From f4f885289e196b6770fea5d509959e3031fd9295 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 18 Aug 2026 12:39:24 +0200 Subject: [PATCH] docs: point user-engine apply home at rapp-user-engine --- sso-mfa/k8s/user-engine/README.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/sso-mfa/k8s/user-engine/README.md b/sso-mfa/k8s/user-engine/README.md index 93f3258..2cdb094 100644 --- a/sso-mfa/k8s/user-engine/README.md +++ b/sso-mfa/k8s/user-engine/README.md @@ -1,5 +1,10 @@ # user-engine portal on reef-railiance +**Apply home moved.** The managed package is `rapp-user-engine`. Render, +deploy, verify, and rollback from that repo (`make deploy`, +`make verify-live`). These files remain migration input until that +package is the only checkout operators apply. + This is a stateful `rail-kubernetes` platform workload. It intentionally has no public Ingress until the KeyCape authorization-code/PKCE edge and `user-engine-portal` client are configured. Direct access to protected routes @@ -25,6 +30,14 @@ only those scoped values into `user-engine-delivery` without printing them. Rerun it after either provider rotates its token, then restart user-engine because the application receives these two values as environment variables. +The desired runtime also projects a short-lived ServiceAccount token with +audience `flex-auth` at `/var/run/secrets/flex-auth-caller/token`. user-engine +re-reads it per policy decision; it is not a Kubernetes API credential and is +not copied into a Secret. This manifest must be promoted with a user-engine +image that understands `USER_ENGINE_FLEX_AUTH_TOKEN_FILE` and flex-auth desired +state that binds `system:serviceaccount:user-engine:user-engine`. The current +pinned digest predates that coordinated rollout. + ```bash kubectl apply -f openbao-runtime.yaml kubectl apply -f runtime.yaml