coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
net-kingdom/sso-mfa/k8s/user-engine/README.md
tegwick f854969a01
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Move portal workloads to registry digests
2026-07-30 00:25:16 +02:00

1.3 KiB
Raw Blame History

user-engine portal on reef-railiance

This is a stateful rail-kubernetes platform workload. It intentionally has no public Ingress until the KeyCape authorization-code/PKCE edge and user-engine-portal client are configured. Direct access to protected routes must remain impossible because the application accepts identity only from a trusted edge marker plus verified claims.

The portal image is published through the activity-core workload-scoped Forgejo package credential and deployed from forgejo.coulomb.social/coulomb/user-engine by immutable digest. The public package read was verified without an image pull Secret; publishing still uses the ExternalSecret-backed credential and temporary client state.

The CloudNativePG operator creates user-engine-pg-app, including its uri field. user-engine-runtime contains only the generated edge marker and must be replaced by an ExternalSecret before public exposure.

kubectl apply -f runtime.yaml
kubectl -n user-engine rollout status deployment/user-engine
kubectl -n user-engine get cluster,pod,service,networkpolicy

Rollback sets the Deployment image to the preceding immutable digest. Database migrations are additive and run before serving; restore uses the standard CNPG recovery contract once the offsite object-store reference is attached.