From dbbccc1a8078e0588936b8e686979f538af3647c Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 13 Aug 2026 17:34:29 +0200 Subject: [PATCH] Deploy scoped user-engine delivery lanes --- WORK-RECORDS.md | 8 ++++---- sso-mfa/k8s/user-engine/README.md | 7 +++++++ sso-mfa/k8s/user-engine/runtime.yaml | 2 +- tools/sync-user-engine-delivery-secret.sh | 19 +++++++++++++++++++ ...ser-engine-portal-integration-expansion.md | 11 +++++++++++ 5 files changed, 42 insertions(+), 5 deletions(-) create mode 100755 tools/sync-user-engine-delivery-secret.sh diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 60ac7cb..9b1bd4d 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -59,10 +59,10 @@ | task | NK-WP-0023-T06 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | | task | NK-WP-0023-T07 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | | task | NK-WP-0023-T08 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | -| task | NK-WP-0024-T01 | progress | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | -| task | NK-WP-0024-T02 | progress | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | -| task | NK-WP-0024-T03 | progress | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | -| task | NK-WP-0024-T04 | progress | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | +| task | NK-WP-0024-T01 | wait | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | +| task | NK-WP-0024-T02 | wait | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | +| task | NK-WP-0024-T03 | wait | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | +| task | NK-WP-0024-T04 | wait | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | | task | NK-WP-0025-T01 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | | task | NK-WP-0025-T02 | wait | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | | task | NK-WP-0025-T03 | wait | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | diff --git a/sso-mfa/k8s/user-engine/README.md b/sso-mfa/k8s/user-engine/README.md index 61694c2..93f3258 100644 --- a/sso-mfa/k8s/user-engine/README.md +++ b/sso-mfa/k8s/user-engine/README.md @@ -18,6 +18,13 @@ service token at `platform/workloads/user-engine/runtime`. The `openbao-runtime.yaml` stores and ExternalSecrets deliver those values into the existing namespaced Secret names without changing application interfaces. +The audit-core sender and email-connect ingest credentials stay authoritative +in their provider namespaces. Run +`tools/sync-user-engine-delivery-secret.sh` from the repository root to copy +only those scoped values into `user-engine-delivery` without printing them. +Rerun it after either provider rotates its token, then restart user-engine +because the application receives these two values as environment variables. + ```bash kubectl apply -f openbao-runtime.yaml kubectl apply -f runtime.yaml diff --git a/sso-mfa/k8s/user-engine/runtime.yaml b/sso-mfa/k8s/user-engine/runtime.yaml index 2d5f38b..3ab171d 100644 --- a/sso-mfa/k8s/user-engine/runtime.yaml +++ b/sso-mfa/k8s/user-engine/runtime.yaml @@ -45,7 +45,7 @@ spec: seccompProfile: {type: RuntimeDefault} containers: - name: portal - image: forgejo.coulomb.social/coulomb/user-engine@sha256:ffca598fab9c035b58a40ae6c2be365497743a7594bc584124ab231383f25d8a + image: forgejo.coulomb.social/coulomb/user-engine@sha256:4eac10bf157e48eeadef16a2da83a00933914c9d37338f01679692008de21565 imagePullPolicy: IfNotPresent ports: [{name: http, containerPort: 8080}] env: diff --git a/tools/sync-user-engine-delivery-secret.sh b/tools/sync-user-engine-delivery-secret.sh new file mode 100755 index 0000000..854bc11 --- /dev/null +++ b/tools/sync-user-engine-delivery-secret.sh @@ -0,0 +1,19 @@ +#!/usr/bin/env bash +set -euo pipefail + +# Copy only the two scoped receiver credentials into user-engine. Values stay +# in process memory and Kubernetes API requests; stdout contains metadata only. +audit_json="$(kubectl -n audit-core get secret audit-core-senders -o jsonpath='{.data.senders\.json}' | base64 -d)" +event_token="$(python3 -c 'import json,sys; rows=json.load(sys.stdin); print(next(row["tokens"][0] for row in rows if row["name"] == "user-engine"))' <<<"$audit_json")" +mail_token="$(kubectl -n email-connect get secret email-connect-runtime -o jsonpath='{.data.EMAIL_CONNECT_INGEST_TOKEN}' | base64 -d)" + +test -n "$event_token" +test -n "$mail_token" + +kubectl -n user-engine create secret generic user-engine-delivery \ + --from-literal=event-token="$event_token" \ + --from-literal=mail-token="$mail_token" \ + --dry-run=client -o yaml \ + | kubectl apply -f - >/dev/null + +echo "user-engine delivery Secret synchronized (values withheld)" diff --git a/workplans/NK-WP-0024-user-engine-portal-integration-expansion.md b/workplans/NK-WP-0024-user-engine-portal-integration-expansion.md index 3cbb346..3f6e6a4 100644 --- a/workplans/NK-WP-0024-user-engine-portal-integration-expansion.md +++ b/workplans/NK-WP-0024-user-engine-portal-integration-expansion.md @@ -156,3 +156,14 @@ external-provider skips. NetKingdom's runtime manifest now declares both cluster-local endpoints, separate Secret keys, and audit-core egress. The remaining gate is custody delivery of those two scoped values, image publish, rollout, and the combined live matrix. + +2026-08-13 rollout: the scoped provider credentials were transferred entirely +through Kubernetes APIs into Secret `user-engine-delivery`, containing exactly +`event-token` and `mail-token`; no value was printed or persisted outside the +cluster. user-engine commit `a0f39f5` was published and deployed at immutable +digest `sha256:4eac10bf157e48eeadef16a2da83a00933914c9d37338f01679692008de21565`. +The rollout completed, `/readyz` reports all checks true, and in-pod probes +reach flex-auth, audit-core, and email-connect with HTTP 200 through the +declared NetworkPolicies. Remaining T04 evidence is application-level outbox +delivery and the negative matrix; health reachability alone is not reported +as delivery acceptance.