coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Pin identity-provisioner digest and readiness to directory preflight
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Promote CI image sha256:3317a2610ef9958b77cb258dce54d69d13dfabbc55ffaad673e018f997a6467c
with /readyz readiness and Recreate rollout. Live /healthz stays process
liveness; /readyz returned directory ready. Native onboarding remains for T05.

Assistant: grok
Assistant-Session: 01a09dc6-3f0e-78f1-a884-c8c703c24ddf
This commit is contained in:
tegwick 2026-09-14 04:57:39 +02:00
parent 84c4225542
commit 8dc5050aa3
5 changed files with 28 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

36
workplans/NK-WP-0036-restore-user-portal-client-registration.md
View file

@ -156,26 +156,24 @@ single native onboarding journey. Preserve credential secrecy and avoid
unbounded password-check retries. Actual demo users and application admission
remain RAPPS-WP-0014 and VERGABE-WP-0019.
2026-09-14 agent implementation (not yet done): source now maps directory
HTTPError/URLError to redacted `{"error":"dependency_unavailable",
"dependency":"directory","reason":"auth_rejected|unreachable|protocol_error"}`.
`GET /healthz` remains process liveness; `GET /readyz` runs one login plus one
directory read. Auth rejection is cached for 30s so probes do not retry a
rejected password unbounded. 28 provider tests pass locally, including the new
directory-contract suite. identity-journeys CI discovers those tests;
identity-provisioner-image.yaml is the immutable publish lane.
2026-09-14: source maps directory HTTPError/URLError to redacted
`{"error":"dependency_unavailable","dependency":"directory","reason":"auth_rejected|unreachable|protocol_error"}`.
`GET /healthz` is process liveness; `GET /readyz` is one login plus one directory
read. Auth rejection is cached for 30s so probes do not retry a rejected
password unbounded. 28 provider tests pass locally. identity-journeys run 242
and identity-provisioner-image run 243 succeeded for c8e0761.
Remaining operator steps before T05 can be marked done:
1. Push this commit to `main` so identity-journeys and identity-provisioner-image
run. Confirm journeys green, then record the image digest from
`coulomb/identity-provisioner`.
2. Pin that digest in `sso-mfa/k8s/identity-provisioner/deployment.yaml`, switch
readiness to `/readyz` with `timeoutSeconds: 5` or higher, keep liveness on
`/healthz`, apply, and confirm Ready 1/1 with `/readyz` returning
`{"status":"ready","dependency":"directory"}`.
3. Verify one native onboarding journey: provider login, user create/linkage,
password setup. Do not retry a rejected password in a loop. Demo users and
application admission stay RAPPS-WP-0014 and VERGABE-WP-0019.
Published and promoted image
`forgejo.coulomb.social/coulomb/identity-provisioner@sha256:3317a2610ef9958b77cb258dce54d69d13dfabbc55ffaad673e018f997a6467c`
(source c8e0761). Deployment uses Recreate so the packed single node can replace
the replica (RollingUpdate surge was Unschedulable: Insufficient cpu). Live
in-pod checks: `/healthz` 200 `{"status":"ok"}`; `/readyz` 200
`{"status":"ready","dependency":"directory"}`. Resources remain 25m/32Mi.
Remaining before T05 can be marked done: one native onboarding journey that
covers provider login, user create/linkage and password setup as a single
human attempt. Do not retry a rejected password in a loop. Demo users and
application admission stay RAPPS-WP-0014 and VERGABE-WP-0019.
## Admit the canonical users hostname and preserve callback validation