Pin identity-provisioner digest and readiness to directory preflight

Promote CI image sha256:3317a2610ef9958b77cb258dce54d69d13dfabbc55ffaad673e018f997a6467c
with /readyz readiness and Recreate rollout. Live /healthz stays process
liveness; /readyz returned directory ready. Native onboarding remains for T05.

Assistant: grok
Assistant-Session: 01a09dc6-3f0e-78f1-a884-c8c703c24ddf

WORK-RECORDS.md

@@ -135,7 +135,7 @@
 | task | NK-WP-0036-T02 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
 | task | NK-WP-0036-T03 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
 | task | NK-WP-0036-T04 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
-| task | NK-WP-0036-T05 | todo | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
+| task | NK-WP-0036-T05 | progress | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
 | task | NK-WP-0036-T06 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
 | task | NK-WP-0037-T01 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
 | task | NK-WP-0037-T02 | progress | — | workplans/NK-WP-0037-vergabe-company-welcome.md |

docs/identity-provisioner-bind-repair.md

@@ -75,5 +75,6 @@ NK-WP-0036-T05 adds `/readyz` as a contained provisioner-to-directory preflight
 `dependency_unavailable` JSON body, and keeps `/healthz` as process liveness.
 Auth rejection is not retried during a cooldown so kube probes cannot hammer a
 rejected password. Synthetic contract tests run in identity-journeys CI.
-Promotion still requires the immutable image digest, switching readiness to
-`/readyz`, and a native onboarding journey; see the T05 workplan note.
+Image sha256:3317a2610ef9958b77cb258dce54d69d13dfabbc55ffaad673e018f997a6467c
+is live with `/readyz` readiness; a native onboarding journey is still required
+before T05 is done. See the T05 workplan note.

sso-mfa/k8s/identity-provisioner/company-welcome.proposed.patch.yaml

@@ -3,7 +3,7 @@ spec:
     spec:
       containers:
         - name: provisioner
-          image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:698620e25cabccd746c10c332030e436428d184baab0f8270936494d285216a6
+          image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:3317a2610ef9958b77cb258dce54d69d13dfabbc55ffaad673e018f997a6467c
           env:
             - name: PASSWORD_SETUP_TENANT_RETURNS
               value: '{"tenant:trial:demo-company":"https://vergabe-teilnahme.coulomb.social/demo-company/"}'

sso-mfa/k8s/identity-provisioner/deployment.yaml

@@ -9,6 +9,7 @@ metadata:
     app.kubernetes.io/part-of: net-kingdom-sso-mfa
 spec:
   replicas: 1
+  strategy: {type: Recreate}
   selector:
     matchLabels: {app.kubernetes.io/name: identity-provisioner}
   template:
@@ -23,7 +24,7 @@ spec:
         seccompProfile: {type: RuntimeDefault}
       containers:
         - name: provisioner
-          image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:698620e25cabccd746c10c332030e436428d184baab0f8270936494d285216a6
+          image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:3317a2610ef9958b77cb258dce54d69d13dfabbc55ffaad673e018f997a6467c
           imagePullPolicy: IfNotPresent
           ports: [{name: http, containerPort: 8080}]
           env:
@@ -45,12 +46,11 @@ spec:
           resources:
             requests: {cpu: 25m, memory: 32Mi}
             limits: {cpu: 250m, memory: 128Mi}
-          # /healthz is process liveness only. After the T05 image is pinned,
-          # switch readiness to /readyz (timeoutSeconds >= 5) so a rejected
-          # directory bind takes the pod out of Service endpoints.
           readinessProbe:
-            httpGet: {path: /healthz, port: http}
-            periodSeconds: 10
+            httpGet: {path: /readyz, port: http}
+            periodSeconds: 15
+            timeoutSeconds: 5
+            failureThreshold: 3
           livenessProbe:
             httpGet: {path: /healthz, port: http}
             periodSeconds: 20

workplans/NK-WP-0036-restore-user-portal-client-registration.md

@@ -156,26 +156,24 @@ single native onboarding journey. Preserve credential secrecy and avoid
 unbounded password-check retries. Actual demo users and application admission
 remain RAPPS-WP-0014 and VERGABE-WP-0019.
 
-2026-09-14 agent implementation (not yet done): source now maps directory
-HTTPError/URLError to redacted `{"error":"dependency_unavailable",
-"dependency":"directory","reason":"auth_rejected|unreachable|protocol_error"}`.
-`GET /healthz` remains process liveness; `GET /readyz` runs one login plus one
-directory read. Auth rejection is cached for 30s so probes do not retry a
-rejected password unbounded. 28 provider tests pass locally, including the new
-directory-contract suite. identity-journeys CI discovers those tests;
-identity-provisioner-image.yaml is the immutable publish lane.
+2026-09-14: source maps directory HTTPError/URLError to redacted
+`{"error":"dependency_unavailable","dependency":"directory","reason":"auth_rejected|unreachable|protocol_error"}`.
+`GET /healthz` is process liveness; `GET /readyz` is one login plus one directory
+read. Auth rejection is cached for 30s so probes do not retry a rejected
+password unbounded. 28 provider tests pass locally. identity-journeys run 242
+and identity-provisioner-image run 243 succeeded for c8e0761.
 
-Remaining operator steps before T05 can be marked done:
-1. Push this commit to `main` so identity-journeys and identity-provisioner-image
-   run. Confirm journeys green, then record the image digest from
-   `coulomb/identity-provisioner`.
-2. Pin that digest in `sso-mfa/k8s/identity-provisioner/deployment.yaml`, switch
-   readiness to `/readyz` with `timeoutSeconds: 5` or higher, keep liveness on
-   `/healthz`, apply, and confirm Ready 1/1 with `/readyz` returning
-   `{"status":"ready","dependency":"directory"}`.
-3. Verify one native onboarding journey: provider login, user create/linkage,
-   password setup. Do not retry a rejected password in a loop. Demo users and
-   application admission stay RAPPS-WP-0014 and VERGABE-WP-0019.
+Published and promoted image
+`forgejo.coulomb.social/coulomb/identity-provisioner@sha256:3317a2610ef9958b77cb258dce54d69d13dfabbc55ffaad673e018f997a6467c`
+(source c8e0761). Deployment uses Recreate so the packed single node can replace
+the replica (RollingUpdate surge was Unschedulable: Insufficient cpu). Live
+in-pod checks: `/healthz` 200 `{"status":"ok"}`; `/readyz` 200
+`{"status":"ready","dependency":"directory"}`. Resources remain 25m/32Mi.
+
+Remaining before T05 can be marked done: one native onboarding journey that
+covers provider login, user create/linkage and password setup as a single
+human attempt. Do not retry a rejected password in a loop. Demo users and
+application admission stay RAPPS-WP-0014 and VERGABE-WP-0019.
 
 
 ## Admit the canonical users hostname and preserve callback validation