tegwick
4f65e41ac5
Some checks failed
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa
85 lines
4.8 KiB
Markdown
85 lines
4.8 KiB
Markdown
# NetKingdom Kubernetes integration guidance
|
|
|
|
This directory holds bootstrap tooling, integration references and migration
|
|
history. Current managed deployment belongs to the service/package owners
|
|
under [ADR-0015](../../docs/adr/ADR-0015-netkingdom-railiance-workload-packaging-and-relational-platform.md).
|
|
The [original foundation procedure](FOUNDATIONS-HISTORICAL.md) is retained as
|
|
historical material, including its old prerequisites and apply commands.
|
|
|
|
## Operating baseline
|
|
|
|
The [September 28 review](../../history/2026-09-28-open-workplan-infrastructure-review.md)
|
|
observed one Ready Railiance01 node at `92.205.62.239`, healthy lightweight
|
|
identity components and single-instance CNPG databases. This is a dated
|
|
inventory, not an HA, recovery or user-login acceptance claim.
|
|
|
|
| Surface | Current role and owner |
|
|
| --- | --- |
|
|
| KeyCape / Authelia / LLDAP (`sso`) and privacyIDEA (`mfa`) | Lightweight identity composition; issuer implementation in `key-cape`, integration contracts here |
|
|
| User Engine | [rapp-user-engine](../../../rapp-user-engine/README.md) owns managed manifests, rollout and rollback |
|
|
| Tenant Engine | [rapp-tenant-engine](../../../rapp-tenant-engine/README.md) owns managed runtime and database-consumption configuration |
|
|
| flex-auth consumer services | [Owner values and chart pointers](tenant-engine/README.md); caller authentication is enforced by the owner declarations |
|
|
| OpenBao and database custody | `railiance-platform`, with managed packages and consumer declarations in their owning repositories |
|
|
| Kubernetes and host substrate | [railiance-cluster operator runbook](../../../railiance-cluster/docs/operator-runbook.md) and `railiance-infra` |
|
|
|
|
OpenBao's public browser endpoint `bao.coulomb.social` is retired. Operators
|
|
use the named `openbao-ui-railiance01` tunnel at `http://127.0.0.1:18200`;
|
|
workloads use the internal Service. Follow the platform's
|
|
[operator-only cutover record](../../../railiance-platform/workplans/RPF-WP-0025-openbao-operator-only-access.md)
|
|
and credential routing in [AGENTS.md](../../AGENTS.md). Route access before
|
|
requesting credentials; never copy tokens or Secret values into evidence.
|
|
|
|
## Read-only orientation
|
|
|
|
Check the context before interpreting these results. All commands below read
|
|
resource metadata and readiness; none applies manifests or initiates login.
|
|
|
|
```bash
|
|
kubectl config current-context
|
|
kubectl get nodes -o wide
|
|
kubectl -n sso get deployments
|
|
kubectl -n mfa get deployments
|
|
kubectl -n user-engine get deployments
|
|
kubectl -n tenant-engine get deployments
|
|
kubectl -n flex-auth get deployments
|
|
kubectl -n openbao get statefulsets,deployments,services,ingresses
|
|
kubectl get clusters.postgresql.cnpg.io -A
|
|
```
|
|
|
|
Ready replicas do not prove negative authorization, actual-user MFA, successful
|
|
backup restoration or independent failure domains. Use the relevant owner's
|
|
verification and recovery procedure for those claims.
|
|
|
|
## Deployment and recovery
|
|
|
|
Start with the owning package's current declaration, immutable image and
|
|
reviewed rollout/rollback procedure. Do not recursively apply this tree.
|
|
`tenant-engine/runtime.yaml` is retired (NK-WP-0039-T04) and holds owner pointers only, no
|
|
objects; the Tenant Engine and flex-auth declarations live with their owners.
|
|
|
|
The scripts and manifests elsewhere in this directory have individual scopes;
|
|
their presence here does not make them current production repair commands.
|
|
The [attended procedure inventory](../../docs/attended-procedure-inventory.md)
|
|
records their exercise limits. Use the [custody model](../../docs/openbao-unseal-custody-models.md)
|
|
and current owner runbooks to prepare recovery. A database-only drill does not
|
|
prove restoration of LLDAP, Authelia, privacyIDEA and its matching encryption
|
|
material, or all identity database state.
|
|
|
|
CoulombCore identity cutover and retained cluster deletion completed on
|
|
2026-10-15 under the recorded approval and passing restart gate in
|
|
[NK-WP-0022](../../workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md).
|
|
Railiance01 is authoritative. Recover through current owner runbooks and
|
|
protected independent backups; the old cluster and its local PVCs are gone.
|
|
|
|
|
|
### Identity-provisioner service group provenance
|
|
|
|
The [owner storage and request migration contract](../../docs/service-group-provenance.md)
|
|
describes the durable journal required by governed service-group ensure/revoke.
|
|
The existing reference identity-provisioner Deployment has a read-only root
|
|
filesystem, UID10001 and no provenance volume. The implemented SQLite backend
|
|
is local/disposable only. Accepted ADR-0015 rejects SQLite-on-a-PVC for production;
|
|
native journal storage requires the CNPG/`rapp-postgres` consumer contract or an
|
|
explicit governed exception, plus owner-admitted image/storage/caller and writer
|
|
isolation. Keep production group operations disabled pending that admission.
|
|
This guidance does not apply or authorize a native volume change.
|