coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0026 finished: user-engine caller identity verified live against railiance01

Browse source 
T02 done. Deployed user-engine digest c501aeb2 reads the projected flex-auth
token per decision (verified in the running container); flex-auth-user-engine
138aa347 serves with caller-auth enforce. Probes: valid 200
decision:d9aef25f08e17b84, missing token 401, wrong-system 403.

Closes manifest drift: runtime.yaml pinned e3b5f65b, the digest T01 warned
against, while the cluster ran c501aeb2. Re-applying it would have rolled the
portal back to an image that cannot authenticate to a PDP now in enforce.
kubectl diff is now empty.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-19 22:01:12 +02:00
parent dae0dc681a
commit 4a915ce6c7
5 changed files with 133 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

11
tests/test_user_engine_platform_expansion.py
View file

@ -19,11 +19,14 @@ class UserEnginePlatformExpansionContractTests(unittest.TestCase):
self.assertIn("dead-letter", text)
self.assertIn("OpenBao", text)
def test_live_manifest_does_not_enable_partial_integration(self):
def test_desired_manifest_authenticates_flex_auth_calls(self):
manifest = (ROOT / "sso-mfa/k8s/user-engine/runtime.yaml").read_text()
self.assertNotIn("USER_ENGINE_FLEX_AUTH_URL", manifest)
self.assertNotIn("USER_ENGINE_EVENT_URL", manifest)
self.assertNotIn("USER_ENGINE_MAIL_URL", manifest)
self.assertIn("USER_ENGINE_FLEX_AUTH_URL", manifest)
self.assertIn("USER_ENGINE_FLEX_AUTH_TOKEN_FILE", manifest)
self.assertIn("serviceAccountName: user-engine", manifest)
self.assertIn("audience: flex-auth", manifest)
self.assertIn("mountPath: /var/run/secrets/flex-auth-caller", manifest)
self.assertIn("automountServiceAccountToken: false", manifest)
if __name__ == "__main__":