tegwick
e8a7ff2547
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
96 lines
6.2 KiB
Markdown
96 lines
6.2 KiB
Markdown
# Vergabe demo-company deployment binding
|
|
|
|
Updated 2026-09-12 under RAPPS-WP-0014 and VERGABE-WP-0019.
|
|
Application placement is live; native product sign-in and recovery acceptance remain open.
|
|
|
|
| Item | Current binding |
|
|
| --- | --- |
|
|
| Tenant | tenant:trial:demo-company, active/version 1; three native memberships and one linked directory identity |
|
|
| Data | Fresh synthetic demo workspace; no historical import |
|
|
| Portal | https://users.coulomb.social/login |
|
|
| Product | https://vergabe-teilnahme.coulomb.social/demo-company/ |
|
|
| DNS / TLS | Both hostnames resolve to 92.205.62.239; certificates Ready |
|
|
| Cluster | Railiance01, kube-system UID a553c742-0115-43d4-99a4-a5ca56fe0786 |
|
|
| Namespace / release | vergabe-demo-company / vergabe-teilnahme, revision 2 |
|
|
| Source / image | 8be281025bf57a7aefd1fe98a7e060f2173df5ef; image 51 / acceptance 52 / smoke 53; sha256:2cb393608a82be2851adfc27f2bf4d8ef5d709f1b0038be5d0999e38c68b039e |
|
|
| Chart / rollout | 0.2.1; one Recreate replica; init migration before serving; Ready 1/1 |
|
|
| Resources | 60m CPU / 256Mi memory request; 1000m CPU / 1Gi memory limit |
|
|
| Database / role | Fresh vergabe_demo_company / vergabe_demo_company, databases/apps-pg |
|
|
| Runtime custody | vergabe-demo-company/vergabe-demo-env; platform helper receipt in RPF-WP-0039 |
|
|
| Media / issue state | Separate Bound local-path PVCs, 5Gi / 1Gi; UID/GID/fsGroup 999 |
|
|
| Authentication | NetKingdom company welcome and OIDC deployed; initial readback zero accounts. Actual recipient login/MFA pending |
|
|
| Remaining handoffs | VERGABE-WP-0019-T06 welcome/SSO; RAPPS-WP-0014-T03 recovery; VERGABE-WP-0019-T04 pilot acceptance |
|
|
|
|
## Current SSO rollout
|
|
|
|
2026-09-12 attended rollout executed after explicit operator approval. KeyCape
|
|
and password setup are Ready on the prepared digests; exact public client
|
|
registration was CAS-applied (config resourceVersion 60123977) with unrelated
|
|
config bytes/Secret data preserved. Existing portal and product client both
|
|
pass fresh-login forwarding, wrong-callback and missing-PKCE checks (6 checks).
|
|
Vergabe Helm revision 2 is Ready; identity migration completed, both PVCs remain,
|
|
and requests remain 60m CPU/256Mi memory. Eleven live product checks pass:
|
|
company welcome, anonymous gate, no-store, secure scoped CSRF, POST/CSRF-only
|
|
login start, native issuer redirect, private company/media protection and
|
|
invalid callback/confirmation rejection. Initial readback showed zero accounts,
|
|
identity mappings and staff accounts. Native invited-user sign-in/MFA and
|
|
confirmation are now requested from the operator; no user credential was used
|
|
by the agent. Recovery and two-user acceptance remain their existing tasks.
|
|
Evidence: railiance-apps/docs/evidence/2026-09-12-demo-company-sso-live.md.
|
|
|
|
## Initial deployment verification
|
|
|
|
2026-09-12 deployment evidence: the operator added A records for
|
|
vergabe-teilnahme.coulomb.social and users.coulomb.social. Authoritative IONOS
|
|
and recursive readback both return 92.205.62.239. Both cert-manager certificates
|
|
are Ready. The portal now uses https://users.coulomb.social/login; its legacy
|
|
nip.io address redirects to the canonical hostname. The exact new callback is
|
|
registered alongside the rollback callback; scopes, public client type and PKCE
|
|
remain unchanged. Canonical authorization succeeds; unapproved callback and
|
|
missing PKCE fail. This supersedes earlier DNS and portal-hostname blockers.
|
|
|
|
Helm release vergabe-teilnahme revision 1 is deployed in vergabe-demo-company,
|
|
chart 0.2.1, pinned product digest cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68.
|
|
Deployment UID 2152014d-a020-4c5e-a3b0-9575e9f21c44 is Ready 1/1. Its init
|
|
migration completed before the web process; both phases share the same 60m CPU /
|
|
256Mi memory request. Node requests now total 3965m of 4000m; the 35m remainder
|
|
matches the accepted prototype allocation. No unrelated resource requests changed.
|
|
|
|
RPF-WP-0039 delivered fresh vergabe_demo_company database/role on apps-pg and
|
|
runtime Secret vergabe-demo-company/vergabe-demo-env. The app's own connection
|
|
confirms that exact database/role. The role is non-superuser, cannot create roles
|
|
or databases, has a 20-connection ceiling and 15-second timeouts, and cannot
|
|
CONNECT to historical vergabe_db, coulomb_social_db or apps_meta. Both dedicated
|
|
PVCs are Bound: 5Gi media and 1Gi issue state. Historical data was not selected
|
|
or overwritten; no credentials are recorded here.
|
|
|
|
Thirteen live Chromium/HTTP checks pass: page and assets, secure tenant-scoped
|
|
CSRF cookie, anonymous login gate and media refusal, private operational path
|
|
refusal, neighboring/root path refusal, canonical slash, HTTPS redirect and
|
|
missing-CSRF POST denial. Migration/app initialization also proves consumer
|
|
connectivity. The empty product has zero accounts, including zero staff accounts.
|
|
The current login is still the interim Django login, not NetKingdom SSO. Native
|
|
recipient login, company welcome and account mapping remain VERGABE-WP-0019-T06.
|
|
RAPPS-WP-0014-T03 retains restart and coherent off-host backup/isolated restore;
|
|
the latest existing apps-pg base backup predates this new database. No pilot-user
|
|
acceptance, shared tenancy, MFA completion or natural factory-worker trace is claimed.
|
|
|
|
## Source and rollback
|
|
|
|
`helm/vergabe-demo-company-foundation.yaml` owns namespace/network policies and
|
|
certificate. `helm/vergabe-demo-company-ingress.yaml` owns the exact host and
|
|
company-prefix route, canonical slash, prefix stripping, headers and rate limit
|
|
(60 requests/minute/IP, burst 20). Private media stays behind Django. The
|
|
existing proposed-values filename now records the admitted binding.
|
|
|
|
`railiance-platform/tools/provision-vergabe-demo.py` owns the fixed fresh
|
|
credential/database lane. It captures all child output and passes values only
|
|
on stdin; the durable credential copies are the two exact Kubernetes Secrets.
|
|
OpenBao automation remains a later owner improvement. Never rerun historical
|
|
bootstrap helpers or substitute apps_admin credentials.
|
|
|
|
This is the first release in the fresh namespace; there is no previously
|
|
accepted application image to roll back to. On a failed next upgrade, stop public
|
|
traffic and reconcile schema/image compatibility before reverting. Retain the
|
|
claims and database; namespace deletion is not rollback. Pod replacement and
|
|
isolated restore must still be proven with matched PostgreSQL/media/SQLite data.
|