diff --git a/docs/vergabe-demo-company-sso-rollout.md b/docs/vergabe-demo-company-sso-rollout.md new file mode 100644 index 0000000..02c099c --- /dev/null +++ b/docs/vergabe-demo-company-sso-rollout.md @@ -0,0 +1,86 @@ +# Demo-company sign-in: prepared attended rollout + +2026-09-12, VERGABE-WP-0019-T06 / KEY-WP-0033 / NK-WP-0037. +Source, release images and server dry runs are complete. This packet has not +been applied to the running services. The existing application still serves +its interim local login. + +| Component | Source | Published digest | +| --- | --- | --- | +| Vergabe | 8be281025bf57a7aefd1fe98a7e060f2173df5ef | sha256:2cb393608a82be2851adfc27f2bf4d8ef5d709f1b0038be5d0999e38c68b039e | +| KeyCape | 8d4336e9448c564ac85f5f10dc75fff3c553564c | sha256:5f10f36a5da23ce1aaf3df9b84a8ff98d7926f34ceaa19e63bd3356adb68e01a | +| Password setup | 48a75b1a5456f224b077b73af1b345473823a743 | sha256:55f744cc9bc2ec3fe23eb7175fa4b7bfcc7a29469d9b9a1a8eaefc75d790dfc6 | + +125 local application tests pass, including 27 OIDC cases; assets build and +migration drift checks pass. The full KeyCape Go suite passes. Sixteen +provisioner tests pass locally and against the published runtime image, +including HTTP issuance/completion. Two registration-helper tests pass. + +Vergabe image publication run 51 passed. Acceptance run 49 completed its test +stage but failed during image export; its log stops there, so the precise +export failure cause is not established. Run 52 acceptance and run 53 smoke +both pass on cf50cc55338e298de56f2a6e1929848a4bfbc0ae; its only difference from +8be2810 is the generated brief. KeyCape image publication run 45 passed. + +## Why the shared rollout is attended + +`key-cape/docs/operations.md`, section on the two changes after the deployed +image, says the live boot "belongs to the attended rollout window and not to +a session running against production on its own." The current issuer is +source dcebd46 / digest 7ff54c54. The new release includes the accepted browser +client startup validation and tenant provenance changes as well as this +session's fresh-login forwarding. These affect the shared issuer. The existing +one-replica Recreate strategy interrupts pending logins; the provisioner's +in-memory setup links also expire on restart. No credential rotation is needed. + +The exact client addition passed the owner's guarded server dry run against +sso/keycape-config UID 2e94519d-1550-41c7-9701-2efe47fe1fd3, resourceVersion +60090393. The helper preserves unrelated configuration bytes and other Secret +data, checks the changed browser-client startup constraint and refuses drift. +Repeat inspection immediately before applying; the recorded revision is not a +license to replay over a changed configuration. + +## Prepared files and execution order + +1. Inspect/dry-run/apply the exact client with + `net-kingdom/sso-mfa/k8s/keycape/vergabe-client-rollout.py`. The public client + has only openid/profile/groups and one exact HTTPS callback. It declares no + tenant and does not weaken the provider's MFA policy. +2. Apply `net-kingdom/sso-mfa/k8s/keycape/vergabe-fresh-login.proposed.patch.yaml` + as a strategic patch to sso/keycape. Wait for Ready and verify discovery, + existing portal authorization, invalid redirect and missing-PKCE rejection, + and propagation of prompt=login to Authelia. On failure, restore the previous + image and withhold product activation; preserve the client and all Secrets. +3. Apply `net-kingdom/sso-mfa/k8s/identity-provisioner/company-welcome.proposed.patch.yaml` + to sso/identity-provisioner. Its 25m/32Mi request and credential references + stay unchanged. The fixed tenant map returns successful setup to the company + entry without tokens, recipient credentials or automatic product login. +4. Apply `helm/vergabe-demo-company-oidc-egress.proposed.yaml`. It admits only + issuer HTTPS via the current public IP and its translated Traefik endpoint. + Use Helm upgrade for the app, layering + `helm/vergabe-demo-company-sso.proposed.yaml` over the existing admitted + `helm/vergabe-demo-company-values.proposed.yaml`, with the current chart. + The new mapping-table migration runs in the existing 60m/256Mi init envelope. + Both current PVCs and database remain. The server-side dry run passed in the + actual vergabe-demo-company namespace. Keep the 60m request and Recreate. +5. Confirm issuer connectivity from the application, welcome/CSRF/prefix/media + protection and a rejected platform identity. Then the actual invited user + completes fresh login and any required MFA, checks their account on the + confirmation page and enters the company workflow. Do not use operator + credentials or create a substitute shared Django password. + +## Rollback and remaining acceptance + +Before application activation, all current images remain valid rollback +references in the existing deployment receipt. Once OIDC accounts exist they +have unusable local passwords. Disable NETKINGDOM_ENABLED or restore the prior +app image to return to the interim gate; that is containment, not a credential +fallback for these users. Keep the new identity table and all three data stores. + +Restore the provisioner's previous image 5b460f5ca9e329e287939f4707a2bb8d5674b7f94e24cfb5f6d790f54c3f8d06 +if its rollout fails. Do not rotate its directory credential or rerun historical +bootstrap commands. Preserve data and the approved client configuration. + +This release's native recipient/MFA acceptance is still open. RAPPS-WP-0014-T03 +retains the coherent backup/isolated restore and pod-replacement proof; +VERGABE-WP-0019-T04 retains two-user collaboration and pilot acceptance. diff --git a/helm/vergabe-demo-company-oidc-egress.proposed.yaml b/helm/vergabe-demo-company-oidc-egress.proposed.yaml new file mode 100644 index 0000000..57be83e --- /dev/null +++ b/helm/vergabe-demo-company-oidc-egress.proposed.yaml @@ -0,0 +1,27 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: vergabe-oidc-issuer-egress + namespace: vergabe-demo-company +spec: + podSelector: + matchLabels: + app.kubernetes.io/name: vergabe-teilnahme + app.kubernetes.io/instance: vergabe-teilnahme + policyTypes: [Egress] + egress: + - to: + - ipBlock: + cidr: 92.205.62.239/32 + ports: + - {protocol: TCP, port: 443} + # The same public TLS route after K3s translates the node destination. + - to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + podSelector: + matchLabels: + app.kubernetes.io/name: traefik + ports: + - {protocol: TCP, port: 8443} diff --git a/helm/vergabe-demo-company-sso.proposed.yaml b/helm/vergabe-demo-company-sso.proposed.yaml new file mode 100644 index 0000000..5ff9b1b --- /dev/null +++ b/helm/vergabe-demo-company-sso.proposed.yaml @@ -0,0 +1,10 @@ +# Layer over the admitted demo-company values during the attended rollout. +image: + digest: sha256:2cb393608a82be2851adfc27f2bf4d8ef5d709f1b0038be5d0999e38c68b039e +env: + NETKINGDOM_ENABLED: "true" + NETKINGDOM_ISSUER: https://kc.coulomb.social + NETKINGDOM_CLIENT_ID: vergabe-demo-company + NETKINGDOM_CALLBACK: https://vergabe-teilnahme.coulomb.social/demo-company/accounts/oidc/callback/ + NETKINGDOM_TENANT: tenant:trial:demo-company + COMPANY_DISPLAY_NAME: Demo Company diff --git a/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md b/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md index f7e69db..630b257 100644 --- a/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md +++ b/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md @@ -38,8 +38,8 @@ values template prepare the deployment; no live resources were changed. ```task id: RAPPS-WP-0014-T02 status: progress -needs_human: true -intervention_note: "Native tenant/user/password setup succeeds; three memberships and one linked identity are verified. Product DNS/TLS, fresh database/Secret, application deployment and tenant welcome/sign-in remain. VERGABE-WP-0019-T06 retains the product handoff. No new approval for the 60m prototype is needed." +needs_human: false +intervention_note: "DNS, TLS and application placement are verified. Product SSO/welcome and pilot/recovery acceptance remain in the existing owner tasks." priority: high assignee: the-custodian state_hub_task_id: "b00958c8-1401-5ebf-bc22-c0252618d897" @@ -118,6 +118,52 @@ identity linkage and a tenant welcome handoff are explicitly VERGABE-WP-0019-T06 This supersedes the preceding pending-Create-login state; the app itself is not yet deployed and native identity success does not establish a Django session. +2026-09-12 deployment evidence: the operator added A records for +vergabe-teilnahme.coulomb.social and users.coulomb.social. Authoritative IONOS +and recursive readback both return 92.205.62.239. Both cert-manager certificates +are Ready. The portal now uses https://users.coulomb.social/login; its legacy +nip.io address redirects to the canonical hostname. The exact new callback is +registered alongside the rollback callback; scopes, public client type and PKCE +remain unchanged. Canonical authorization succeeds; unapproved callback and +missing PKCE fail. This supersedes earlier DNS and portal-hostname blockers. + +Helm release vergabe-teilnahme revision 1 is deployed in vergabe-demo-company, +chart 0.2.1, pinned product digest cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68. +Deployment UID 2152014d-a020-4c5e-a3b0-9575e9f21c44 is Ready 1/1. Its init +migration completed before the web process; both phases share the same 60m CPU / +256Mi memory request. Node requests now total 3965m of 4000m; the 35m remainder +matches the accepted prototype allocation. No unrelated resource requests changed. + +RPF-WP-0039 delivered fresh vergabe_demo_company database/role on apps-pg and +runtime Secret vergabe-demo-company/vergabe-demo-env. The app's own connection +confirms that exact database/role. The role is non-superuser, cannot create roles +or databases, has a 20-connection ceiling and 15-second timeouts, and cannot +CONNECT to historical vergabe_db, coulomb_social_db or apps_meta. Both dedicated +PVCs are Bound: 5Gi media and 1Gi issue state. Historical data was not selected +or overwritten; no credentials are recorded here. + +Thirteen live Chromium/HTTP checks pass: page and assets, secure tenant-scoped +CSRF cookie, anonymous login gate and media refusal, private operational path +refusal, neighboring/root path refusal, canonical slash, HTTPS redirect and +missing-CSRF POST denial. Migration/app initialization also proves consumer +connectivity. The empty product has zero accounts, including zero staff accounts. +The current login is still the interim Django login, not NetKingdom SSO. Native +recipient login, company welcome and account mapping remain VERGABE-WP-0019-T06. +RAPPS-WP-0014-T03 retains restart and coherent off-host backup/isolated restore; +the latest existing apps-pg base backup predates this new database. No pilot-user +acceptance, shared tenancy, MFA completion or natural factory-worker trace is claimed. + + +2026-09-12 SSO release preparation: docs/vergabe-demo-company-sso-rollout.md +contains the exact published app/issuer/provisioner digests, server dry runs, +attended sequence and rollback. The new helm/vergabe-demo-company-sso.proposed.yaml +layers over the admitted values and retains the 60m/256Mi allocation. The narrow +issuer-egress policy is also proposed, not applied. The shared KeyCape upgrade +requires the attended window described in its operations document. Native +recipient/MFA and product acceptance stay with VERGABE-WP-0019-T06; recovery +remains T03 here. No live runtime changes were made in this continuation. + + ## Demonstrate restart, isolated restore, rollback and operating ownership ```task @@ -126,7 +172,7 @@ status: wait priority: high assignee: the-custodian depends_on: [RAPPS-WP-0014-T02] -blocking_reason: "Await exact placement/release/data binding before native rehearsal and admission." +blocking_reason: "Placement and data binding are live; verify product account onboarding and run the coherent restart/restore rehearsal before pilot admission." state_hub_task_id: "dd069c6d-fcc1-5bac-b233-976f2f0d5cd1" ```