coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Complete reversible identity retirement
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source
This commit is contained in:
tegwick 2026-07-30 09:28:05 +02:00
parent 91a1acad8c
commit d975086ef0
2 changed files with 26 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
WORK-RECORDS.md
View file

@ -47,8 +47,8 @@
| task | NK-WP-0022-T03 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
| task | NK-WP-0022-T04 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
| task | NK-WP-0022-T05 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
| task | NK-WP-0022-T06 | progress | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
| task | NK-WP-0022-T07 | wait | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
| task | NK-WP-0022-T06 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
| task | NK-WP-0022-T07 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
| task | NK-WP-0022-T08 | wait | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
| task | NK-WP-0023-T01 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
| task | NK-WP-0023-T02 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |

26
workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md
View file

@ -219,7 +219,7 @@ client tests and TLS/discovery evidence, pre-cutover conformance passes.
```task
id: NK-WP-0022-T06
status: progress
status: done
priority: high
state_hub_task_id: "00bfa48b-28de-4b8e-b3da-715c797beae5"
```
@ -249,11 +249,20 @@ returned generic OpenBao/login/SSH routes, not provider DNS authority.
Consequently T06 remains in progress on one explicit operator DNS change and
its observation window, rather than being closed cosmetically.
2026-07-30 completion: the operator moved `lldap.coulomb.social` to
railiance01. Normal resolution now sends `auth`, `login`, `lldap`, `pink`,
`pink-account`, and `kc` to `92.205.62.239`; only the explicitly retained
`bao`, retired `gitea`, and `hub` names resolve to CoulombCore. HTTPS probes
for Authelia, LLDAP, both privacyIDEA surfaces, and KeyCape discovery pass on
the public path. Direct TLS-preserving requests to the old IP return 404 for
each identity hostname, proving the stale ingress has no functioning backend.
The observation gate therefore passes without fallback traffic.
## T07 - Retire CoulombCore identity workloads reversibly
```task
id: NK-WP-0022-T07
status: wait
status: done
priority: high
state_hub_task_id: "75d160e6-ed58-4b89-b870-4a755e1ca5ce"
```
@ -277,6 +286,14 @@ one replica. It must not be scaled down until the final LLDAP DNS record and
T06 observation gate pass. The reversible retirement is therefore reduced to
one remaining workload plus stale ingress/backup checks.
2026-07-30 completion: after T06 passed, CoulombCore Authelia was scaled to
zero. KeyCape, LLDAP, privacyIDEA, and Authelia are now all zero replicas.
No legacy identity backup CronJobs remain present. Services, Ingresses,
ConfigMaps, Secrets, PVCs, TLS material, and source manifests were deliberately
retained. Public identity probes still reach healthy railiance01 endpoints,
while direct old-IP identity requests return 404. The reversible rollback
window begins 2026-07-30; no retained state may be deleted under this task.
## T08 - Final deletion and closure
```task
@ -295,6 +312,11 @@ runbooks. Run `statehub fix-consistency`.
Done when railiance01 is the sole authoritative identity stack, all evidence
is reconciled, and the workplan is marked finished.
Retention gate: keep the reversible CoulombCore identity resources through at
least 2026-08-29. T08 then requires a successful railiance01 restore/restart
drill and a new explicit approval for destructive deletion. Until both occur,
the workplan remains active with only T08 waiting.
## Safety gates
- No retirement before a tested backup and restore path exists.