diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index d433e63..b080cb3 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -135,7 +135,7 @@ | task | NK-WP-0036-T02 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | | task | NK-WP-0036-T03 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | | task | NK-WP-0036-T04 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | -| task | NK-WP-0036-T05 | todo | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| task | NK-WP-0036-T05 | progress | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | | task | NK-WP-0036-T06 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | | task | NK-WP-0037-T01 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md | | task | NK-WP-0037-T02 | progress | — | workplans/NK-WP-0037-vergabe-company-welcome.md | diff --git a/docs/identity-provisioner-bind-repair.md b/docs/identity-provisioner-bind-repair.md index 1c8731b..08e4aaf 100644 --- a/docs/identity-provisioner-bind-repair.md +++ b/docs/identity-provisioner-bind-repair.md @@ -75,5 +75,6 @@ NK-WP-0036-T05 adds `/readyz` as a contained provisioner-to-directory preflight `dependency_unavailable` JSON body, and keeps `/healthz` as process liveness. Auth rejection is not retried during a cooldown so kube probes cannot hammer a rejected password. Synthetic contract tests run in identity-journeys CI. -Promotion still requires the immutable image digest, switching readiness to -`/readyz`, and a native onboarding journey; see the T05 workplan note. +Image sha256:3317a2610ef9958b77cb258dce54d69d13dfabbc55ffaad673e018f997a6467c +is live with `/readyz` readiness; a native onboarding journey is still required +before T05 is done. See the T05 workplan note. diff --git a/sso-mfa/k8s/identity-provisioner/company-welcome.proposed.patch.yaml b/sso-mfa/k8s/identity-provisioner/company-welcome.proposed.patch.yaml index 7255cb6..75d6f77 100644 --- a/sso-mfa/k8s/identity-provisioner/company-welcome.proposed.patch.yaml +++ b/sso-mfa/k8s/identity-provisioner/company-welcome.proposed.patch.yaml @@ -3,7 +3,7 @@ spec: spec: containers: - name: provisioner - image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:698620e25cabccd746c10c332030e436428d184baab0f8270936494d285216a6 + image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:3317a2610ef9958b77cb258dce54d69d13dfabbc55ffaad673e018f997a6467c env: - name: PASSWORD_SETUP_TENANT_RETURNS value: '{"tenant:trial:demo-company":"https://vergabe-teilnahme.coulomb.social/demo-company/"}' diff --git a/sso-mfa/k8s/identity-provisioner/deployment.yaml b/sso-mfa/k8s/identity-provisioner/deployment.yaml index e7e6dc0..453fc0f 100644 --- a/sso-mfa/k8s/identity-provisioner/deployment.yaml +++ b/sso-mfa/k8s/identity-provisioner/deployment.yaml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/part-of: net-kingdom-sso-mfa spec: replicas: 1 + strategy: {type: Recreate} selector: matchLabels: {app.kubernetes.io/name: identity-provisioner} template: @@ -23,7 +24,7 @@ spec: seccompProfile: {type: RuntimeDefault} containers: - name: provisioner - image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:698620e25cabccd746c10c332030e436428d184baab0f8270936494d285216a6 + image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:3317a2610ef9958b77cb258dce54d69d13dfabbc55ffaad673e018f997a6467c imagePullPolicy: IfNotPresent ports: [{name: http, containerPort: 8080}] env: @@ -45,12 +46,11 @@ spec: resources: requests: {cpu: 25m, memory: 32Mi} limits: {cpu: 250m, memory: 128Mi} - # /healthz is process liveness only. After the T05 image is pinned, - # switch readiness to /readyz (timeoutSeconds >= 5) so a rejected - # directory bind takes the pod out of Service endpoints. readinessProbe: - httpGet: {path: /healthz, port: http} - periodSeconds: 10 + httpGet: {path: /readyz, port: http} + periodSeconds: 15 + timeoutSeconds: 5 + failureThreshold: 3 livenessProbe: httpGet: {path: /healthz, port: http} periodSeconds: 20 diff --git a/workplans/NK-WP-0036-restore-user-portal-client-registration.md b/workplans/NK-WP-0036-restore-user-portal-client-registration.md index 769049f..9f17ed6 100644 --- a/workplans/NK-WP-0036-restore-user-portal-client-registration.md +++ b/workplans/NK-WP-0036-restore-user-portal-client-registration.md @@ -156,26 +156,24 @@ single native onboarding journey. Preserve credential secrecy and avoid unbounded password-check retries. Actual demo users and application admission remain RAPPS-WP-0014 and VERGABE-WP-0019. -2026-09-14 agent implementation (not yet done): source now maps directory -HTTPError/URLError to redacted `{"error":"dependency_unavailable", -"dependency":"directory","reason":"auth_rejected|unreachable|protocol_error"}`. -`GET /healthz` remains process liveness; `GET /readyz` runs one login plus one -directory read. Auth rejection is cached for 30s so probes do not retry a -rejected password unbounded. 28 provider tests pass locally, including the new -directory-contract suite. identity-journeys CI discovers those tests; -identity-provisioner-image.yaml is the immutable publish lane. +2026-09-14: source maps directory HTTPError/URLError to redacted +`{"error":"dependency_unavailable","dependency":"directory","reason":"auth_rejected|unreachable|protocol_error"}`. +`GET /healthz` is process liveness; `GET /readyz` is one login plus one directory +read. Auth rejection is cached for 30s so probes do not retry a rejected +password unbounded. 28 provider tests pass locally. identity-journeys run 242 +and identity-provisioner-image run 243 succeeded for c8e0761. -Remaining operator steps before T05 can be marked done: -1. Push this commit to `main` so identity-journeys and identity-provisioner-image - run. Confirm journeys green, then record the image digest from - `coulomb/identity-provisioner`. -2. Pin that digest in `sso-mfa/k8s/identity-provisioner/deployment.yaml`, switch - readiness to `/readyz` with `timeoutSeconds: 5` or higher, keep liveness on - `/healthz`, apply, and confirm Ready 1/1 with `/readyz` returning - `{"status":"ready","dependency":"directory"}`. -3. Verify one native onboarding journey: provider login, user create/linkage, - password setup. Do not retry a rejected password in a loop. Demo users and - application admission stay RAPPS-WP-0014 and VERGABE-WP-0019. +Published and promoted image +`forgejo.coulomb.social/coulomb/identity-provisioner@sha256:3317a2610ef9958b77cb258dce54d69d13dfabbc55ffaad673e018f997a6467c` +(source c8e0761). Deployment uses Recreate so the packed single node can replace +the replica (RollingUpdate surge was Unschedulable: Insufficient cpu). Live +in-pod checks: `/healthz` 200 `{"status":"ok"}`; `/readyz` 200 +`{"status":"ready","dependency":"directory"}`. Resources remain 25m/32Mi. + +Remaining before T05 can be marked done: one native onboarding journey that +covers provider login, user create/linkage and password setup as a single +human attempt. Do not retry a rejected password in a loop. Demo users and +application admission stay RAPPS-WP-0014 and VERGABE-WP-0019. ## Admit the canonical users hostname and preserve callback validation