From ba5ed2f707c50281a0e92c5798dbfe49c7fe81b3 Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 8 Oct 2026 16:45:32 +0200 Subject: [PATCH] ORGREF-WP-0002-T02: fresh runtime capture and per-entry consumer review 43 anonymous image pulls (confirmed working anonymously), 10 ArgoCD apps, CI tarball downloads in ~20 repos, PyPI reads, reuse-surface federation and ~8 code readers break on closure. Founder presence checks prepared for ArgoCD repository credentials and k3s node registry auth. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 5457@bnt-lap001 Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012 --- inventory/access-consumers-2026-10-08.json | 305 ++- inventory/access-consumers.md | 98 +- inventory/runtime-2026-10-08.json | 1720 +++++++++++++++++ ...WP-0002-forge-closure-netkingdom-access.md | 17 +- 4 files changed, 2048 insertions(+), 92 deletions(-) create mode 100644 inventory/runtime-2026-10-08.json diff --git a/inventory/access-consumers-2026-10-08.json b/inventory/access-consumers-2026-10-08.json index 0116597..d00e463 100644 --- a/inventory/access-consumers-2026-10-08.json +++ b/inventory/access-consumers-2026-10-08.json @@ -1,7 +1,7 @@ { "schema_version": "0.1", "workplan": "ORGREF-WP-0002-T02", - "runtime_capture": "runtime-2026-09-28.json", + "runtime_capture": "runtime-2026-10-08.json", "scanned_repositories": 161, "local_remote_forms": { "other": 1, @@ -11,19 +11,19 @@ "api-client": 25, "build-tooling": 23, "ci-runner": 27, - "cluster-gitops": 6, - "cluster-image-pull": 40, + "cluster-gitops": 10, + "cluster-image-pull": 43, "code-reference": 24, - "config-reference": 98, + "config-reference": 99, "doc-link": 119, "other": 2, "package-consumer": 2, "raw-file-fetch": 68, - "record-or-test": 103, - "repo-gitops": 15, - "repo-image-reference": 91 + "record-or-test": 104, + "repo-gitops": 17, + "repo-image-reference": 93 }, - "anonymous_image_pulls": 40, + "anonymous_image_pulls": 43, "consumers": [ { "consumer": "argocd:activity-core", @@ -49,6 +49,22 @@ "credential": "unknown (ArgoCD repo credentials not inspected)", "target_steward": "railiance" }, + { + "consumer": "argocd:informed-decision", + "class": "cluster-gitops", + "kind": "gitops-source", + "target": "coulomb/informed-decision", + "credential": "unknown (ArgoCD repo credentials not inspected)", + "target_steward": "helixforge" + }, + { + "consumer": "argocd:informed-decision-requester", + "class": "cluster-gitops", + "kind": "gitops-source", + "target": "coulomb/railiance-platform", + "credential": "unknown (ArgoCD repo credentials not inspected)", + "target_steward": "railiance" + }, { "consumer": "argocd:openbao-secretstore", "class": "cluster-gitops", @@ -65,6 +81,22 @@ "credential": "unknown (ArgoCD repo credentials not inspected)", "target_steward": "railiance" }, + { + "consumer": "argocd:secret-annotation-guard", + "class": "cluster-gitops", + "kind": "gitops-source", + "target": "coulomb/railiance-platform", + "credential": "unknown (ArgoCD repo credentials not inspected)", + "target_steward": "railiance" + }, + { + "consumer": "argocd:state-hub-memo-dispatch", + "class": "cluster-gitops", + "kind": "gitops-source", + "target": "coulomb/state-hub", + "credential": "unknown (ArgoCD repo credentials not inspected)", + "target_steward": "helixforge" + }, { "consumer": "argocd:target-revenue", "class": "cluster-gitops", @@ -130,7 +162,7 @@ "target_steward": "netkingdom" }, { - "consumer": "k3s:audit-core/Job/audit-core-attest-chain-29841317", + "consumer": "k3s:audit-core/Job/audit-core-attest-chain-29855717", "class": "cluster-image-pull", "kind": "image-pull", "target": "coulomb/audit-core", @@ -138,7 +170,7 @@ "target_steward": "netkingdom" }, { - "consumer": "k3s:audit-core/Job/audit-core-attest-chain-29842757", + "consumer": "k3s:audit-core/Job/audit-core-attest-chain-29857157", "class": "cluster-image-pull", "kind": "image-pull", "target": "coulomb/audit-core", @@ -209,6 +241,14 @@ "credential": "anonymous (no imagePullSecrets)", "target_steward": "UNRESOLVED" }, + { + "consumer": "k3s:flex-auth/Deployment/flex-auth-informed-decision-lifecycle", + "class": "cluster-image-pull", + "kind": "image-pull", + "target": "coulomb/flex-auth", + "credential": "anonymous (no imagePullSecrets)", + "target_steward": "netkingdom" + }, { "consumer": "k3s:flex-auth/Deployment/flex-auth-informed-decision-sitting", "class": "cluster-image-pull", @@ -233,6 +273,14 @@ "credential": "anonymous (no imagePullSecrets)", "target_steward": "netkingdom" }, + { + "consumer": "k3s:flex-auth/Deployment/flex-auth-ops-warden-fetch", + "class": "cluster-image-pull", + "kind": "image-pull", + "target": "coulomb/flex-auth", + "credential": "anonymous (no imagePullSecrets)", + "target_steward": "netkingdom" + }, { "consumer": "k3s:flex-auth/Deployment/flex-auth-secrets-engine", "class": "cluster-image-pull", @@ -345,6 +393,14 @@ "credential": "anonymous (no imagePullSecrets)", "target_steward": "helixforge" }, + { + "consumer": "k3s:state-hub/Deployment/state-hub-memo-dispatch", + "class": "cluster-image-pull", + "kind": "image-pull", + "target": "coulomb/state-hub-memo-dispatch", + "credential": "anonymous (no imagePullSecrets)", + "target_steward": "unassigned" + }, { "consumer": "k3s:target-revenue/Deployment/target-revenue", "class": "cluster-image-pull", @@ -3458,10 +3514,12 @@ "locations": [ "inventory/runtime-2026-09-28.json:113", "inventory/runtime-2026-09-28.json:114", + "inventory/runtime-2026-10-08.json:176", + "inventory/runtime-2026-10-08.json:177", "inventory/snapshot.json:13", "inventory/snapshot-before.json:13" ], - "location_count": 4, + "location_count": 6, "target_steward": "unassigned" }, { @@ -3470,9 +3528,10 @@ "kind": "config-reference", "target": "coulomb/activity-core", "locations": [ - "inventory/runtime-2026-09-28.json:84" + "inventory/runtime-2026-09-28.json:84", + "inventory/runtime-2026-10-08.json:132" ], - "location_count": 1, + "location_count": 2, "target_steward": "helixforge" }, { @@ -3486,6 +3545,17 @@ "location_count": 1, "target_steward": "coulomb" }, + { + "consumer": "repo:prj-forgejo-org-refactor", + "class": "config-reference", + "kind": "config-reference", + "target": "coulomb/informed-decision", + "locations": [ + "inventory/runtime-2026-10-08.json:146" + ], + "location_count": 1, + "target_steward": "helixforge" + }, { "consumer": "repo:prj-forgejo-org-refactor", "class": "config-reference", @@ -3493,9 +3563,12 @@ "target": "coulomb/railiance-platform", "locations": [ "inventory/runtime-2026-09-28.json:98", - "inventory/runtime-2026-09-28.json:105" + "inventory/runtime-2026-09-28.json:105", + "inventory/runtime-2026-10-08.json:154", + "inventory/runtime-2026-10-08.json:161", + "inventory/runtime-2026-10-08.json:168" ], - "location_count": 2, + "location_count": 5, "target_steward": "railiance" }, { @@ -3504,9 +3577,10 @@ "kind": "config-reference", "target": "coulomb/reuse-surface", "locations": [ - "inventory/runtime-2026-09-28.json:1180" + "inventory/runtime-2026-09-28.json:1180", + "inventory/runtime-2026-10-08.json:1263" ], - "location_count": 1, + "location_count": 2, "target_steward": "helixforge" }, { @@ -3517,9 +3591,13 @@ "locations": [ "inventory/runtime-2026-09-28.json:142", "inventory/runtime-2026-09-28.json:1400", - "inventory/runtime-2026-09-28.json:1410" + "inventory/runtime-2026-09-28.json:1410", + "inventory/runtime-2026-10-08.json:147", + "inventory/runtime-2026-10-08.json:205", + "inventory/runtime-2026-10-08.json:1483", + "inventory/runtime-2026-10-08.json:1493" ], - "location_count": 3, + "location_count": 7, "target_steward": "helixforge" }, { @@ -3528,9 +3606,10 @@ "kind": "config-reference", "target": "coulomb/target-revenue", "locations": [ - "inventory/runtime-2026-09-28.json:1430" + "inventory/runtime-2026-09-28.json:1430", + "inventory/runtime-2026-10-08.json:1523" ], - "location_count": 1, + "location_count": 2, "target_steward": "UNRESOLVED" }, { @@ -3577,7 +3656,19 @@ "kind": "gitops-source", "target": "coulomb/activity-core", "locations": [ - "inventory/runtime-2026-09-28.json:10" + "inventory/runtime-2026-09-28.json:10", + "inventory/runtime-2026-10-08.json:10" + ], + "location_count": 2, + "target_steward": "helixforge" + }, + { + "consumer": "repo:prj-forgejo-org-refactor", + "class": "repo-gitops", + "kind": "gitops-source", + "target": "coulomb/informed-decision", + "locations": [ + "inventory/runtime-2026-10-08.json:46" ], "location_count": 1, "target_steward": "helixforge" @@ -3592,20 +3683,37 @@ "inventory/runtime-2026-09-28.json:22", "inventory/runtime-2026-09-28.json:34", "inventory/runtime-2026-09-28.json:46", - "inventory/runtime-2026-09-28.json:58" + "inventory/runtime-2026-09-28.json:58", + "inventory/runtime-2026-10-08.json:22", + "inventory/runtime-2026-10-08.json:34", + "inventory/runtime-2026-10-08.json:58", + "inventory/runtime-2026-10-08.json:70", + "inventory/runtime-2026-10-08.json:82" ], - "location_count": 5, + "location_count": 11, "target_steward": "railiance" }, + { + "consumer": "repo:prj-forgejo-org-refactor", + "class": "repo-gitops", + "kind": "gitops-source", + "target": "coulomb/state-hub", + "locations": [ + "inventory/runtime-2026-10-08.json:106" + ], + "location_count": 1, + "target_steward": "helixforge" + }, { "consumer": "repo:prj-forgejo-org-refactor", "class": "repo-gitops", "kind": "gitops-source", "target": "coulomb/target-revenue", "locations": [ - "inventory/runtime-2026-09-28.json:70" + "inventory/runtime-2026-09-28.json:70", + "inventory/runtime-2026-10-08.json:118" ], - "location_count": 1, + "location_count": 2, "target_steward": "UNRESOLVED" }, { @@ -3616,9 +3724,12 @@ "locations": [ "inventory/runtime-2026-09-28.json:122", "inventory/runtime-2026-09-28.json:132", - "inventory/runtime-2026-09-28.json:172" + "inventory/runtime-2026-09-28.json:172", + "inventory/runtime-2026-10-08.json:185", + "inventory/runtime-2026-10-08.json:195", + "inventory/runtime-2026-10-08.json:235" ], - "location_count": 3, + "location_count": 6, "target_steward": "helixforge" }, { @@ -3627,9 +3738,10 @@ "kind": "image-pull", "target": "coulomb/approval-engine", "locations": [ - "inventory/runtime-2026-09-28.json:252" + "inventory/runtime-2026-09-28.json:252", + "inventory/runtime-2026-10-08.json:315" ], - "location_count": 1, + "location_count": 2, "target_steward": "netkingdom" }, { @@ -3641,9 +3753,13 @@ "inventory/runtime-2026-09-28.json:303", "inventory/runtime-2026-09-28.json:313", "inventory/runtime-2026-09-28.json:323", - "inventory/runtime-2026-09-28.json:338" + "inventory/runtime-2026-09-28.json:338", + "inventory/runtime-2026-10-08.json:366", + "inventory/runtime-2026-10-08.json:376", + "inventory/runtime-2026-10-08.json:386", + "inventory/runtime-2026-10-08.json:401" ], - "location_count": 4, + "location_count": 8, "target_steward": "netkingdom" }, { @@ -3652,9 +3768,10 @@ "kind": "image-pull", "target": "coulomb/canned-prompts", "locations": [ - "inventory/runtime-2026-09-28.json:363" + "inventory/runtime-2026-09-28.json:363", + "inventory/runtime-2026-10-08.json:426" ], - "location_count": 1, + "location_count": 2, "target_steward": "helixforge" }, { @@ -3665,20 +3782,34 @@ "locations": [ "GOAL.md:72", "inventory/runtime-2026-09-28.json:413", - "inventory/runtime-2026-09-28.json:443" + "inventory/runtime-2026-09-28.json:443", + "inventory/runtime-2026-10-08.json:476", + "inventory/runtime-2026-10-08.json:506" ], - "location_count": 3, + "location_count": 5, "target_steward": "helixforge" }, + { + "consumer": "repo:prj-forgejo-org-refactor", + "class": "repo-image-reference", + "kind": "image-pull", + "target": "coulomb/coulomb-social", + "locations": [ + "inventory/runtime-2026-10-08.json:536" + ], + "location_count": 1, + "target_steward": "coulomb" + }, { "consumer": "repo:prj-forgejo-org-refactor", "class": "repo-image-reference", "kind": "image-pull", "target": "coulomb/email-connect", "locations": [ - "inventory/runtime-2026-09-28.json:543" + "inventory/runtime-2026-09-28.json:543", + "inventory/runtime-2026-10-08.json:606" ], - "location_count": 1, + "location_count": 2, "target_steward": "UNRESOLVED" }, { @@ -3692,9 +3823,13 @@ "inventory/runtime-2026-09-28.json:658", "inventory/runtime-2026-09-28.json:668", "inventory/runtime-2026-09-28.json:678", - "inventory/runtime-2026-09-28.json:688" + "inventory/runtime-2026-09-28.json:688", + "inventory/runtime-2026-10-08.json:701", + "inventory/runtime-2026-10-08.json:711", + "inventory/runtime-2026-10-08.json:721", + "inventory/runtime-2026-10-08.json:731" ], - "location_count": 6, + "location_count": 14, "target_steward": "netkingdom" }, { @@ -3704,9 +3839,11 @@ "target": "coulomb/hub-core", "locations": [ "inventory/runtime-2026-09-28.json:423", - "inventory/runtime-2026-09-28.json:453" + "inventory/runtime-2026-09-28.json:453", + "inventory/runtime-2026-10-08.json:486", + "inventory/runtime-2026-10-08.json:516" ], - "location_count": 2, + "location_count": 4, "target_steward": "helixforge" }, { @@ -3715,9 +3852,10 @@ "kind": "image-pull", "target": "coulomb/identity-provisioner", "locations": [ - "inventory/runtime-2026-09-28.json:1250" + "inventory/runtime-2026-09-28.json:1250", + "inventory/runtime-2026-10-08.json:1333" ], - "location_count": 1, + "location_count": 2, "target_steward": "unassigned" }, { @@ -3726,9 +3864,10 @@ "kind": "image-pull", "target": "coulomb/informed-decision", "locations": [ - "inventory/runtime-2026-09-28.json:719" + "inventory/runtime-2026-09-28.json:719", + "inventory/runtime-2026-10-08.json:802" ], - "location_count": 1, + "location_count": 2, "target_steward": "helixforge" }, { @@ -3737,9 +3876,10 @@ "kind": "image-pull", "target": "coulomb/issue-core", "locations": [ - "inventory/runtime-2026-09-28.json:739" + "inventory/runtime-2026-09-28.json:739", + "inventory/runtime-2026-10-08.json:822" ], - "location_count": 1, + "location_count": 2, "target_steward": "helixforge" }, { @@ -3748,9 +3888,10 @@ "kind": "image-pull", "target": "coulomb/key-cape", "locations": [ - "inventory/runtime-2026-09-28.json:1260" + "inventory/runtime-2026-09-28.json:1260", + "inventory/runtime-2026-10-08.json:1343" ], - "location_count": 1, + "location_count": 2, "target_steward": "netkingdom" }, { @@ -3759,9 +3900,10 @@ "kind": "image-pull", "target": "coulomb/policy-nexus", "locations": [ - "inventory/runtime-2026-09-28.json:986" + "inventory/runtime-2026-09-28.json:986", + "inventory/runtime-2026-10-08.json:1069" ], - "location_count": 1, + "location_count": 2, "target_steward": "netkingdom" }, { @@ -3771,9 +3913,11 @@ "target": "coulomb/railiance-telemetry-ack", "locations": [ "inventory/runtime-2026-09-28.json:1472", - "inventory/runtime-2026-09-28.json:1482" + "inventory/runtime-2026-09-28.json:1482", + "inventory/runtime-2026-10-08.json:1565", + "inventory/runtime-2026-10-08.json:1575" ], - "location_count": 2, + "location_count": 4, "target_steward": "unassigned" }, { @@ -3783,9 +3927,11 @@ "target": "coulomb/rapp-qonto", "locations": [ "inventory/runtime-2026-09-28.json:1133", - "inventory/runtime-2026-09-28.json:1150" + "inventory/runtime-2026-09-28.json:1150", + "inventory/runtime-2026-10-08.json:1216", + "inventory/runtime-2026-10-08.json:1233" ], - "location_count": 2, + "location_count": 4, "target_steward": "railiance" }, { @@ -3794,9 +3940,10 @@ "kind": "image-pull", "target": "coulomb/repo-manager", "locations": [ - "inventory/runtime-2026-09-28.json:433" + "inventory/runtime-2026-09-28.json:433", + "inventory/runtime-2026-10-08.json:496" ], - "location_count": 1, + "location_count": 2, "target_steward": "helixforge" }, { @@ -3805,10 +3952,22 @@ "kind": "image-pull", "target": "coulomb/sbom-nexus", "locations": [ - "inventory/runtime-2026-09-28.json:1200" + "inventory/runtime-2026-09-28.json:1200", + "inventory/runtime-2026-10-08.json:1283" + ], + "location_count": 2, + "target_steward": "netkingdom" + }, + { + "consumer": "repo:prj-forgejo-org-refactor", + "class": "repo-image-reference", + "kind": "image-pull", + "target": "coulomb/state-hub-memo-dispatch", + "locations": [ + "inventory/runtime-2026-10-08.json:1503" ], "location_count": 1, - "target_steward": "netkingdom" + "target_steward": "unassigned" }, { "consumer": "repo:prj-forgejo-org-refactor", @@ -3816,9 +3975,10 @@ "kind": "image-pull", "target": "coulomb/tenant-engine", "locations": [ - "inventory/runtime-2026-09-28.json:1524" + "inventory/runtime-2026-09-28.json:1524", + "inventory/runtime-2026-10-08.json:1617" ], - "location_count": 1, + "location_count": 2, "target_steward": "netkingdom" }, { @@ -3827,9 +3987,10 @@ "kind": "image-pull", "target": "coulomb/user-engine", "locations": [ - "inventory/runtime-2026-09-28.json:1554" + "inventory/runtime-2026-09-28.json:1554", + "inventory/runtime-2026-10-08.json:1647" ], - "location_count": 1, + "location_count": 2, "target_steward": "netkingdom" }, { @@ -3838,10 +3999,22 @@ "kind": "image-pull", "target": "coulomb/vergabe-teilnahme", "locations": [ - "inventory/runtime-2026-09-28.json:1619" + "inventory/runtime-2026-09-28.json:1619", + "inventory/runtime-2026-10-08.json:1712" + ], + "location_count": 2, + "target_steward": "UNRESOLVED" + }, + { + "consumer": "repo:prj-forgejo-org-refactor", + "class": "record-or-test", + "kind": "record", + "target": "coulomb/x", + "locations": [ + "tests/test_access_consumers.py:35" ], "location_count": 1, - "target_steward": "UNRESOLVED" + "target_steward": "unassigned" }, { "consumer": "repo:prj-helixforge-factory", diff --git a/inventory/access-consumers.md b/inventory/access-consumers.md index 2092ae9..e27136f 100644 --- a/inventory/access-consumers.md +++ b/inventory/access-consumers.md @@ -3,44 +3,102 @@ Machine-readable result: `access-consumers-2026-10-08.json`. Reproduce: ```bash +python3 tools/runtime_inventory.py --output inventory/runtime-2026-10-08.json python3 tools/access_consumers.py --root /home/worsch \ - --runtime inventory/runtime-2026-09-28.json \ + --runtime inventory/runtime-2026-10-08.json \ --output inventory/access-consumers-2026-10-08.json ``` -Read-only: 161 local working trees scanned, plus the 2026-09-28 runtime capture -(not a live read). Secrets, ArgoCD repository credentials and node registry -configuration were not inspected. +Read-only: 161 local working trees scanned, plus a fresh runtime capture +(`runtime-2026-10-08.json`: 135 controllers, 10 Applications, 7 AppProjects). +Secrets and node registry configuration were not inspected. ## What breaks when repositories and packages go private | Class | Count | Reads | Will need | | --- | --- | --- | --- | -| cluster-image-pull | 40 workloads in 21 namespaces | container images from the Forgejo registry, **none with `imagePullSecrets`** | pull credentials per namespace, or node-level registry auth (k3s `registries.yaml`), which is unverified | -| cluster-gitops | 6 ArgoCD applications | Git sources on the forge | ArgoCD repository credentials (current state unverified) | -| ci-runner | 27 hits in workflow files | checkouts, reusable actions, registry | runner or job tokens for cross-repo reads | -| api-client | 25 hits | `/api/v1` calls (state-hub, railiance-*, ops-warden, issue-core, …) | per-service tokens; check which calls are anonymous today | -| raw-file-fetch | 68 hits, 63 in `reuse-surface` | raw files by URL | authenticated fetch, or move the published content to a public location | -| raw-file-fetch (campaign) | pr-hall-of-helix, fluid-telegram | Telegram fetching post images | a deliberate public asset location (ORGREF-WP-0002-T01 point 4) | -| package-consumer | 2 (kaizen-agentic, whynot-design) | modules or packages from the forge | package-registry credentials | +| cluster-image-pull | 43 workloads | container images from the Forgejo registry, **none with `imagePullSecrets`** | pull credentials per namespace, or node-level registry auth (k3s `registries.yaml`, unverified). Anonymous pulls confirmed working on 2026-10-08: anonymous registry token issued, tag list 200 | +| cluster-gitops | 10 ArgoCD applications over 5 repos | Git: railiance-platform (6 apps), activity-core, informed-decision, state-hub, target-revenue | ArgoCD repository credentials. `argocd-cm` defines none; Secret-based credentials unverified | +| ci-runner | about 20 repos | own-source tarballs and cross-repo tarballs, anonymously (below) | job token for the own repository, a scoped read token across repositories | +| package index | kaizen-agentic, vergabe-teilnahme | PyPI `simple/` index without credentials | package-read token | +| federation | reuse-surface | about 60 capability indexes by raw URL | read identity, or a published index location | +| code readers | about 8 files, below | clones, API and raw reads without token handling | owner review; re-point to an authenticated path | +| campaign images | pr-hall-of-helix, fluid-telegram | Telegram fetching post images by raw URL | a deliberate public asset location (ORGREF-WP-0002-T01 point 4) | -Lower risk, review only: `repo-gitops` (15) and `repo-image-reference` (91) are -the same cluster consumers seen from their source repos. `code-reference` (24), -`config-reference` (98) and `build-tooling` (23) are mostly URLs and pushes that -need a per-entry look. `doc-link` (119) means links break for the public, not -consumers. `record-or-test` (103) is evidence and fixtures. +Lower risk: `repo-gitops` and `repo-image-reference` are the cluster consumers +seen from their source repos. `doc-link` means links break for the public, not +consumers. `record-or-test` is evidence and fixtures. + +## Per-entry review, 2026-10-08 + +**CI: anonymous source tarballs (breaks).** Workflows download their own source +with plain `curl`/`wget` from `/${GITHUB_REPOSITORY}/archive/.tar.gz`, with no +credentials: access-engine, activity-core, core-hub, coulomb-social, email-connect, +glas-harness, hub-core, issue-core, kaizen-agentic, key-cape, net-kingdom, +railiance-platform, reuse-surface, sbom-nexus, state-hub, tenant-engine, +the-custodian, user-engine, vergabe-teilnahme. Cross-repo fetches as well: +core-hub → hub-core, glas-harness → sand-boxer, state-hub → extra repos. +Work-record workflows (binky-control, repo-seed, runbook-tutorials) call the +forge base URL too. Fix: send the job token (`Authorization: token +${{ github.token }}`) for the job's own repository, and a scoped read token for +cross-repo fetches. Registry pushes in the same workflows are already +authenticated. + +**Package indexes: anonymous reads (breaks).** PyPI `simple/` used without +credentials: kaizen-agentic install docs, and vergabe-teilnahme `pyproject.toml` / +`uv.lock` (issue-core 0.2.1). npm consumers (whynot-design, markitect +testdrive-jsui) already send `NPM_AUTH_TOKEN`. + +**Federation: reuse-surface (breaks).** `registry/federation/sources.yaml` fetches +about 60 capability indexes by raw URL, anonymously. + +**Code readers with no token handling found.** activity-core +`release_transport.py` (https clone of activity-core and railiance-platform), +`owner_return_eligibility.py` (forge API) and `run_artifacts.py`; sbom-nexus +`source_fetch.py`; repo-manager `source_ref.py`; frontend-patterns +`reference_consume.py`; state-hub `scripts/verify_image_pin.py`. Each owner +confirms and re-points it. Token-aware already: state-hub `forge_projection.py`, +railiance-platform `forgejo_package_prune.py` and its provisioning scripts. +activity-core context resolvers are partly token-aware. Smoke probes of `/v2/` +(core-hub, ops-hub) only check reachability. + +**Not consumers.** Runbooks, docs and evidence that mention URLs; +`gitea.coulomb.social` references (frozen legacy host); kaizen-agentic project +URLs and whynot-design's SSH `repository` field. ## Not anonymous All 160 local clones use SSH with the founder's key (`forgejo-remote`). They keep working as long as that account can read the repositories. +## Founder checks (presence only, no secret values) + +Agents do not read Secrets, so run these in your own terminal and paste the output. + +1. ArgoCD repository credentials, by name, type and URL only: + + ```bash + kubectl -n argocd get secrets \ + -l 'argocd.argoproj.io/secret-type in (repository,repo-creds)' \ + -o go-template='{{range .items}}{{.metadata.name}} {{index .metadata.labels "argocd.argoproj.io/secret-type"}} {{if .data.url}}{{.data.url | base64decode}}{{end}}{{"\n"}}{{end}}' + ``` + +2. k3s registry configuration on railiance01, as key names with every value + stripped: + + ```bash + ssh railiance01 'sudo test -f /etc/rancher/k3s/registries.yaml \ + && sudo sed -nE "s/^([[:space:]]*[A-Za-z0-9_.\"-]+:).*/\1/p" /etc/rancher/k3s/registries.yaml \ + || echo absent' + ``` + + `absent`, or no `auth:` under the forge host, means all 43 pulls depend on + anonymous registry access today. + ## Still open for T02 -- Live verification: k3s node registry auth, ArgoCD repository credentials, and - a fresh runtime capture (the 2026-09-28 capture is the basis here). -- Per-entry review of `api-client`, `code-reference` and `ci-runner` hits, to - tell anonymous reads from authenticated writes. +- The two founder checks above. +- Owners confirm the code readers listed under "no token handling found". - Consumers outside these working trees (external sites and links, other people's clones) cannot be found by scanning; T08's anonymous probe after each wave is the backstop. diff --git a/inventory/runtime-2026-10-08.json b/inventory/runtime-2026-10-08.json new file mode 100644 index 0000000..8c74d27 --- /dev/null +++ b/inventory/runtime-2026-10-08.json @@ -0,0 +1,1720 @@ +{ + "applications": [ + { + "name": "activity-core", + "namespace": "argocd", + "project": "activity-core", + "sources": [ + { + "path": "k8s/gitops", + "repoURL": "https://forgejo.coulomb.social/coulomb/activity-core.git", + "targetRevision": "a86a14332d76d92a7ed176ea34dca4429902c396" + } + ] + }, + { + "name": "bao-notice", + "namespace": "argocd", + "project": "railiance-tenants", + "sources": [ + { + "path": "argocd/platform-addons/bao-notice", + "repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git", + "targetRevision": "9ee20967ca7b50a8926c99ae86fa027f8bfb0fa3" + } + ] + }, + { + "name": "eso-token-renewer", + "namespace": "argocd", + "project": "railiance-platform-addons", + "sources": [ + { + "path": "argocd/platform-addons/eso-token-renewer", + "repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git", + "targetRevision": "b2ebe108495c4d06ebb6ca33893ea4a2a23c9725" + } + ] + }, + { + "name": "informed-decision", + "namespace": "argocd", + "project": "informed-decision-lifecycle", + "sources": [ + { + "path": "deploy/lifecycle", + "repoURL": "https://forgejo.coulomb.social/coulomb/informed-decision.git", + "targetRevision": "9207a5134f92904f3843c200645ced91f247af72" + } + ] + }, + { + "name": "informed-decision-requester", + "namespace": "argocd", + "project": "informed-decision-requester", + "sources": [ + { + "path": "argocd/platform-addons/informed-decision-requester", + "repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git", + "targetRevision": "4332c391ea7f66479f67968222a45be4fc6e2f90" + } + ] + }, + { + "name": "openbao-secretstore", + "namespace": "argocd", + "project": "railiance-platform-addons", + "sources": [ + { + "path": "argocd/platform-addons/openbao-secretstore", + "repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git", + "targetRevision": "d2dbc19c254247652c49fda8721c80d53bca206a" + } + ] + }, + { + "name": "railiance-apps-root", + "namespace": "argocd", + "project": "railiance-bootstrap", + "sources": [ + { + "path": "argocd/railiance01/applications", + "repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git", + "targetRevision": "main" + } + ] + }, + { + "name": "secret-annotation-guard", + "namespace": "argocd", + "project": "railiance-platform-addons", + "sources": [ + { + "path": "argocd/platform-addons/secret-annotation-guard", + "repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git", + "targetRevision": "7daf7e90675b21c8f9556028e54aa8c0a13fd9f0" + } + ] + }, + { + "name": "state-hub-memo-dispatch", + "namespace": "argocd", + "project": "informed-decision-lifecycle", + "sources": [ + { + "path": "deploy/informed-decision", + "repoURL": "https://forgejo.coulomb.social/coulomb/state-hub.git", + "targetRevision": "1321361d85cf773aa6d051360be0159ac672eff2" + } + ] + }, + { + "name": "target-revenue", + "namespace": "argocd", + "project": "railiance-tenants", + "sources": [ + { + "path": "k8s/railiance", + "repoURL": "https://forgejo.coulomb.social/coulomb/target-revenue.git", + "targetRevision": "a3a8a27a8cda32ae3c7b55353ee16a131c50a0a0" + } + ] + } + ], + "cluster": "railiance01", + "coverage": "All namespaces; workload controller units, not pod/replicaset duplicates. Jobs may be historical; owners retained. Secrets never queried.", + "node_ip_verified": "92.205.62.239", + "projects": [ + { + "name": "activity-core", + "namespace": "argocd", + "sourceRepos": [ + "https://forgejo.coulomb.social/coulomb/activity-core.git" + ] + }, + { + "name": "default", + "namespace": "argocd", + "sourceRepos": [ + "*" + ] + }, + { + "name": "informed-decision-lifecycle", + "namespace": "argocd", + "sourceRepos": [ + "https://forgejo.coulomb.social/coulomb/informed-decision.git", + "https://forgejo.coulomb.social/coulomb/state-hub.git" + ] + }, + { + "name": "informed-decision-requester", + "namespace": "argocd", + "sourceRepos": [ + "https://forgejo.coulomb.social/coulomb/railiance-platform.git" + ] + }, + { + "name": "railiance-bootstrap", + "namespace": "argocd", + "sourceRepos": [ + "https://forgejo.coulomb.social/coulomb/railiance-platform.git" + ] + }, + { + "name": "railiance-platform-addons", + "namespace": "argocd", + "sourceRepos": [ + "https://forgejo.coulomb.social/coulomb/railiance-platform.git", + "https://charts.external-secrets.io" + ] + }, + { + "name": "railiance-tenants", + "namespace": "argocd", + "sourceRepos": [ + "https://forgejo.coulomb.social/coulomb/*.git", + "https://gitea.coulomb.social/coulomb/*.git" + ] + } + ], + "workloads": [ + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/activity-core@sha256:fdc631d7a154e3ae57098ae8c6e5a399617c3180859971f5d5269ee33e93ff2c" + ], + "kind": "Deployment", + "name": "actcore-api", + "namespace": "activity-core", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/activity-core@sha256:cd4e924c2809f0d1d319e53a9ddd20db2e88a1b543d62e6442702c184b7842f4" + ], + "kind": "Deployment", + "name": "actcore-event-router", + "namespace": "activity-core", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/state-hub:main-1cf949b" + ], + "kind": "Deployment", + "name": "actcore-statehub-edge-relay", + "namespace": "activity-core", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "temporalio/auto-setup:1.29.1" + ], + "kind": "Deployment", + "name": "actcore-temporal", + "namespace": "activity-core", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "temporalio/ui:latest" + ], + "kind": "Deployment", + "name": "actcore-temporal-ui", + "namespace": "activity-core", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/activity-core@sha256:fdc631d7a154e3ae57098ae8c6e5a399617c3180859971f5d5269ee33e93ff2c" + ], + "kind": "Deployment", + "name": "actcore-worker", + "namespace": "activity-core", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "docker.io/library/llm-connect:latest" + ], + "kind": "Deployment", + "name": "llm-connect", + "namespace": "activity-core", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "activity-core:railiance01-prod" + ], + "kind": "Job", + "name": "actcore-migrate", + "namespace": "activity-core", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "activity-core:wp0039-20260923" + ], + "kind": "Job", + "name": "actcore-migrate-wp0039", + "namespace": "activity-core", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "activity-core:fi-publication-20260914" + ], + "kind": "Job", + "name": "actcore-sync", + "namespace": "activity-core", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "postgres:16" + ], + "kind": "StatefulSet", + "name": "actcore-app-db", + "namespace": "activity-core", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "nats:2.10-alpine" + ], + "kind": "StatefulSet", + "name": "actcore-nats", + "namespace": "activity-core", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "postgres:16" + ], + "kind": "StatefulSet", + "name": "actcore-temporal-db", + "namespace": "activity-core", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/approval-engine@sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49" + ], + "kind": "StatefulSet", + "name": "approval-engine", + "namespace": "approval-engine", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "quay.io/argoproj/argocd:v3.5.3" + ], + "kind": "Deployment", + "name": "argocd-applicationset-controller", + "namespace": "argocd", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "public.ecr.aws/docker/library/redis:8.2.3-alpine", + "quay.io/argoproj/argocd:v3.5.3" + ], + "kind": "Deployment", + "name": "argocd-redis", + "namespace": "argocd", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "quay.io/argoproj/argocd:v3.5.3" + ], + "kind": "Deployment", + "name": "argocd-repo-server", + "namespace": "argocd", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "quay.io/argoproj/argocd:v3.5.3" + ], + "kind": "StatefulSet", + "name": "argocd-application-controller", + "namespace": "argocd", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/audit-core@sha256:ec15f63d49226bfe507af2bc38ffbd5e83f549ba2c6d1ae7a338e7e053f34615" + ], + "kind": "CronJob", + "name": "audit-core-attest-chain", + "namespace": "audit-core", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/audit-core@sha256:ec15f63d49226bfe507af2bc38ffbd5e83f549ba2c6d1ae7a338e7e053f34615" + ], + "kind": "Deployment", + "name": "audit-core", + "namespace": "audit-core", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/audit-core@sha256:ec15f63d49226bfe507af2bc38ffbd5e83f549ba2c6d1ae7a338e7e053f34615" + ], + "kind": "Job", + "name": "audit-core-attest-chain-29855717", + "namespace": "audit-core", + "owners": [ + { + "kind": "CronJob", + "name": "audit-core-attest-chain" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/audit-core@sha256:ec15f63d49226bfe507af2bc38ffbd5e83f549ba2c6d1ae7a338e7e053f34615" + ], + "kind": "Job", + "name": "audit-core-attest-chain-29857157", + "namespace": "audit-core", + "owners": [ + { + "kind": "CronJob", + "name": "audit-core-attest-chain" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "nginxinc/nginx-unprivileged@sha256:65e3e85dbaed8ba248841d9d58a899b6197106c23cb0ff1a132b7bfe0547e4c0" + ], + "kind": "Deployment", + "name": "bao-notice", + "namespace": "bao-notice", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/canned-prompts@sha256:d5de508ea66d3ad9e354f05ccb6f764bd3b01d290631558f0e866059e8a705a6" + ], + "kind": "Deployment", + "name": "canned-prompts", + "namespace": "canned-prompts", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "quay.io/jetstack/cert-manager-controller:v1.18.2" + ], + "kind": "Deployment", + "name": "cert-manager", + "namespace": "cert-manager", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "quay.io/jetstack/cert-manager-cainjector:v1.18.2" + ], + "kind": "Deployment", + "name": "cert-manager-cainjector", + "namespace": "cert-manager", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "quay.io/jetstack/cert-manager-webhook:v1.18.2" + ], + "kind": "Deployment", + "name": "cert-manager-webhook", + "namespace": "cert-manager", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "ghcr.io/cloudnative-pg/cloudnative-pg:1.25.1" + ], + "kind": "Deployment", + "name": "cnpg-controller-manager", + "namespace": "cnpg-system", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/core-hub@sha256:388a94ec752e13a0031e329a45e970480c41691e969d4e40c31924669e8d0005" + ], + "kind": "Deployment", + "name": "core-hub-api", + "namespace": "core-hub", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/hub-core@sha256:a3461c0da805ef2b58caa0c862be3dc6562abcca186300d1257df9b96569b4c0" + ], + "kind": "Deployment", + "name": "core-hub-api-candidate", + "namespace": "core-hub", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/repo-manager@sha256:69d00898cfa1ff0a4b7db8cdc86d15f5f4bea4526915019d3ca82b6f5574354c" + ], + "kind": "Deployment", + "name": "core-hub-api-repository-publisher", + "namespace": "core-hub", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/core-hub@sha256:0db6f7c646c6d4c1fbc844dc266fcf883584637e1c1f47802efe1c6a98558d3c" + ], + "kind": "Job", + "name": "core-hub-prod-migrate", + "namespace": "core-hub", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/hub-core@sha256:6f9a0318349221a6db4e958383791f5bc9398c0df7bef4c8118d8a16b9ec6e4d" + ], + "kind": "Job", + "name": "hub-core-candidate-migrate", + "namespace": "core-hub", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "92.205.130.254:32166/coulomb/ihp-railiance-probe:d0162d5" + ], + "kind": "Deployment", + "name": "ihp-railiance-probe", + "namespace": "coulomb", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/coulomb-social@sha256:9a646d8e01a61ba5316d3c2eb0273064e17f2d0300ad07af766ccedda65ecb18" + ], + "kind": "Deployment", + "name": "coulomb-social", + "namespace": "coulomb-social", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "ghcr.io/cloudnative-pg/postgresql:16" + ], + "kind": "Cluster", + "name": "apps-pg", + "namespace": "databases", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "ghcr.io/cloudnative-pg/postgresql:16" + ], + "kind": "Cluster", + "name": "forgejo-db", + "namespace": "databases", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "ghcr.io/cloudnative-pg/postgresql:16" + ], + "kind": "Cluster", + "name": "net-kingdom-pg", + "namespace": "databases", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "ghcr.io/cloudnative-pg/postgresql:16.10-system-trixie" + ], + "kind": "Cluster", + "name": "platform-pg", + "namespace": "databases", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "ghcr.io/cloudnative-pg/postgresql:16.10-system-trixie" + ], + "kind": "Cluster", + "name": "platform-pg-2", + "namespace": "databases", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "ghcr.io/cloudnative-pg/postgresql:16" + ], + "kind": "Cluster", + "name": "state-hub-db", + "namespace": "databases", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/email-connect@sha256:eb3e7b68d21209e9eb71b928a5b0bc987e8e3164f21dca4ff712f946d0c103f2" + ], + "kind": "Deployment", + "name": "email-connect", + "namespace": "email-connect", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "python:3.12-slim@sha256:d764629ce0ddd8c71fd371e9901efb324a95789d2315a47db7e4d27e78f1b0e9" + ], + "kind": "CronJob", + "name": "eso-token-renewer", + "namespace": "external-secrets", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "oci.external-secrets.io/external-secrets/external-secrets:v0.16.1" + ], + "kind": "Deployment", + "name": "external-secrets", + "namespace": "external-secrets", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "oci.external-secrets.io/external-secrets/external-secrets:v0.16.1" + ], + "kind": "Deployment", + "name": "external-secrets-cert-controller", + "namespace": "external-secrets", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "oci.external-secrets.io/external-secrets/external-secrets:v0.16.1" + ], + "kind": "Deployment", + "name": "external-secrets-webhook", + "namespace": "external-secrets", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "python:3.12-slim@sha256:d764629ce0ddd8c71fd371e9901efb324a95789d2315a47db7e4d27e78f1b0e9" + ], + "kind": "Job", + "name": "eso-token-renewer-29854240", + "namespace": "external-secrets", + "owners": [ + { + "kind": "CronJob", + "name": "eso-token-renewer" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "python:3.12-slim@sha256:d764629ce0ddd8c71fd371e9901efb324a95789d2315a47db7e4d27e78f1b0e9" + ], + "kind": "Job", + "name": "eso-token-renewer-29855680", + "namespace": "external-secrets", + "owners": [ + { + "kind": "CronJob", + "name": "eso-token-renewer" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "python:3.12-slim@sha256:d764629ce0ddd8c71fd371e9901efb324a95789d2315a47db7e4d27e78f1b0e9" + ], + "kind": "Job", + "name": "eso-token-renewer-29857120", + "namespace": "external-secrets", + "owners": [ + { + "kind": "CronJob", + "name": "eso-token-renewer" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/flex-auth@sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99" + ], + "kind": "Deployment", + "name": "flex-auth-informed-decision-lifecycle", + "namespace": "flex-auth", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/flex-auth@sha256:6c6dc263f4a7f6461e109e133c004c080e8e373acfead8611856c5fb3e44168e" + ], + "kind": "Deployment", + "name": "flex-auth-informed-decision-sitting", + "namespace": "flex-auth", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/flex-auth@sha256:6600c7a62c36dfb4fbb42590722613827d07ff49875b1f0f4b5de63d8351658d" + ], + "kind": "Deployment", + "name": "flex-auth-informed-decision-t03", + "namespace": "flex-auth", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/flex-auth@sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b" + ], + "kind": "Deployment", + "name": "flex-auth-ops-warden", + "namespace": "flex-auth", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/flex-auth@sha256:419bc37420d0d0a5304a8587448f1fdbf87117fb041fb43081b0449b4a7bb13b" + ], + "kind": "Deployment", + "name": "flex-auth-ops-warden-fetch", + "namespace": "flex-auth", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/flex-auth@sha256:05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd" + ], + "kind": "Deployment", + "name": "flex-auth-secrets-engine", + "namespace": "flex-auth", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/flex-auth@sha256:05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd" + ], + "kind": "Deployment", + "name": "flex-auth-tenant-engine", + "namespace": "flex-auth", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/flex-auth@sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b" + ], + "kind": "Deployment", + "name": "flex-auth-user-engine", + "namespace": "flex-auth", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "code.forgejo.org/forgejo/forgejo:11.0.3-rootless" + ], + "kind": "Deployment", + "name": "forgejo-gitea", + "namespace": "forgejo", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "code.forgejo.org/forgejo/runner:6.3.1", + "docker:27-dind" + ], + "kind": "Deployment", + "name": "forgejo-runner", + "namespace": "forgejo", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173" + ], + "kind": "Deployment", + "name": "informed-decision", + "namespace": "informed-decision", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "92.205.130.254:32166/coulomb/inter-hub:790b5e5" + ], + "kind": "Deployment", + "name": "inter-hub", + "namespace": "inter-hub", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/issue-core@sha256:a56c80ccbd1690bc0bcea384165b1967704f0fdbaf1c506ce1082f56190b92cf" + ], + "kind": "Deployment", + "name": "issue-core", + "namespace": "issue-core", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "gcr.io/knative-releases/knative.dev/serving/cmd/activator@sha256:8f7e9df2642a8ba715ebc55b62abee17b0984b6b6af0c6ec00dabaadf5f8cccb" + ], + "kind": "Deployment", + "name": "activator", + "namespace": "knative-serving", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler@sha256:ec66d97244395b57a67923d4a8c5a95f0264805f1fdb2ee0cdb49ec0f3bd7855" + ], + "kind": "Deployment", + "name": "autoscaler", + "namespace": "knative-serving", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "gcr.io/knative-releases/knative.dev/serving/cmd/controller@sha256:6833f2c83e9f356c274ddb2de40e5471ad2b1c08882c9bd11f5afa240e86d574" + ], + "kind": "Deployment", + "name": "controller", + "namespace": "knative-serving", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier@sha256:a2e8f568a4bf68ef6391bc3afea956d11a8698f6a22c4be50844b1da4f8bcc74" + ], + "kind": "Deployment", + "name": "net-kourier-controller", + "namespace": "knative-serving", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "gcr.io/knative-releases/knative.dev/serving/cmd/webhook@sha256:c505888f7ee34ccadc1b9a6877d6d49691f633ea28cf8cbe03fcfa6d3afcd584" + ], + "kind": "Deployment", + "name": "webhook", + "namespace": "knative-serving", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "docker.io/envoyproxy/envoy@sha256:1c2b79776c6e3b38e8b0113b825e6a599f9bfc08d680c199d80bf8964856c529" + ], + "kind": "Deployment", + "name": "3scale-kourier-gateway", + "namespace": "kourier-system", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "rancher/klipper-lb:v0.4.14" + ], + "kind": "DaemonSet", + "name": "svclb-traefik-0c8aecaf", + "namespace": "kube-system", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "rancher/mirrored-coredns-coredns:1.14.1" + ], + "kind": "Deployment", + "name": "coredns", + "namespace": "kube-system", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "rancher/local-path-provisioner:v0.0.34" + ], + "kind": "Deployment", + "name": "local-path-provisioner", + "namespace": "kube-system", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "rancher/mirrored-metrics-server:v0.8.1" + ], + "kind": "Deployment", + "name": "metrics-server", + "namespace": "kube-system", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "rancher/mirrored-library-traefik:3.6.7" + ], + "kind": "Deployment", + "name": "traefik", + "namespace": "kube-system", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "rancher/klipper-helm:v0.9.14-build20260210" + ], + "kind": "Job", + "name": "helm-install-traefik", + "namespace": "kube-system", + "owners": [ + { + "kind": "HelmChart", + "name": "traefik" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "rancher/klipper-helm:v0.9.14-build20260210" + ], + "kind": "Job", + "name": "helm-install-traefik-crd", + "namespace": "kube-system", + "owners": [ + { + "kind": "HelmChart", + "name": "traefik-crd" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "busybox:stable" + ], + "kind": "CronJob", + "name": "privacyidea-backup", + "namespace": "mfa", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "busybox:1.36", + "ghcr.io/gpappsoft/privacyidea-docker:3.12.2", + "ghcr.io/gpappsoft/privacyidea-docker@sha256:af7841adad262f129e0c1d4f553af13f21cb2f4dc713533f316cfe43ed0b4473" + ], + "kind": "Deployment", + "name": "privacyidea", + "namespace": "mfa", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "busybox:stable" + ], + "kind": "Job", + "name": "privacyidea-backup-29854290", + "namespace": "mfa", + "owners": [ + { + "kind": "CronJob", + "name": "privacyidea-backup" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "busybox:stable" + ], + "kind": "Job", + "name": "privacyidea-backup-29855730", + "namespace": "mfa", + "owners": [ + { + "kind": "CronJob", + "name": "privacyidea-backup" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "busybox:stable" + ], + "kind": "Job", + "name": "privacyidea-backup-29857170", + "namespace": "mfa", + "owners": [ + { + "kind": "CronJob", + "name": "privacyidea-backup" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "nginx:1.27-alpine" + ], + "kind": "Deployment", + "name": "openbao-ui-gateway", + "namespace": "openbao", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "quay.io/openbao/openbao:2.5.4" + ], + "kind": "StatefulSet", + "name": "openbao", + "namespace": "openbao", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "minio/minio:RELEASE.2024-12-18T13-15-44Z" + ], + "kind": "Deployment", + "name": "drill-minio", + "namespace": "platform-pg-drill", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/policy-nexus@sha256:23df0ab3dc80d2a92b8058eeb572c222ceb05d17434f173a24142b2450ab3cea" + ], + "kind": "Deployment", + "name": "policy-nexus", + "namespace": "policy-nexus", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "92.205.130.254:32166/coulomb/rapp-qonto@sha256:62a1bd9f0ac08f3e127a64862b1cb8fe0a041b4eaf25ec64324696f5c147ef7c", + "docker.io/curlimages/curl@sha256:94e9e444bcba979c2ea12e27ae39bee4cd10bc7041a472c4727a558e213744e6", + "gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:371c23206b7bd924474b07e51435198579133eb98fba27a5cb3db9e6ba63b06b" + ], + "kind": "Deployment", + "name": "rapp-qonto-00001-deployment", + "namespace": "rapp-qonto", + "owners": [ + { + "kind": "Revision", + "name": "rapp-qonto-00001" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "92.205.130.254:32166/coulomb/rapp-qonto@sha256:62a1bd9f0ac08f3e127a64862b1cb8fe0a041b4eaf25ec64324696f5c147ef7c", + "docker.io/curlimages/curl@sha256:94e9e444bcba979c2ea12e27ae39bee4cd10bc7041a472c4727a558e213744e6", + "gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:371c23206b7bd924474b07e51435198579133eb98fba27a5cb3db9e6ba63b06b" + ], + "kind": "Deployment", + "name": "rapp-qonto-00002-deployment", + "namespace": "rapp-qonto", + "owners": [ + { + "kind": "Revision", + "name": "rapp-qonto-00002" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "92.205.130.254:32166/coulomb/rapp-qonto@sha256:62a1bd9f0ac08f3e127a64862b1cb8fe0a041b4eaf25ec64324696f5c147ef7c", + "docker.io/curlimages/curl@sha256:94e9e444bcba979c2ea12e27ae39bee4cd10bc7041a472c4727a558e213744e6", + "gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:371c23206b7bd924474b07e51435198579133eb98fba27a5cb3db9e6ba63b06b" + ], + "kind": "Deployment", + "name": "rapp-qonto-00003-deployment", + "namespace": "rapp-qonto", + "owners": [ + { + "kind": "Revision", + "name": "rapp-qonto-00003" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "92.205.130.254:32166/coulomb/rapp-qonto@sha256:62a1bd9f0ac08f3e127a64862b1cb8fe0a041b4eaf25ec64324696f5c147ef7c", + "docker.io/curlimages/curl@sha256:94e9e444bcba979c2ea12e27ae39bee4cd10bc7041a472c4727a558e213744e6", + "gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:371c23206b7bd924474b07e51435198579133eb98fba27a5cb3db9e6ba63b06b" + ], + "kind": "Deployment", + "name": "rapp-qonto-00004-deployment", + "namespace": "rapp-qonto", + "owners": [ + { + "kind": "Revision", + "name": "rapp-qonto-00004" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "92.205.130.254:32166/coulomb/rapp-qonto@sha256:62a1bd9f0ac08f3e127a64862b1cb8fe0a041b4eaf25ec64324696f5c147ef7c", + "docker.io/curlimages/curl@sha256:94e9e444bcba979c2ea12e27ae39bee4cd10bc7041a472c4727a558e213744e6", + "gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:371c23206b7bd924474b07e51435198579133eb98fba27a5cb3db9e6ba63b06b" + ], + "kind": "Deployment", + "name": "rapp-qonto-00005-deployment", + "namespace": "rapp-qonto", + "owners": [ + { + "kind": "Revision", + "name": "rapp-qonto-00005" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "92.205.130.254:32166/coulomb/rapp-qonto@sha256:62a1bd9f0ac08f3e127a64862b1cb8fe0a041b4eaf25ec64324696f5c147ef7c", + "docker.io/curlimages/curl@sha256:94e9e444bcba979c2ea12e27ae39bee4cd10bc7041a472c4727a558e213744e6", + "gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:371c23206b7bd924474b07e51435198579133eb98fba27a5cb3db9e6ba63b06b" + ], + "kind": "Deployment", + "name": "rapp-qonto-00006-deployment", + "namespace": "rapp-qonto", + "owners": [ + { + "kind": "Revision", + "name": "rapp-qonto-00006" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "92.205.130.254:32166/coulomb/rapp-qonto@sha256:62a1bd9f0ac08f3e127a64862b1cb8fe0a041b4eaf25ec64324696f5c147ef7c", + "docker.io/curlimages/curl@sha256:94e9e444bcba979c2ea12e27ae39bee4cd10bc7041a472c4727a558e213744e6", + "gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:371c23206b7bd924474b07e51435198579133eb98fba27a5cb3db9e6ba63b06b" + ], + "kind": "Deployment", + "name": "rapp-qonto-00007-deployment", + "namespace": "rapp-qonto", + "owners": [ + { + "kind": "Revision", + "name": "rapp-qonto-00007" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "92.205.130.254:32166/coulomb/rapp-qonto@sha256:62a1bd9f0ac08f3e127a64862b1cb8fe0a041b4eaf25ec64324696f5c147ef7c", + "docker.io/curlimages/curl@sha256:94e9e444bcba979c2ea12e27ae39bee4cd10bc7041a472c4727a558e213744e6", + "gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:371c23206b7bd924474b07e51435198579133eb98fba27a5cb3db9e6ba63b06b" + ], + "kind": "Deployment", + "name": "rapp-qonto-00008-deployment", + "namespace": "rapp-qonto", + "owners": [ + { + "kind": "Revision", + "name": "rapp-qonto-00008" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "docker.io/curlimages/curl@sha256:94e9e444bcba979c2ea12e27ae39bee4cd10bc7041a472c4727a558e213744e6", + "forgejo.coulomb.social/coulomb/rapp-qonto@sha256:2e42b5e665a19ffa3b3ae8109a8aab64f5485329f72810be063263ff5086cb3f", + "gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:371c23206b7bd924474b07e51435198579133eb98fba27a5cb3db9e6ba63b06b" + ], + "kind": "Deployment", + "name": "rapp-qonto-00009-deployment", + "namespace": "rapp-qonto", + "owners": [ + { + "kind": "Revision", + "name": "rapp-qonto-00009" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "docker.io/curlimages/curl@sha256:94e9e444bcba979c2ea12e27ae39bee4cd10bc7041a472c4727a558e213744e6", + "forgejo.coulomb.social/coulomb/rapp-qonto@sha256:2e42b5e665a19ffa3b3ae8109a8aab64f5485329f72810be063263ff5086cb3f" + ], + "kind": "Service", + "name": "rapp-qonto", + "namespace": "rapp-qonto", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "docker.io/ubuntu/squid@sha256:8a3baed477e2c282ab8aa5edad442f69873246964f225c5c2ae8364b6610963c" + ], + "kind": "Deployment", + "name": "qonto-egress-proxy", + "namespace": "rapp-qonto-egress", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "rein-aharness:railiance01" + ], + "kind": "Deployment", + "name": "rein-aharness", + "namespace": "rein-aharness", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/reuse-surface:main-6cbc862" + ], + "kind": "Deployment", + "name": "reuse-surface", + "namespace": "reuse", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "nginxinc/nginx-unprivileged:1.27-alpine" + ], + "kind": "Deployment", + "name": "reuse-surface-landing", + "namespace": "reuse", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/sbom-nexus@sha256:1da0f4f008643a0dec3f00bbad15f287103aa4b469577b78cfe1d67f8b3cbe31" + ], + "kind": "Deployment", + "name": "sbom-nexus", + "namespace": "sbom-nexus", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "nouchka/sqlite3:latest" + ], + "kind": "CronJob", + "name": "authelia-backup", + "namespace": "sso", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "python:3.12-slim@sha256:d764629ce0ddd8c71fd371e9901efb324a95789d2315a47db7e4d27e78f1b0e9" + ], + "kind": "CronJob", + "name": "keycape-factor-renewer", + "namespace": "sso", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "nouchka/sqlite3:latest" + ], + "kind": "CronJob", + "name": "lldap-backup", + "namespace": "sso", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "docker.io/authelia/authelia@sha256:bd97cff4fcbf715b5ff1f9ae286afbe6033afce385302520b0368122d43a6f54" + ], + "kind": "Deployment", + "name": "authelia", + "namespace": "sso", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/identity-provisioner@sha256:ffacd5d790a5b7800e0535f3aa95b7de52c7a68e4f575b9192c3e1622fa672c2" + ], + "kind": "Deployment", + "name": "identity-provisioner", + "namespace": "sso", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/key-cape@sha256:6f79a2af1c695d39480173fad013facd84d21e7732860366af519302a2c496b8" + ], + "kind": "Deployment", + "name": "keycape", + "namespace": "sso", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "lldap/lldap:stable" + ], + "kind": "Deployment", + "name": "lldap", + "namespace": "sso", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "nouchka/sqlite3:latest" + ], + "kind": "Job", + "name": "authelia-backup-29855715", + "namespace": "sso", + "owners": [ + { + "kind": "CronJob", + "name": "authelia-backup" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "nouchka/sqlite3:latest" + ], + "kind": "Job", + "name": "authelia-backup-29857155", + "namespace": "sso", + "owners": [ + { + "kind": "CronJob", + "name": "authelia-backup" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "nouchka/sqlite3:latest" + ], + "kind": "Job", + "name": "csoc-authelia-pre-smtp-20261006", + "namespace": "sso", + "owners": [ + { + "kind": "CronJob", + "name": "authelia-backup" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "python:3.12-slim@sha256:d764629ce0ddd8c71fd371e9901efb324a95789d2315a47db7e4d27e78f1b0e9" + ], + "kind": "Job", + "name": "keycape-factor-renewer-29857830", + "namespace": "sso", + "owners": [ + { + "kind": "CronJob", + "name": "keycape-factor-renewer" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "python:3.12-slim@sha256:d764629ce0ddd8c71fd371e9901efb324a95789d2315a47db7e4d27e78f1b0e9" + ], + "kind": "Job", + "name": "keycape-factor-renewer-29857840", + "namespace": "sso", + "owners": [ + { + "kind": "CronJob", + "name": "keycape-factor-renewer" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "nouchka/sqlite3:latest" + ], + "kind": "Job", + "name": "lldap-backup-29854260", + "namespace": "sso", + "owners": [ + { + "kind": "CronJob", + "name": "lldap-backup" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "nouchka/sqlite3:latest" + ], + "kind": "Job", + "name": "lldap-backup-29855700", + "namespace": "sso", + "owners": [ + { + "kind": "CronJob", + "name": "lldap-backup" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "nouchka/sqlite3:latest" + ], + "kind": "Job", + "name": "lldap-backup-29857140", + "namespace": "sso", + "owners": [ + { + "kind": "CronJob", + "name": "lldap-backup" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/state-hub:main-7d99282" + ], + "kind": "Deployment", + "name": "state-hub", + "namespace": "state-hub", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/state-hub:main-7d99282" + ], + "kind": "Deployment", + "name": "state-hub-mcp", + "namespace": "state-hub", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/state-hub-memo-dispatch@sha256:410fb6b6c9fd7a7ee0b63d727fd3249fb3ae13943421d6a5ce88b7ad2520bd2f" + ], + "kind": "Deployment", + "name": "state-hub-memo-dispatch", + "namespace": "state-hub", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "ghcr.io/cloudnative-pg/postgresql:16" + ], + "kind": "Cluster", + "name": "target-revenue-pg", + "namespace": "target-revenue", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/target-revenue:0.1.4" + ], + "kind": "Deployment", + "name": "target-revenue", + "namespace": "target-revenue", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "docker.io/grafana/grafana:13.2.1-distroless", + "docker.io/library/busybox:1.38.0", + "quay.io/kiwigrid/k8s-sidecar:2.11.2" + ], + "kind": "Deployment", + "name": "telemetry-grafana", + "namespace": "telemetry", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0" + ], + "kind": "Deployment", + "name": "telemetry-kube-state-metrics", + "namespace": "telemetry", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "quay.io/prometheus-operator/prometheus-operator:v0.93.1" + ], + "kind": "Deployment", + "name": "telemetry-operator", + "namespace": "telemetry", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/railiance-telemetry-ack@sha256:75f5a2235ebf55e3cb75afd95cfd776c0f57e3a0e2607e60b3a8402b339dbd62" + ], + "kind": "Job", + "name": "telemetry-smtp-proof-20260928", + "namespace": "telemetry", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/railiance-telemetry-ack@sha256:75f5a2235ebf55e3cb75afd95cfd776c0f57e3a0e2607e60b3a8402b339dbd62" + ], + "kind": "Job", + "name": "telemetry-smtp-proof-20260928-egress", + "namespace": "telemetry", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "quay.io/prometheus-operator/prometheus-config-reloader:v0.93.1", + "quay.io/prometheus/alertmanager:v0.34.0" + ], + "kind": "StatefulSet", + "name": "alertmanager-telemetry-alertmanager", + "namespace": "telemetry", + "owners": [ + { + "kind": "Alertmanager", + "name": "telemetry-alertmanager" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "quay.io/prometheus-operator/prometheus-config-reloader:v0.93.1", + "quay.io/prometheus/prometheus:v3.14.0-distroless" + ], + "kind": "StatefulSet", + "name": "prometheus-telemetry-prometheus", + "namespace": "telemetry", + "owners": [ + { + "kind": "Prometheus", + "name": "telemetry-prometheus" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/tenant-engine@sha256:a8e8086ffc5b772c1391b166f5e1884b90f7d327b152c205eceae129df555c24" + ], + "kind": "Deployment", + "name": "tenant-engine", + "namespace": "tenant-engine", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "ghcr.io/cloudnative-pg/postgresql:17.5" + ], + "kind": "Cluster", + "name": "user-engine-pg", + "namespace": "user-engine", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "ghcr.io/cloudnative-pg/postgresql:17.5" + ], + "kind": "CronJob", + "name": "user-engine-backup", + "namespace": "user-engine", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/user-engine@sha256:030fe90232e20bb02b372e3d16b8ff659a5407d54f6405eb85754262b9ad7dc6" + ], + "kind": "Deployment", + "name": "user-engine", + "namespace": "user-engine", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "ghcr.io/cloudnative-pg/postgresql:17.5" + ], + "kind": "Job", + "name": "user-engine-backup-29854320", + "namespace": "user-engine", + "owners": [ + { + "kind": "CronJob", + "name": "user-engine-backup" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "ghcr.io/cloudnative-pg/postgresql:17.5" + ], + "kind": "Job", + "name": "user-engine-backup-29855760", + "namespace": "user-engine", + "owners": [ + { + "kind": "CronJob", + "name": "user-engine-backup" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "ghcr.io/cloudnative-pg/postgresql:17.5" + ], + "kind": "Job", + "name": "user-engine-backup-29857200", + "namespace": "user-engine", + "owners": [ + { + "kind": "CronJob", + "name": "user-engine-backup" + } + ] + }, + { + "image_pull_secret_names": [], + "images": [ + "ghcr.io/cloudnative-pg/postgresql:17.5" + ], + "kind": "Job", + "name": "user-engine-restore-drill", + "namespace": "user-engine", + "owners": [] + }, + { + "image_pull_secret_names": [], + "images": [ + "forgejo.coulomb.social/coulomb/vergabe-teilnahme@sha256:a26444f59c259698159c69ccb96f73dc648a261ece4c86bb2037a9d977870d91" + ], + "kind": "Deployment", + "name": "vergabe-teilnahme", + "namespace": "vergabe-demo-company", + "owners": [] + } + ] +} diff --git a/workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md b/workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md index d447816..8b9fa01 100644 --- a/workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md +++ b/workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md @@ -146,12 +146,17 @@ Output a machine-readable `inventory/access-consumers-.json` plus a summary listing, per consumer class, the owner and the proposed credential kind. Uncertain entries are flagged, not dropped. -2026-10-08: first pass done. `tools/access_consumers.py` produced -`inventory/access-consumers-2026-10-08.json`, summarised in -`inventory/access-consumers.md`. Headline: 40 cluster workloads pull forge images -with no `imagePullSecrets`; 6 ArgoCD applications read forge Git; local clones -are SSH and unaffected. Open: live check of node registry auth and ArgoCD -credentials, and a per-entry review of api-client, code and CI hits. +2026-10-08: inventory done except two founder checks. `tools/access_consumers.py` +over 161 working trees and a fresh runtime capture (`inventory/runtime-2026-10-08.json`) +produced `inventory/access-consumers-2026-10-08.json`, reviewed in +`inventory/access-consumers.md`. Breaks on closure: 43 workloads pulling forge +images without `imagePullSecrets` (anonymous registry pulls confirmed working); +10 ArgoCD applications over 5 repos; CI in about 20 repos downloading source +tarballs anonymously; PyPI index reads; reuse-surface federation (about 60 raw +indexes); about 8 code readers without token handling; campaign images. Local +clones are SSH and unaffected. Open: founder presence checks for ArgoCD +repository credentials and k3s node registry auth (commands in the summary), +and owner confirmation of the code readers. ```task id: ORGREF-WP-0002-T03