From e8a7ff254761ab64aec1afbb89ab34dc02e36ad6 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 12 Sep 2026 03:12:45 +0200 Subject: [PATCH] Record deployed Vergabe pilot chart and company sign-in evidence Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c --- charts/vergabe-teilnahme/Chart.yaml | 2 +- .../templates/deployment.yaml | 18 ++ charts/vergabe-teilnahme/values.yaml | 4 + .../2026-09-12-demo-company-deployment.md | 36 ++++ .../2026-09-12-demo-company-sso-live.md | 27 +++ docs/vergabe-demo-company-binding.md | 161 +++++++++--------- docs/vergabe-demo-company-sso-rollout.md | 27 ++- docs/vergabe-teilnahme-pilot.md | 38 +++++ helm/vergabe-demo-company-foundation.yaml | 94 ++++++++++ helm/vergabe-demo-company-ingress.yaml | 116 +++++++++++++ .../vergabe-demo-company-values.proposed.yaml | 14 +- tests/test_vergabe_pilot_chart.py | 14 ++ .../RAPPS-WP-0014-vergabe-invited-pilot.md | 16 ++ 13 files changed, 479 insertions(+), 88 deletions(-) create mode 100644 docs/evidence/2026-09-12-demo-company-deployment.md create mode 100644 docs/evidence/2026-09-12-demo-company-sso-live.md create mode 100644 helm/vergabe-demo-company-foundation.yaml create mode 100644 helm/vergabe-demo-company-ingress.yaml diff --git a/charts/vergabe-teilnahme/Chart.yaml b/charts/vergabe-teilnahme/Chart.yaml index 64e7c59..a198d85 100644 --- a/charts/vergabe-teilnahme/Chart.yaml +++ b/charts/vergabe-teilnahme/Chart.yaml @@ -4,7 +4,7 @@ description: | Vergabe Teilnahme — internal Django tender/bid management web app. Single-instance v1 deployment; HA and canary are deferred. type: application -version: 0.2.0 +version: 0.2.1 appVersion: "0.1.0" keywords: - django diff --git a/charts/vergabe-teilnahme/templates/deployment.yaml b/charts/vergabe-teilnahme/templates/deployment.yaml index 9be6ed5..b9c6ea2 100644 --- a/charts/vergabe-teilnahme/templates/deployment.yaml +++ b/charts/vergabe-teilnahme/templates/deployment.yaml @@ -21,7 +21,25 @@ spec: metadata: labels: {{- include "vergabe.selectorLabels" . | nindent 8 }} spec: + automountServiceAccountToken: false securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }} + {{- if .Values.migrations.enabled }} + initContainers: + - name: migrate + image: {{ include "vergabe.image" . | quote }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + command: ["python", "manage.py", "migrate", "--noinput"] + securityContext: {{- toYaml .Values.securityContext | nindent 12 }} + envFrom: + - secretRef: + name: {{ .Values.envSecretName | quote }} + env: + {{- range $k, $v := .Values.env }} + - name: {{ $k }} + value: {{ $v | quote }} + {{- end }} + resources: {{- toYaml .Values.resources | nindent 12 }} + {{- end }} containers: - name: app image: {{ include "vergabe.image" . | quote }} diff --git a/charts/vergabe-teilnahme/values.yaml b/charts/vergabe-teilnahme/values.yaml index 5e415d0..aafa818 100644 --- a/charts/vergabe-teilnahme/values.yaml +++ b/charts/vergabe-teilnahme/values.yaml @@ -4,6 +4,10 @@ image: digest: "" # preferred; takes precedence over tag pullPolicy: IfNotPresent +# Opt in after reviewing migrations; runs before serving traffic, within the same pod request. +migrations: + enabled: false + replicaCount: 1 # v1 is single-instance; HA is deferred (RAILIANCE-WP-0002 Notes) # An invited company pilot requires an immutable image and both data volumes. diff --git a/docs/evidence/2026-09-12-demo-company-deployment.md b/docs/evidence/2026-09-12-demo-company-deployment.md new file mode 100644 index 0000000..096640a --- /dev/null +++ b/docs/evidence/2026-09-12-demo-company-deployment.md @@ -0,0 +1,36 @@ +# Demo-company deployment receipt + +2026-09-12 deployment evidence: the operator added A records for +vergabe-teilnahme.coulomb.social and users.coulomb.social. Authoritative IONOS +and recursive readback both return 92.205.62.239. Both cert-manager certificates +are Ready. The portal now uses https://users.coulomb.social/login; its legacy +nip.io address redirects to the canonical hostname. The exact new callback is +registered alongside the rollback callback; scopes, public client type and PKCE +remain unchanged. Canonical authorization succeeds; unapproved callback and +missing PKCE fail. This supersedes earlier DNS and portal-hostname blockers. + +Helm release vergabe-teilnahme revision 1 is deployed in vergabe-demo-company, +chart 0.2.1, pinned product digest cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68. +Deployment UID 2152014d-a020-4c5e-a3b0-9575e9f21c44 is Ready 1/1. Its init +migration completed before the web process; both phases share the same 60m CPU / +256Mi memory request. Node requests now total 3965m of 4000m; the 35m remainder +matches the accepted prototype allocation. No unrelated resource requests changed. + +RPF-WP-0039 delivered fresh vergabe_demo_company database/role on apps-pg and +runtime Secret vergabe-demo-company/vergabe-demo-env. The app's own connection +confirms that exact database/role. The role is non-superuser, cannot create roles +or databases, has a 20-connection ceiling and 15-second timeouts, and cannot +CONNECT to historical vergabe_db, coulomb_social_db or apps_meta. Both dedicated +PVCs are Bound: 5Gi media and 1Gi issue state. Historical data was not selected +or overwritten; no credentials are recorded here. + +Thirteen live Chromium/HTTP checks pass: page and assets, secure tenant-scoped +CSRF cookie, anonymous login gate and media refusal, private operational path +refusal, neighboring/root path refusal, canonical slash, HTTPS redirect and +missing-CSRF POST denial. Migration/app initialization also proves consumer +connectivity. The empty product has zero accounts, including zero staff accounts. +The current login is still the interim Django login, not NetKingdom SSO. Native +recipient login, company welcome and account mapping remain VERGABE-WP-0019-T06. +RAPPS-WP-0014-T03 retains restart and coherent off-host backup/isolated restore; +the latest existing apps-pg base backup predates this new database. No pilot-user +acceptance, shared tenancy, MFA completion or natural factory-worker trace is claimed. diff --git a/docs/evidence/2026-09-12-demo-company-sso-live.md b/docs/evidence/2026-09-12-demo-company-sso-live.md new file mode 100644 index 0000000..1ac81c1 --- /dev/null +++ b/docs/evidence/2026-09-12-demo-company-sso-live.md @@ -0,0 +1,27 @@ +# Demo-company sign-in live rollout + +Recorded 2026-09-12T01:09:00.835106+00:00 + + +2026-09-12 attended rollout executed after explicit operator approval. KeyCape +and password setup are Ready on the prepared digests; exact public client +registration was CAS-applied (config resourceVersion 60123977) with unrelated +config bytes/Secret data preserved. Existing portal and product client both +pass fresh-login forwarding, wrong-callback and missing-PKCE checks (6 checks). +Vergabe Helm revision 2 is Ready; identity migration completed, both PVCs remain, +and requests remain 60m CPU/256Mi memory. Eleven live product checks pass: +company welcome, anonymous gate, no-store, secure scoped CSRF, POST/CSRF-only +login start, native issuer redirect, private company/media protection and +invalid callback/confirmation rejection. Initial readback showed zero accounts, +identity mappings and staff accounts. Native invited-user sign-in/MFA and +confirmation are now requested from the operator; no user credential was used +by the agent. Recovery and two-user acceptance remain their existing tasks. +Evidence: railiance-apps/docs/evidence/2026-09-12-demo-company-sso-live.md. + +| Component | Deployed digest | +| --- | --- | +| Vergabe | sha256:2cb393608a82be2851adfc27f2bf4d8ef5d709f1b0038be5d0999e38c68b039e | +| KeyCape | sha256:5f10f36a5da23ce1aaf3df9b84a8ff98d7926f34ceaa19e63bd3356adb68e01a | +| Password setup | sha256:55f744cc9bc2ec3fe23eb7175fa4b7bfcc7a29469d9b9a1a8eaefc75d790dfc6 | + +Cluster UID: a553c742-0115-43d4-99a4-a5ca56fe0786. The operator explicitly approved the prepared attended rollout. Shared issuer startup is proven; authenticated recipient token/account acceptance remains pending. diff --git a/docs/vergabe-demo-company-binding.md b/docs/vergabe-demo-company-binding.md index 0349a42..7dbe16a 100644 --- a/docs/vergabe-demo-company-binding.md +++ b/docs/vergabe-demo-company-binding.md @@ -1,95 +1,96 @@ # Vergabe demo-company deployment binding -Prepared 2026-09-11 under RAPPS-WP-0014-T02 and VERGABE-WP-0019-T03/T04. -Native tenant, user and password setup are verified; application placement and product onboarding remain pending. +Updated 2026-09-12 under RAPPS-WP-0014 and VERGABE-WP-0019. +Application placement is live; native product sign-in and recovery acceptance remain open. -| Item | Binding / execution status | +| Item | Current binding | | --- | --- | -| Tenant | `tenant:trial:demo-company`; display `demo-company`; active, version 1; native operator create/readback verified | -| Purpose / data | New demo workspace; synthetic data only; no existing data import | -| Initial accounts | Three native memberships; one linked identity with operator-confirmed password setup. Remaining identities, actual login-name mapping and product accounts still require verification | -| Operator / acceptance | Bernd Worsch via authenticated existing operator path | -| Cluster | Railiance01, kube-system UID `a553c742-0115-43d4-99a4-a5ca56fe0786` | -| Proposed namespace | `vergabe-demo-company`; create separately from historical installations | -| Helm release | `vergabe-teilnahme` within that namespace | -| Image source | Tenant-path source `9345a1bb1a92ac0ee3b2dc6443a3d299e6754e70`; CI smoke 43 / publication 44 passed | -| Image digest | `forgejo.coulomb.social/coulomb/vergabe-teilnahme@sha256:cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68` | -| Chart baseline | 0.2.0 at railiance-apps `9491744e5adab4464070c164d7172a7392ae1e15` | -| Resources | One Recreate replica, CPU request 60m / limit 1000m, memory request 256Mi / limit 1Gi | -| Selected URL | `https://vergabe-teilnahme.coulomb.social/demo-company/`; one product host, exact tenant path | -| Public edge | DNS, TLS and login abuse-control configuration pending; expected target 92.205.62.239 | -| Proposed database / role | Fresh `vergabe_demo_company` / `vergabe_demo_company` on `databases/apps-pg`; platform provisioning/custody pending | -| Runtime Secret | `vergabe-demo-env` in the dedicated namespace; platform delivery pending, no secret values in this packet | -| Media / app state | Separate `vergabe-teilnahme-media` 5Gi and `vergabe-teilnahme-app-state` 1Gi PVCs, local-path; native creation pending | -| Recovery / support | Existing RAPPS-WP-0014-T03 retains off-host recovery point, isolated restore, rollback and operating responsibility evidence | +| Tenant | tenant:trial:demo-company, active/version 1; three native memberships and one linked directory identity | +| Data | Fresh synthetic demo workspace; no historical import | +| Portal | https://users.coulomb.social/login | +| Product | https://vergabe-teilnahme.coulomb.social/demo-company/ | +| DNS / TLS | Both hostnames resolve to 92.205.62.239; certificates Ready | +| Cluster | Railiance01, kube-system UID a553c742-0115-43d4-99a4-a5ca56fe0786 | +| Namespace / release | vergabe-demo-company / vergabe-teilnahme, revision 2 | +| Source / image | 8be281025bf57a7aefd1fe98a7e060f2173df5ef; image 51 / acceptance 52 / smoke 53; sha256:2cb393608a82be2851adfc27f2bf4d8ef5d709f1b0038be5d0999e38c68b039e | +| Chart / rollout | 0.2.1; one Recreate replica; init migration before serving; Ready 1/1 | +| Resources | 60m CPU / 256Mi memory request; 1000m CPU / 1Gi memory limit | +| Database / role | Fresh vergabe_demo_company / vergabe_demo_company, databases/apps-pg | +| Runtime custody | vergabe-demo-company/vergabe-demo-env; platform helper receipt in RPF-WP-0039 | +| Media / issue state | Separate Bound local-path PVCs, 5Gi / 1Gi; UID/GID/fsGroup 999 | +| Authentication | NetKingdom company welcome and OIDC deployed; initial readback zero accounts. Actual recipient login/MFA pending | +| Remaining handoffs | VERGABE-WP-0019-T06 welcome/SSO; RAPPS-WP-0014-T03 recovery; VERGABE-WP-0019-T04 pilot acceptance | -The target database is a proposed new consumer, not permission to reuse or -overwrite `vergabe_db`. Refresh managed-consumer count, placement and migration -demand before applying. Tenant creation itself does not depend on this hostname. +## Current SSO rollout -## Native tenant and identity execution +2026-09-12 attended rollout executed after explicit operator approval. KeyCape +and password setup are Ready on the prepared digests; exact public client +registration was CAS-applied (config resourceVersion 60123977) with unrelated +config bytes/Secret data preserved. Existing portal and product client both +pass fresh-login forwarding, wrong-callback and missing-PKCE checks (6 checks). +Vergabe Helm revision 2 is Ready; identity migration completed, both PVCs remain, +and requests remain 60m CPU/256Mi memory. Eleven live product checks pass: +company welcome, anonymous gate, no-store, secure scoped CSRF, POST/CSRF-only +login start, native issuer redirect, private company/media protection and +invalid callback/confirmation rejection. Initial readback showed zero accounts, +identity mappings and staff accounts. Native invited-user sign-in/MFA and +confirmation are now requested from the operator; no user credential was used +by the agent. Recovery and two-user acceptance remain their existing tasks. +Evidence: railiance-apps/docs/evidence/2026-09-12-demo-company-sso-live.md. -Use the existing User Engine portal at `https://users.92-205-62-239.nip.io`. -Its `/login` uses KeyCape and the registered native callback. The authenticated -platform form creates `tenant:trial:demo-company` through Tenant Engine. Record -the response and read back the exact tenant before creating memberships. Do not -substitute a service actor, fabricate verified claims, or bypass policy on denial. -Native login and operator creation succeeded at 19:03:18 UTC. Tenant Engine -confirms demo-company active/version 1; User Engine contains the first -administrator with invited status. A subsequent Create login failed with an -LLDAP service-login 401. The operator completed NK-WP-0036-T04's attended -credential-reference repair: provider and consumer login now pass, independently -verified with a directory read; the provider password and image are unchanged. -The operator confirms successful user password setup on 2026-09-12. Independent -read-only User Engine evidence shows three memberships and one linked identity. -USER-WP-0025 also delivered operator navigation, logout and tenant-name selection. -Remaining identity and product access are verified separately. +## Initial deployment verification -Create two ordinary memberships through User Engine. Confirm how the identity -provisioner assigns login names before provisioning the requested demo names; -do not invent deliverable email addresses or send invitations to third parties. -The current product uses separately provisioned Django accounts, with no staff -or superuser flags. Preserve the mapping to this tenant's isolated deployment. -This establishes a platform tenant and a bounded app pilot, not completed SSO. +2026-09-12 deployment evidence: the operator added A records for +vergabe-teilnahme.coulomb.social and users.coulomb.social. Authoritative IONOS +and recursive readback both return 92.205.62.239. Both cert-manager certificates +are Ready. The portal now uses https://users.coulomb.social/login; its legacy +nip.io address redirects to the canonical hostname. The exact new callback is +registered alongside the rollback callback; scopes, public client type and PKCE +remain unchanged. Canonical authorization succeeds; unapproved callback and +missing PKCE fail. This supersedes earlier DNS and portal-hostname blockers. -## Hostname and deployment execution +Helm release vergabe-teilnahme revision 1 is deployed in vergabe-demo-company, +chart 0.2.1, pinned product digest cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68. +Deployment UID 2152014d-a020-4c5e-a3b0-9575e9f21c44 is Ready 1/1. Its init +migration completed before the web process; both phases share the same 60m CPU / +256Mi memory request. Node requests now total 3965m of 4000m; the 35m remainder +matches the accepted prototype allocation. No unrelated resource requests changed. -`helm/vergabe-demo-company-values.proposed.yaml` retains 60m resources and the -selected product host, APP_BASE_PATH=/demo-company and published immutable -digest. The chart does not create ingress or DNS. -The edge must match exactly /demo-company or /demo-company/, canonicalize the -bare path and strip the prefix. It must keep private media on the app route and -apply TLS and the admitted abuse-control policy. Do not route neighboring paths -to this instance. Company/data separation remains the dedicated database and -volumes, not a forwarded header or browser path. +RPF-WP-0039 delivered fresh vergabe_demo_company database/role on apps-pg and +runtime Secret vergabe-demo-company/vergabe-demo-env. The app's own connection +confirms that exact database/role. The role is non-superuser, cannot create roles +or databases, has a 20-connection ceiling and 15-second timeouts, and cannot +CONNECT to historical vergabe_db, coulomb_social_db or apps_meta. Both dedicated +PVCs are Bound: 5Gi media and 1Gi issue state. Historical data was not selected +or overwritten; no credentials are recorded here. -On 2026-09-11 the selected product hostname resolves to 80.158.43.29; Railiance01 -is 92.205.62.239. No DNS changes have been made. A single product DNS/certificate -serves this arrangement; tenants do not need their own subdomains. +Thirteen live Chromium/HTTP checks pass: page and assets, secure tenant-scoped +CSRF cookie, anonymous login gate and media refusal, private operational path +refusal, neighboring/root path refusal, canonical slash, HTTPS redirect and +missing-CSRF POST denial. Migration/app initialization also proves consumer +connectivity. The empty product has zero accounts, including zero staff accounts. +The current login is still the interim Django login, not NetKingdom SSO. Native +recipient login, company welcome and account mapping remain VERGABE-WP-0019-T06. +RAPPS-WP-0014-T03 retains restart and coherent off-host backup/isolated restore; +the latest existing apps-pg base backup predates this new database. No pilot-user +acceptance, shared tenancy, MFA completion or natural factory-worker trace is claimed. -Complete platform database/Secret provisioning and the source-backed namespace, -network and public edge manifests before deployment. Then migrate the fresh -database, deploy, provision the demo app accounts, and perform the two-user -workflow plus restart/isolated-restore checks in the existing owner tasks. -Only then record the demo environment as available for use. +## Source and rollback -Validation on 2026-09-11: Helm lint passed. Rendering the proposed values -produced the pinned digest, one Recreate replica, 60m CPU request, matching -Django/probe hosts, and two distinct retained PVCs. This is local manifest -verification; it is not native deployment or tenant-creation evidence. +`helm/vergabe-demo-company-foundation.yaml` owns namespace/network policies and +certificate. `helm/vergabe-demo-company-ingress.yaml` owns the exact host and +company-prefix route, canonical slash, prefix stripping, headers and rate limit +(60 requests/minute/IP, burst 20). Private media stays behind Django. The +existing proposed-values filename now records the admitted binding. +`railiance-platform/tools/provision-vergabe-demo.py` owns the fixed fresh +credential/database lane. It captures all child output and passes values only +on stdin; the durable credential copies are the two exact Kubernetes Secrets. +OpenBao automation remains a later owner improvement. Never rerun historical +bootstrap helpers or substitute apps_admin credentials. -The next product handoff is VERGABE-WP-0019-T06: preserve the invited tenant and -recipient through an allow-listed password-setup return and land on the admitted -demo-company welcome/sign-in path. Product authentication must validate its own -NetKingdom identity and tenant; it must not reuse the operator's portal session -or silently grant staff privileges. No application SSO is implemented yet. - - -Latest DNS evidence, 2026-09-12: both the recursive resolver and authoritative -ns1047.ui-dns.biz return NXDOMAIN for the product hostname (A and AAAA queried -recursively). This supersedes the earlier 80.158.43.29 observation for current -execution. The zone is served by IONOS ui-dns nameservers. The operator was asked -to add only A vergabe-teilnahme.coulomb.social → 92.205.62.239, TTL 300 or default. -No DNS credentials were requested or retrieved; native record readback and TLS -remain pending. Tenant paths continue sharing this one product hostname. +This is the first release in the fresh namespace; there is no previously +accepted application image to roll back to. On a failed next upgrade, stop public +traffic and reconcile schema/image compatibility before reverting. Retain the +claims and database; namespace deletion is not rollback. Pod replacement and +isolated restore must still be proven with matched PostgreSQL/media/SQLite data. diff --git a/docs/vergabe-demo-company-sso-rollout.md b/docs/vergabe-demo-company-sso-rollout.md index 02c099c..4c90f12 100644 --- a/docs/vergabe-demo-company-sso-rollout.md +++ b/docs/vergabe-demo-company-sso-rollout.md @@ -1,9 +1,12 @@ -# Demo-company sign-in: prepared attended rollout +# Demo-company sign-in: executed attended rollout 2026-09-12, VERGABE-WP-0019-T06 / KEY-WP-0033 / NK-WP-0037. -Source, release images and server dry runs are complete. This packet has not -been applied to the running services. The existing application still serves -its interim local login. +The operator approved and the prepared rollout was applied on 2026-09-12. +All three services are Ready; Helm revision 2 serves the company welcome and +NetKingdom sign-in. Native invited-user/MFA acceptance remains pending. +See docs/evidence/2026-09-12-demo-company-sso-live.md. + +The preparation and rollback record follows. | Component | Source | Published digest | | --- | --- | --- | @@ -84,3 +87,19 @@ bootstrap commands. Preserve data and the approved client configuration. This release's native recipient/MFA acceptance is still open. RAPPS-WP-0014-T03 retains the coherent backup/isolated restore and pod-replacement proof; VERGABE-WP-0019-T04 retains two-user collaboration and pilot acceptance. + + +2026-09-12 attended rollout executed after explicit operator approval. KeyCape +and password setup are Ready on the prepared digests; exact public client +registration was CAS-applied (config resourceVersion 60123977) with unrelated +config bytes/Secret data preserved. Existing portal and product client both +pass fresh-login forwarding, wrong-callback and missing-PKCE checks (6 checks). +Vergabe Helm revision 2 is Ready; identity migration completed, both PVCs remain, +and requests remain 60m CPU/256Mi memory. Eleven live product checks pass: +company welcome, anonymous gate, no-store, secure scoped CSRF, POST/CSRF-only +login start, native issuer redirect, private company/media protection and +invalid callback/confirmation rejection. Initial readback showed zero accounts, +identity mappings and staff accounts. Native invited-user sign-in/MFA and +confirmation are now requested from the operator; no user credential was used +by the agent. Recovery and two-user acceptance remain their existing tasks. +Evidence: railiance-apps/docs/evidence/2026-09-12-demo-company-sso-live.md. diff --git a/docs/vergabe-teilnahme-pilot.md b/docs/vergabe-teilnahme-pilot.md index b9df12b..0022dbf 100644 --- a/docs/vergabe-teilnahme-pilot.md +++ b/docs/vergabe-teilnahme-pilot.md @@ -160,3 +160,41 @@ custody, placement and recovery. VERGABE-WP-0019-T06 now explicitly tracks the requested tenant welcome and connection to the new NetKingdom identity. The earlier manually provisioned Django account path remains an interim capability; it does not make the directory password a product credential or implement SSO. + + +## Live demo placement — 2026-09-12 + +2026-09-12 deployment evidence: the operator added A records for +vergabe-teilnahme.coulomb.social and users.coulomb.social. Authoritative IONOS +and recursive readback both return 92.205.62.239. Both cert-manager certificates +are Ready. The portal now uses https://users.coulomb.social/login; its legacy +nip.io address redirects to the canonical hostname. The exact new callback is +registered alongside the rollback callback; scopes, public client type and PKCE +remain unchanged. Canonical authorization succeeds; unapproved callback and +missing PKCE fail. This supersedes earlier DNS and portal-hostname blockers. + +Helm release vergabe-teilnahme revision 1 is deployed in vergabe-demo-company, +chart 0.2.1, pinned product digest cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68. +Deployment UID 2152014d-a020-4c5e-a3b0-9575e9f21c44 is Ready 1/1. Its init +migration completed before the web process; both phases share the same 60m CPU / +256Mi memory request. Node requests now total 3965m of 4000m; the 35m remainder +matches the accepted prototype allocation. No unrelated resource requests changed. + +RPF-WP-0039 delivered fresh vergabe_demo_company database/role on apps-pg and +runtime Secret vergabe-demo-company/vergabe-demo-env. The app's own connection +confirms that exact database/role. The role is non-superuser, cannot create roles +or databases, has a 20-connection ceiling and 15-second timeouts, and cannot +CONNECT to historical vergabe_db, coulomb_social_db or apps_meta. Both dedicated +PVCs are Bound: 5Gi media and 1Gi issue state. Historical data was not selected +or overwritten; no credentials are recorded here. + +Thirteen live Chromium/HTTP checks pass: page and assets, secure tenant-scoped +CSRF cookie, anonymous login gate and media refusal, private operational path +refusal, neighboring/root path refusal, canonical slash, HTTPS redirect and +missing-CSRF POST denial. Migration/app initialization also proves consumer +connectivity. The empty product has zero accounts, including zero staff accounts. +The current login is still the interim Django login, not NetKingdom SSO. Native +recipient login, company welcome and account mapping remain VERGABE-WP-0019-T06. +RAPPS-WP-0014-T03 retains restart and coherent off-host backup/isolated restore; +the latest existing apps-pg base backup predates this new database. No pilot-user +acceptance, shared tenancy, MFA completion or natural factory-worker trace is claimed. diff --git a/helm/vergabe-demo-company-foundation.yaml b/helm/vergabe-demo-company-foundation.yaml new file mode 100644 index 0000000..c314dfd --- /dev/null +++ b/helm/vergabe-demo-company-foundation.yaml @@ -0,0 +1,94 @@ +# RAPPS-WP-0014: admitted empty demo workspace; no credentials or database data. +apiVersion: v1 +kind: Namespace +metadata: + name: vergabe-demo-company + labels: + railiance.io/workload-class: application + railiance.io/postgres-client: apps-pg +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: default-deny + namespace: vergabe-demo-company +spec: + podSelector: {} + policyTypes: + - Ingress + - Egress +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: vergabe-runtime + namespace: vergabe-demo-company +spec: + podSelector: + matchLabels: + app.kubernetes.io/name: vergabe-teilnahme + app.kubernetes.io/instance: vergabe-teilnahme + policyTypes: + - Ingress + - Egress + ingress: + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + ports: + - protocol: TCP + port: 8000 + egress: + - to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: databases + podSelector: + matchLabels: + cnpg.io/cluster: apps-pg + ports: + - protocol: TCP + port: 5432 + - to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + ports: + - protocol: UDP + port: 53 + - protocol: TCP + port: 53 +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: allow-acme-http01 + namespace: vergabe-demo-company +spec: + podSelector: + matchLabels: + acme.cert-manager.io/http01-solver: 'true' + policyTypes: + - Ingress + ingress: + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + ports: + - protocol: TCP + port: 8089 +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: vergabe-demo-tls + namespace: vergabe-demo-company +spec: + secretName: vergabe-demo-tls + dnsNames: + - vergabe-teilnahme.coulomb.social + issuerRef: + kind: ClusterIssuer + name: letsencrypt-prod diff --git a/helm/vergabe-demo-company-ingress.yaml b/helm/vergabe-demo-company-ingress.yaml new file mode 100644 index 0000000..f7e7d0a --- /dev/null +++ b/helm/vergabe-demo-company-ingress.yaml @@ -0,0 +1,116 @@ +# Exact product hostname and isolated company path. Private media stays in Django. +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: vergabe-security + namespace: vergabe-demo-company +spec: + chain: + middlewares: + - name: vergabe-rate-limit + - name: vergabe-headers + - name: vergabe-canonical-path + - name: vergabe-strip-tenant +--- +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: vergabe-rate-limit + namespace: vergabe-demo-company +spec: + rateLimit: + average: 60 + period: 1m + burst: 20 +--- +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: vergabe-headers + namespace: vergabe-demo-company +spec: + headers: + stsSeconds: 31536000 + contentTypeNosniff: true + frameDeny: true + referrerPolicy: same-origin +--- +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: vergabe-canonical-path + namespace: vergabe-demo-company +spec: + redirectRegex: + regex: ^(https?://vergabe-teilnahme\.coulomb\.social/demo-company)(\?.*)?$ + replacement: ${1}/${2} + permanent: false +--- +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: vergabe-strip-tenant + namespace: vergabe-demo-company +spec: + stripPrefix: + prefixes: + - /demo-company +--- +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: vergabe-https + namespace: vergabe-demo-company +spec: + redirectScheme: + scheme: https + permanent: true +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: vergabe-demo-company + namespace: vergabe-demo-company + annotations: + traefik.ingress.kubernetes.io/router.entrypoints: websecure + traefik.ingress.kubernetes.io/router.tls: 'true' + traefik.ingress.kubernetes.io/router.middlewares: vergabe-demo-company-vergabe-security@kubernetescrd +spec: + ingressClassName: traefik + rules: + - host: vergabe-teilnahme.coulomb.social + http: + paths: + - path: /demo-company + pathType: Prefix + backend: + service: + name: vergabe-teilnahme + port: + number: 80 + tls: + - secretName: vergabe-demo-tls + hosts: + - vergabe-teilnahme.coulomb.social +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + annotations: + traefik.ingress.kubernetes.io/router.entrypoints: web + traefik.ingress.kubernetes.io/router.middlewares: vergabe-demo-company-vergabe-https@kubernetescrd + name: vergabe-demo-company-http + namespace: vergabe-demo-company +spec: + ingressClassName: traefik + rules: + - host: vergabe-teilnahme.coulomb.social + http: + paths: + - backend: + service: + name: vergabe-teilnahme + port: + number: 80 + path: /demo-company + pathType: Prefix diff --git a/helm/vergabe-demo-company-values.proposed.yaml b/helm/vergabe-demo-company-values.proposed.yaml index 0b1067a..283494f 100644 --- a/helm/vergabe-demo-company-values.proposed.yaml +++ b/helm/vergabe-demo-company-values.proposed.yaml @@ -1,10 +1,12 @@ -# Proposed binding only; see docs/vergabe-demo-company-binding.md. -# Tenant and published image are verified; database/Secret and DNS/TLS admission are pending. +# Admitted demo binding; see docs/vergabe-demo-company-binding.md. +# Fresh database only. Init migration shares the application scheduling envelope. # Release vergabe-teilnahme; namespace vergabe-demo-company. pilot: enabled: true image: - digest: sha256:cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68 + digest: sha256:2cb393608a82be2851adfc27f2bf4d8ef5d709f1b0038be5d0999e38c68b039e +migrations: + enabled: true replicaCount: 1 resources: requests: @@ -15,6 +17,12 @@ resources: memory: 1Gi envSecretName: vergabe-demo-env env: + NETKINGDOM_ENABLED: "true" + NETKINGDOM_ISSUER: https://kc.coulomb.social + NETKINGDOM_CLIENT_ID: vergabe-demo-company + NETKINGDOM_CALLBACK: https://vergabe-teilnahme.coulomb.social/demo-company/accounts/oidc/callback/ + NETKINGDOM_TENANT: tenant:trial:demo-company + COMPANY_DISPLAY_NAME: Demo Company APP_BASE_PATH: /demo-company DJANGO_SETTINGS_MODULE: vergabe_teilnahme.settings.prod ALLOWED_HOSTS: vergabe-teilnahme.coulomb.social,localhost diff --git a/tests/test_vergabe_pilot_chart.py b/tests/test_vergabe_pilot_chart.py index 8d5b23f..4089fcc 100644 --- a/tests/test_vergabe_pilot_chart.py +++ b/tests/test_vergabe_pilot_chart.py @@ -59,6 +59,20 @@ class PilotChartTests(unittest.TestCase): self.assertEqual(claim['metadata']['annotations']['helm.sh/resource-policy'], 'keep') self.assertEqual(pod['securityContext']['fsGroup'], 999) + def test_migrations_finish_before_serving_with_same_identity_and_resource_request(self): + values = pilot() + values.update(migrations={'enabled': True}, resources={'requests': {'cpu': '60m'}}) + deployment = next(o for o in self.objects(values) if o['kind'] == 'Deployment') + pod = deployment['spec']['template']['spec'] + init, app = pod['initContainers'][0], pod['containers'][0] + self.assertEqual(init['command'], ['python', 'manage.py', 'migrate', '--noinput']) + for key in ('image', 'envFrom', 'env', 'resources', 'securityContext'): + self.assertEqual(init[key], app[key]) + self.assertEqual(init['resources']['requests']['cpu'], '60m') + self.assertFalse(pod['automountServiceAccountToken']) + legacy = next(o for o in self.objects(pilot()) if o['kind'] == 'Deployment') + self.assertNotIn('initContainers', legacy['spec']['template']['spec']) + def test_pilot_refuses_each_ephemeral_store(self): for store in ('media', 'appState'): with self.subTest(store=store): diff --git a/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md b/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md index 630b257..fcfc63d 100644 --- a/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md +++ b/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md @@ -164,6 +164,22 @@ recipient/MFA and product acceptance stay with VERGABE-WP-0019-T06; recovery remains T03 here. No live runtime changes were made in this continuation. + +2026-09-12 attended rollout executed after explicit operator approval. KeyCape +and password setup are Ready on the prepared digests; exact public client +registration was CAS-applied (config resourceVersion 60123977) with unrelated +config bytes/Secret data preserved. Existing portal and product client both +pass fresh-login forwarding, wrong-callback and missing-PKCE checks (6 checks). +Vergabe Helm revision 2 is Ready; identity migration completed, both PVCs remain, +and requests remain 60m CPU/256Mi memory. Eleven live product checks pass: +company welcome, anonymous gate, no-store, secure scoped CSRF, POST/CSRF-only +login start, native issuer redirect, private company/media protection and +invalid callback/confirmation rejection. Initial readback showed zero accounts, +identity mappings and staff accounts. Native invited-user sign-in/MFA and +confirmation are now requested from the operator; no user credential was used +by the agent. Recovery and two-user acceptance remain their existing tasks. +Evidence: railiance-apps/docs/evidence/2026-09-12-demo-company-sso-live.md. + ## Demonstrate restart, isolated restore, rollback and operating ownership ```task