60 lines
2.3 KiB
Markdown
60 lines
2.3 KiB
Markdown
# policy-nexus production release
|
|
|
|
`railiance-apps` owns only the approved production binding for
|
|
`policy.coulomb.social`. Policy sources and the OCI artifact belong to
|
|
`policy-nexus`; the Helm chart, hardening, verification, and rollback belong to
|
|
`rapp-policy-nexus`. This repository must not copy either the generated site or
|
|
the chart.
|
|
|
|
## Binding a release
|
|
|
|
The source-controlled binding is
|
|
`bindings/policy-nexus-production.json`. Before deployment, record all four
|
|
candidate identities and set `status` to `release-approved`:
|
|
|
|
- `image_digest`: the registry-resolved `sha256:...` digest of the image
|
|
published by `policy-nexus`;
|
|
- `publication_manifest_digest`: the 64-hex SHA-256 printed by the release
|
|
verifier for the exact `publication-manifest.json` in that image.
|
|
- `source_inventory_digest`: the 64-hex SHA-256 of the exact
|
|
`source-inventory.json` in that image;
|
|
- `source_set_digest`: the deterministic 64-hex digest of every upstream
|
|
repository revision audited for that candidate.
|
|
|
|
Tags are not accepted as production identity. All four identities must be
|
|
reviewed in the same change; this binds runtime bytes to policy source
|
|
provenance without making this repository a second policy authority.
|
|
|
|
## Preflight and deployment
|
|
|
|
With sibling checkouts of `railiance-apps` and `rapp-policy-nexus`:
|
|
|
|
```sh
|
|
make policy-nexus-check-binding
|
|
make policy-nexus-check-image
|
|
make policy-nexus-render
|
|
make policy-nexus-server-dry-run
|
|
make policy-nexus-deploy
|
|
make policy-nexus-status
|
|
make policy-nexus-smoke
|
|
```
|
|
|
|
Production deployment is an operator action. The current Forgejo build runner
|
|
has registry-publication authority but intentionally has no cluster-deploy
|
|
authority, kubeconfig, or SSH lane. Do not add those credentials to make this
|
|
release automatic. The guarded Make targets refuse the current
|
|
`approved-awaiting-artifact` binding and provide the reviewed execution path
|
|
from an authorized operator workstation.
|
|
|
|
## Rollback
|
|
|
|
Find the last known-good Helm revision with `make policy-nexus-status`, then:
|
|
|
|
```sh
|
|
make policy-nexus-rollback POLICY_NEXUS_REVISION=<revision>
|
|
make policy-nexus-smoke
|
|
```
|
|
|
|
After an emergency rollback, restore the binding file to the four immutable
|
|
identities actually serving and capture the smoke output. The package promises
|
|
restart recovery on the single-node reef, not multi-node high availability.
|