deploy: bind demo company to published tenant-path release
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
parent
8f29af4b63
commit
428d0707e0
4 changed files with 62 additions and 30 deletions
|
|
@ -1,22 +1,22 @@
|
|||
# Vergabe demo-company deployment binding
|
||||
|
||||
Prepared 2026-09-11 under RAPPS-WP-0014-T02 and VERGABE-WP-0019-T03/T04.
|
||||
This is an execution packet; native tenant creation and deployment are pending.
|
||||
Native tenant creation is verified; application placement and onboarding remain pending.
|
||||
|
||||
| Item | Binding / execution status |
|
||||
| --- | --- |
|
||||
| Tenant | `tenant:trial:demo-company`; display `demo-company`; native creation pending |
|
||||
| Tenant | `tenant:trial:demo-company`; display `demo-company`; active, version 1; native operator create/readback verified |
|
||||
| Purpose / data | New demo workspace; synthetic data only; no existing data import |
|
||||
| Initial accounts | `demo-user1`, `demo-user2`, ordinary members; creation and private credential setup pending |
|
||||
| Operator / acceptance | Bernd Worsch via authenticated existing operator path |
|
||||
| Cluster | Railiance01, kube-system UID `a553c742-0115-43d4-99a4-a5ca56fe0786` |
|
||||
| Proposed namespace | `vergabe-demo-company`; create separately from historical installations |
|
||||
| Helm release | `vergabe-teilnahme` within that namespace |
|
||||
| Image source | `ccb6d1f8c7abd50f2ef654491bb1aa5861e795cb`; live CI 29 / publication 31 passed |
|
||||
| Image digest | `forgejo.coulomb.social/coulomb/vergabe-teilnahme@sha256:963240ef4180a01e5b8af7fbeb88be27e56203a45da8ecd633326b4c6d262005` |
|
||||
| Image source | Tenant-path source `9345a1bb1a92ac0ee3b2dc6443a3d299e6754e70`; CI smoke 43 / publication 44 passed |
|
||||
| Image digest | `forgejo.coulomb.social/coulomb/vergabe-teilnahme@sha256:cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68` |
|
||||
| Chart baseline | 0.2.0 at railiance-apps `9491744e5adab4464070c164d7172a7392ae1e15` |
|
||||
| Resources | One Recreate replica, CPU request 60m / limit 1000m, memory request 256Mi / limit 1Gi |
|
||||
| Proposed URL | `https://demo-vergabe.coulomb.social`; user preference pending |
|
||||
| Selected URL | `https://vergabe-teilnahme.coulomb.social/demo-company/`; one product host, exact tenant path |
|
||||
| Public edge | DNS, TLS and login abuse-control configuration pending; expected target 92.205.62.239 |
|
||||
| Proposed database / role | Fresh `vergabe_demo_company` / `vergabe_demo_company` on `databases/apps-pg`; platform provisioning/custody pending |
|
||||
| Runtime Secret | `vergabe-demo-env` in the dedicated namespace; platform delivery pending, no secret values in this packet |
|
||||
|
|
@ -34,7 +34,11 @@ Its `/login` uses KeyCape and the registered native callback. The authenticated
|
|||
platform form creates `tenant:trial:demo-company` through Tenant Engine. Record
|
||||
the response and read back the exact tenant before creating memberships. Do not
|
||||
substitute a service actor, fabricate verified claims, or bypass policy on denial.
|
||||
An operator browser has been opened; native login/creation is not yet confirmed.
|
||||
Native login and operator creation succeeded at 19:03:18 UTC. Tenant Engine
|
||||
confirms demo-company active/version 1; User Engine contains the first
|
||||
administrator with invited status. A subsequent Create login fails with an
|
||||
LLDAP service-login 401. NK-WP-0036-T04 owns the attended credential-reference
|
||||
repair; no directory identity is inferred from the user-domain record.
|
||||
|
||||
Create two ordinary memberships through User Engine. Confirm how the identity
|
||||
provisioner assigns login names before provisioning the requested demo names;
|
||||
|
|
@ -45,14 +49,18 @@ This establishes a platform tenant and a bounded app pilot, not completed SSO.
|
|||
|
||||
## Hostname and deployment execution
|
||||
|
||||
`helm/vergabe-demo-company-values.proposed.yaml` pins the published image and
|
||||
60m resources, and consistently uses the proposed host for Django and probes.
|
||||
The chart does not itself create public ingress or DNS. Confirm the preferred
|
||||
hostname, point its DNS to Railiance01 through the DNS owner, configure the
|
||||
HTTPS route and abuse control through the existing edge lane, and verify TLS.
|
||||
On 2026-09-11 the proposed hostname resolved to 80.158.43.29; the legacy
|
||||
`vergabe-teilnahme.whywhynot.de` resolved to 92.205.130.254. Neither was the
|
||||
intended Railiance01 address. No DNS changes have been made.
|
||||
`helm/vergabe-demo-company-values.proposed.yaml` retains 60m resources and the
|
||||
selected product host, APP_BASE_PATH=/demo-company and published immutable
|
||||
digest. The chart does not create ingress or DNS.
|
||||
The edge must match exactly /demo-company or /demo-company/, canonicalize the
|
||||
bare path and strip the prefix. It must keep private media on the app route and
|
||||
apply TLS and the admitted abuse-control policy. Do not route neighboring paths
|
||||
to this instance. Company/data separation remains the dedicated database and
|
||||
volumes, not a forwarded header or browser path.
|
||||
|
||||
On 2026-09-11 the selected product hostname resolves to 80.158.43.29; Railiance01
|
||||
is 92.205.62.239. No DNS changes have been made. A single product DNS/certificate
|
||||
serves this arrangement; tenants do not need their own subdomains.
|
||||
|
||||
Complete platform database/Secret provisioning and the source-backed namespace,
|
||||
network and public edge manifests before deployment. Then migrate the fresh
|
||||
|
|
|
|||
|
|
@ -140,3 +140,13 @@ database/backup metadata; no customer data was read, selected for reuse or
|
|||
modified. The user subsequently selected a new demo-company workspace; the
|
||||
prepared binding explicitly uses a fresh database and leaves historical data
|
||||
untouched.
|
||||
|
||||
|
||||
2026-09-11 update: the selected customer URL is
|
||||
https://vergabe-teilnahme.coulomb.social/demo-company/. Native demo-company
|
||||
creation and first-administrator registration are verified. Identity login
|
||||
provisioning currently fails its LLDAP service authentication, tracked by
|
||||
NK-WP-0036-T04. Tenant-path application source 9345a1b passes 98 tests and seven
|
||||
local browser checks; image publication 44 passed with digest
|
||||
sha256:cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68.
|
||||
Live edge/data admission remains open. See the updated demo-company binding for execution status.
|
||||
|
|
|
|||
|
|
@ -1,10 +1,10 @@
|
|||
# Proposed binding only; see docs/vergabe-demo-company-binding.md.
|
||||
# Native tenant, database/Secret, DNS/TLS and edge admission are still pending.
|
||||
# Tenant and published image are verified; database/Secret and DNS/TLS admission are pending.
|
||||
# Release vergabe-teilnahme; namespace vergabe-demo-company.
|
||||
pilot:
|
||||
enabled: true
|
||||
image:
|
||||
digest: sha256:963240ef4180a01e5b8af7fbeb88be27e56203a45da8ecd633326b4c6d262005
|
||||
digest: sha256:cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68
|
||||
replicaCount: 1
|
||||
resources:
|
||||
requests:
|
||||
|
|
@ -15,11 +15,12 @@ resources:
|
|||
memory: 1Gi
|
||||
envSecretName: vergabe-demo-env
|
||||
env:
|
||||
APP_BASE_PATH: /demo-company
|
||||
DJANGO_SETTINGS_MODULE: vergabe_teilnahme.settings.prod
|
||||
ALLOWED_HOSTS: demo-vergabe.coulomb.social,localhost
|
||||
CSRF_TRUSTED_ORIGINS: https://demo-vergabe.coulomb.social
|
||||
ALLOWED_HOSTS: vergabe-teilnahme.coulomb.social,localhost
|
||||
CSRF_TRUSTED_ORIGINS: https://vergabe-teilnahme.coulomb.social
|
||||
probes:
|
||||
hostHeader: demo-vergabe.coulomb.social
|
||||
hostHeader: vergabe-teilnahme.coulomb.social
|
||||
persistence:
|
||||
media:
|
||||
enabled: true
|
||||
|
|
|
|||
|
|
@ -39,7 +39,7 @@ values template prepare the deployment; no live resources were changed.
|
|||
id: RAPPS-WP-0014-T02
|
||||
status: progress
|
||||
needs_human: true
|
||||
intervention_note: "Company and fresh data are selected. Await native User Engine operator login for demo-company creation; proposed hostname preference and DNS/TLS setup remain open. No new approval for the accepted 60m prototype is needed."
|
||||
intervention_note: "Native demo-company exists; product host/path is selected. Identity-provisioner LLDAP login returns 401 after credential reload; NK-WP-0036-T04 holds attended consumer credential reconciliation. DNS/TLS, new database/Secret, app deployment and ordinary demo accounts remain. No new approval for the 60m prototype is needed."
|
||||
priority: high
|
||||
assignee: the-custodian
|
||||
state_hub_task_id: "b00958c8-1401-5ebf-bc22-c0252618d897"
|
||||
|
|
@ -80,18 +80,31 @@ limiter. Keep `/media/` behind the app gate.
|
|||
The user requests a new `demo-company` tenant with `demo-user1`, etc. Apply
|
||||
NetKingdom ADR-0013 as `tenant:trial:demo-company` and start with two ordinary
|
||||
demo users. Fresh data is selected; no historical customer import is authorized.
|
||||
The exact prepared namespace/database/release and proposed hostname are in
|
||||
The prepared namespace/database/release and current execution status are in
|
||||
`docs/vergabe-demo-company-binding.md` and
|
||||
`helm/vergabe-demo-company-values.proposed.yaml`. The suggested hostname is
|
||||
`demo-vergabe.coulomb.social`; user preference is pending. Its observed DNS
|
||||
target is not Railiance01 and must be corrected through the edge owner.
|
||||
`helm/vergabe-demo-company-values.proposed.yaml`. The user chose
|
||||
`https://vergabe-teilnahme.coulomb.social/demo-company`. DNS/TLS is per product
|
||||
host; the exact company prefix selects its isolated application instance.
|
||||
The chosen hostname currently resolves to 80.158.43.29 and needs the admitted
|
||||
Railiance01 route (92.205.62.239) through the edge owner.
|
||||
|
||||
Tenant Engine creation must use the authenticated User Engine operator portal.
|
||||
An isolated native KeyCape login window has been opened; operator login,
|
||||
tenant creation/readback, memberships and app account provisioning are not yet
|
||||
confirmed. Do not substitute a trusted service actor to bypass a denial.
|
||||
Platform registration does not add SSO to the Django pilot. Continue execution
|
||||
on T02; company/data choice is no longer missing input.
|
||||
Native operator authentication as platform-root succeeded. At 19:03:18 UTC the
|
||||
operator created demo-company through the native User Engine form; Tenant
|
||||
Engine readback confirms active, version 1. The chosen first administrator is
|
||||
present with invited status. A subsequent user was created, but Create login
|
||||
fails in identity-provisioner at the LLDAP admin authentication step, before
|
||||
directory mutation. Reloading the existing credential reference preserves this
|
||||
401. NK-WP-0036-T04 owns the prepared attended consumer-only reconciliation;
|
||||
T05 retains the functional dependency preflight/error-reporting improvement.
|
||||
No provider password has been changed, and no failed login create was replayed.
|
||||
|
||||
Vergabe source 9345a1b supports APP_BASE_PATH=/demo-company, prefix-aware URL
|
||||
reversing and cookie scope. All 98 application tests, Vite build and seven
|
||||
local Chromium path/edge checks pass. CI smoke 43 and publication 44 passed; the proposed values now pin
|
||||
sha256:cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68
|
||||
and APP_BASE_PATH=/demo-company. The previous root-path image is superseded. Ordinary demo memberships and
|
||||
Django accounts remain separate from platform tenant existence. No product SSO
|
||||
is claimed. The selected URL and successful tenant creation are resolved inputs.
|
||||
|
||||
## Demonstrate restart, isolated restore, rollback and operating ownership
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue