coulomb/flex-auth@sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4
|
||||
image: forgejo.coulomb.social/coulomb/flex-auth@sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b
|
||||
args: ["serve", "--addr", "0.0.0.0:8080", "--registry", "/opt/flex-auth/examples/user-engine/registry_snapshot.json", "--policy", "/opt/flex-auth/examples/user-engine/policy_package.md"]
|
||||
ports: [{name: http, containerPort: 8080}]
|
||||
securityContext: {allowPrivilegeEscalation: false, capabilities: {drop: ["ALL"]}, readOnlyRootFilesystem: true}
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ owner: codex
|
|||
topic_slug: net-kingdom
|
||||
planning_priority: P0
|
||||
created: "2026-08-23"
|
||||
updated: "2026-08-23"
|
||||
updated: "2026-09-23"
|
||||
origin: routed
|
||||
origin_ref: "State Hub message 8cc44a39-683c-4fab-80dd-b2275d0728e0"
|
||||
related:
|
||||
|
|
@ -219,3 +219,15 @@ is why each partial fix appeared to change nothing.
|
|||
Remaining before T05 can close: a green receipt from the repaired script, and a
|
||||
ruling on whether a predecessor disposition observed but not receipted is an
|
||||
acceptable close for this incident.
|
||||
|
||||
### Operator ruling 2026-09-23 — predecessor disposition
|
||||
|
||||
The operator (Bernd Worsch) accepted the two recorded observations from
|
||||
2026-08-27 as the disposition of the exposed LLDAP predecessor: the WebUI
|
||||
lockout, and the `--check` run that passed `predecessor-denial`. A receipt
|
||||
cannot be produced because the value is unrecoverable. The incident closes
|
||||
once `reconcile-lldap-resolver-live.sh --check` emits a green receipt, and
|
||||
nothing else is required.
|
||||
|
||||
The custody gap (rotation does not retain the outgoing value) is a
|
||||
rotation-runbook fix. It is not a reason to reopen this incident.
|
||||
|
|
|
|||
|
|
@ -11,6 +11,7 @@ topic_slug: netkingdom
|
|||
created: "2026-09-23"
|
||||
updated: "2026-09-23"
|
||||
related: [FLEX-WP-0020, FLEX-DEC-2026-013, NK-WP-0026]
|
||||
state_hub_workstream_id: "284a8ac2-61dc-5bee-b74a-0a62d9808edb"
|
||||
---
|
||||
|
||||
Intake for the flex-auth handoff request (hub message `3bc95c76`, surface
|
||||
|
|
@ -29,6 +30,7 @@ rollout.
|
|||
id: NK-WP-0039-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "adfaa07d-dd15-50a6-a781-7cee2772fc90"
|
||||
```
|
||||
|
||||
Read-only check on railiance01 (node `92.205.62.239`) on 2026-09-23. The
|
||||
|
|
@ -57,16 +59,20 @@ the live ones.
|
|||
| `flex-auth-tenant-engine` | `c25fc34a…` | `05a03a87…` |
|
||||
| `flex-auth-user-engine` | `1f529037…` | `138aa347…` |
|
||||
|
||||
Which side is current has not been established. Reconciling them is a
|
||||
separate decision with flex-auth. Re-applying the declared file as it stands
|
||||
would replace the running images.
|
||||
Resolved 2026-09-23 (flex-auth reply `28d9c6ca`): live is correct. `05a03a87`
|
||||
was promoted 2026-09-11 for NK-WP-0036-T03 (flex-auth evidence
|
||||
`docs/evidence/2026-09-11-user-portal-tenant-policy.md`); `138aa347` has been
|
||||
live since 2026-08-19 (FLEX-WP-0015-T02). flex-auth's source of truth is
|
||||
`values/<consumer>.yaml` in flex-auth. `runtime.yaml` now declares the live
|
||||
digests. See T04 for the rest of the drift.
|
||||
|
||||
## Confirm the image-pull path survives the rename
|
||||
|
||||
```task
|
||||
id: NK-WP-0039-T02
|
||||
status: wait
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "73e98d7a-bff6-5111-93b1-f36938ab624f"
|
||||
```
|
||||
|
||||
The image path is `coulomb/flex-auth`, which is also the repository name.
|
||||
|
|
@ -77,7 +83,11 @@ Before the rename lands, flex-auth confirms one of these:
|
|||
- the package moves, and flex-auth names the new coordinate and the cut-over
|
||||
window.
|
||||
|
||||
Waiting on flex-auth under FLEX-WP-0020.
|
||||
Answered 2026-09-23 (flex-auth `28d9c6ca`): the package stays resolvable as
|
||||
`coulomb/flex-auth`. Forgejo packages are scoped to the owner, not the
|
||||
repository, and FLEX-WP-0020 keeps the package coordinate. There is no new
|
||||
coordinate and no cut-over window. FLEX-WP-0020 T09 verifies publication and
|
||||
pulls after the rename. The image pins do not change because of the rename.
|
||||
|
||||
## Update repository-coordinate references once access-engine resolves
|
||||
|
||||
|
|
@ -85,6 +95,7 @@ Waiting on flex-auth under FLEX-WP-0020.
|
|||
id: NK-WP-0039-T03
|
||||
status: wait
|
||||
priority: medium
|
||||
state_hub_task_id: "6e62919d-117d-57ab-b55b-1b437a105402"
|
||||
```
|
||||
|
||||
Once flex-auth announces that `coulomb/access-engine` resolves, update
|
||||
|
|
@ -93,3 +104,28 @@ changes, update the two image pins in `sso-mfa/k8s/tenant-engine/runtime.yaml`
|
|||
in the same change as the digest reconciliation from T01. Applying that live
|
||||
needs the founder's go-ahead. Leave runtime names and historical records
|
||||
unchanged.
|
||||
|
||||
After T02, no in-repo coordinate reference needs to change: the image pins
|
||||
stay, and NK-WP-0026 is a historical record. This task waits only for
|
||||
flex-auth's announcement that `access-engine` resolves, which confirms that
|
||||
nothing else moved.
|
||||
|
||||
## Retire or reconcile the stale flex-auth/tenant-engine reference manifest
|
||||
|
||||
```task
|
||||
id: NK-WP-0039-T04
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
A read-only `kubectl diff` of `sso-mfa/k8s/tenant-engine/runtime.yaml`
|
||||
against railiance01 on 2026-09-23 showed live ahead of the file beyond the
|
||||
digests. flex-auth runs with `--caller-auth-mode enforce` and caller
|
||||
bindings. tenant-engine runs image `a8e8086f…` (file: `2249e8c6…`) with a
|
||||
different strategy, PVC mount and env. The egress rules also differ. No script
|
||||
applies the file. It now carries a DO-NOT-APPLY header, because applying it
|
||||
would drop caller-auth enforcement.
|
||||
|
||||
Decide with flex-auth and tenant-engine whether NetKingdom keeps a reference
|
||||
copy. The recommendation is to replace it with pointers to the owners'
|
||||
declarations (ADR-0015) rather than reconcile it field by field.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue