tegwick
d9557ba90e
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
52 lines
3.1 KiB
Markdown
52 lines
3.1 KiB
Markdown
# user-engine portal on reef-railiance
|
|
|
|
Exercise status: unknown for the procedures in this runbook; no per-procedure successful-run receipt with operator attribution was established in the 2026-09-05 review. See [procedure inventory](../../../docs/attended-procedure-inventory.md).
|
|
|
|
**Apply home moved.** The managed package is `rapp-user-engine`. Render,
|
|
deploy, verify, and rollback from that repo (`make deploy`,
|
|
`make verify-live`). These files are historical migration input, not a current apply or rollback
|
|
procedure. In particular, the old runtime mail binding must not be replayed.
|
|
|
|
This is a stateful `rail-kubernetes` platform workload. It intentionally has
|
|
no public Ingress until the KeyCape authorization-code/PKCE edge and
|
|
`user-engine-portal` client are configured. Direct access to protected routes
|
|
must remain impossible because the application accepts identity only from a
|
|
trusted edge marker plus verified claims.
|
|
|
|
The portal image is published through the activity-core workload-scoped
|
|
Forgejo package credential and deployed from
|
|
`forgejo.coulomb.social/coulomb/user-engine` by immutable digest. The public
|
|
package read was verified without an image pull Secret; publishing still uses
|
|
the ExternalSecret-backed credential and temporary client state.
|
|
|
|
The CloudNativePG operator creates `user-engine-pg-app`, including its `uri`
|
|
field. OpenBao is authoritative for the portal edge marker and provisioner
|
|
service token at `platform/workloads/user-engine/runtime`. The
|
|
`openbao-runtime.yaml` stores and ExternalSecrets deliver those values into the
|
|
existing namespaced Secret names without changing application interfaces.
|
|
|
|
Email delivery now uses email-connect's scoped `user-engine-scoped-mail` ESO
|
|
contract owned by the provider; the former shared `mail-token` is revoked and
|
|
must not be restored. The legacy `tools/sync-user-engine-delivery-secret.sh`
|
|
now refuses before credential or cluster access. Audit sender maintenance must
|
|
use the audit-core/Platform owner-reviewed delivery path; the existing audit
|
|
Secret is preserved, not rotated or revoked by source retirement. The managed
|
|
package's `docs/runtime-contract.md` is the release authority.
|
|
|
|
The desired runtime also projects a short-lived ServiceAccount token with
|
|
audience `flex-auth` at `/var/run/secrets/flex-auth-caller/token`. user-engine
|
|
re-reads it per policy decision; it is not a Kubernetes API credential and is
|
|
not copied into a Secret. This manifest must be promoted with a user-engine
|
|
image that understands `USER_ENGINE_FLEX_AUTH_TOKEN_FILE` and flex-auth desired
|
|
state that binds `system:serviceaccount:user-engine:user-engine`. The current
|
|
pinned digest predates that coordinated rollout.
|
|
|
|
Use `make verify-live` from `rapp-user-engine` for current verification.
|
|
The former `verify-operability.sh` is retired: its rollback reapplied this
|
|
migration tree and its fixed July job names could not prove a current restore.
|
|
|
|
|
|
Rollback sets the Deployment image to the preceding immutable digest.
|
|
Database migrations are additive and run before serving; restore uses the
|
|
standard CNPG recovery contract once the offsite object-store reference is
|
|
attached.
|