coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Retire CoulombCore references; correct the 16443 diagnosis
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
CoulombCore is being retired, so the docs stop using it as the reference host:
state-hub-coulombcore examples become state-hub-railiance01, and the reuse-surface
playbook no longer attributes bao.coulomb.social to it — that resolves to
92.205.62.239, which is railiance01. The openrouter lane keeps its factual note
about ESO on the CoulombCore cluster, with a retirement flag for its owner.

Also corrects this session's own error. The WP-0031 evidence blamed the
Unauthorized on a local-port collision between k3s-api-coulombcore and
k3s-api-haskelseed. That was wrong: the haskelseed tunnel is a reverse forward,
where local_port is a destination rather than a listener, so they never competed.
16443 was simply CoulombCore's k3s — a different cluster whose client CA does not
know that cert. The wrong reason had already gone to flex-auth, so it is
corrected in the file rather than quietly dropped.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-19 19:31:41 +02:00
parent e22f9b3434
commit 661176e37a
9 changed files with 34 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

19
history/2026-08-19-flex-auth-caller-identity-evidence.md
View file

@ -8,11 +8,20 @@ Service `flex-auth-ops-warden:8080`, digest `sha256:138aa347…`, running
(read off the live Deployment, matching FLEX-WP-0016 T02).
Reached from the workstation by port-forward; the tunnel `k3s-api-railiance01`
(local `16444`) carries the API. Note `~/.kube/config` / `config-hosteurope`
points at `16443`, which two bridge tunnels claim
(`k3s-api-coulombcore` and `k3s-api-haskelseed`) — that collision is why a
`system:masters` cert returns `Unauthorized` there. Use
`--kubeconfig ~/.kube/config-railiance01`.
(local `16444`) carries the API. Use `--kubeconfig ~/.kube/config-railiance01`.
`~/.kube/config` / `config-hosteurope` — which `.bashrc` exports as `KUBECONFIG`
— points at `16443`, and that was **CoulombCore's** k3s API, a different cluster
whose client CA does not know this cert. Hence `Unauthorized`. CoulombCore is
being retired and that tunnel was removed on 2026-08-19, so the port is simply
gone now; `KUBECONFIG` was repointed at `config-railiance01`.
*(An earlier revision of this file blamed a local-port collision between
`k3s-api-coulombcore` and `k3s-api-haskelseed`. That was wrong: the haskelseed
tunnel is a **reverse** forward, where `local_port` is the destination on this
workstation rather than a listener, so the two never competed for the port. The
correction is recorded here because the wrong reason was also sent to flex-auth
and would have misdirected whoever followed the handoff.)*
## Baseline — before