coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Adopt live flex-auth digests, record rename answers and NK-WP-0033 ruling
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
- runtime.yaml: declare the live flex-auth tenant-engine/user-engine digests
  confirmed by flex-auth, and mark the file reference-only (do not apply):
  live is ahead of it beyond the digests, including caller-auth enforce.
- NK-WP-0039: T02 answered (package coordinate unchanged), T03 narrowed,
  new T04 to retire or reconcile the stale reference manifest.
- NK-WP-0033: record the operator's predecessor-disposition ruling.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e
This commit is contained in:
tegwick 2026-09-23 20:01:30 +02:00
parent 444f2b3fc3
commit 47c42f33fb
4 changed files with 65 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

9
sso-mfa/k8s/tenant-engine/runtime.yaml
View file

@ -1,3 +1,8 @@
# REFERENCE ONLY - DO NOT APPLY. Not the runtime source of truth (ADR-0015).
# flex-auth-* Deployments are owned by flex-auth (values/<consumer>.yaml) and
# tenant-engine by its own repository. Live differs from this file beyond the
# flex-auth image digests (caller-auth enforce args, tenant-engine image, PVC,
# strategy, egress). Applying it would drop caller-auth enforcement. NK-WP-0039.
apiVersion: v1
kind: Namespace
metadata: {name: flex-auth, labels: {net-kingdom/component: flex-auth}}
@ -19,7 +24,7 @@ spec:
securityContext: {runAsNonRoot: true, seccompProfile: {type: RuntimeDefault}}
containers:
- name: flex-auth
image: forgejo.coulomb.social/coulomb/flex-auth@sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa
image: forgejo.coulomb.social/coulomb/flex-auth@sha256:05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd
args: ["serve", "--addr", "0.0.0.0:8080", "--registry", "/opt/flex-auth/examples/tenant-engine/registry_snapshot.json", "--policy", "/opt/flex-auth/examples/tenant-engine/policy_package.md"]
ports: [{name: http, containerPort: 8080}]
securityContext: {allowPrivilegeEscalation: false, capabilities: {drop: ["ALL"]}, readOnlyRootFilesystem: true}
@ -45,7 +50,7 @@ spec:
securityContext: {runAsNonRoot: true, seccompProfile: {type: RuntimeDefault}}
containers:
- name: flex-auth
image: forgejo.coulomb.social/coulomb/flex-auth@sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4
image: forgejo.coulomb.social/coulomb/flex-auth@sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b
args: ["serve", "--addr", "0.0.0.0:8080", "--registry", "/opt/flex-auth/examples/user-engine/registry_snapshot.json", "--policy", "/opt/flex-auth/examples/user-engine/policy_package.md"]
ports: [{name: http, containerPort: 8080}]
securityContext: {allowPrivilegeEscalation: false, capabilities: {drop: ["ALL"]}, readOnlyRootFilesystem: true}