coulomb/railiance-cluster
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-cluster/workplans/ADHOC-2026-07-27.md

33 lines
921 B
Markdown
Raw Normal View History

Enable Knative fail-closed init gates
2026-07-27 07:18:07 +02:00
---
fix(workplans): qualify ad-hoc identifiers with the repository prefix `ADHOC-YYYY-MM-DD` is unique per date but not per repository, so any two repos opening an ad-hoc on the same day collide. The 2026-08-26 fleet projection reset refused 9 records for exactly this reason. Canon (work-record-types_v0.1, CUST-WP-0066) settled the form as `{PREFIX}-WP-ADHOC-YYYY-MM-DD`, filename unchanged, and grandfathered existing ids on the condition they are never *silently* re-derived. This is the explicit migration that clause allows for. The hub id is derived from the record id, so a changed id is a different record: stale state_hub_*_id fields are dropped and fix-consistency re-derives. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
2026-08-28 00:28:23 +02:00
id: RAIL-BS-RCLUSTER-WP-ADHOC-2026-07-27
Enable Knative fail-closed init gates
2026-07-27 07:18:07 +02:00
type: workplan
title: "Knative fail-closed init-container support"
domain: financials
repo: railiance-cluster
status: finished
owner: codex
topic_slug: railiance
created: "2026-07-27"
updated: "2026-07-27"
---
fix(workplans): qualify ad-hoc identifiers with the repository prefix `ADHOC-YYYY-MM-DD` is unique per date but not per repository, so any two repos opening an ad-hoc on the same day collide. The 2026-08-26 fleet projection reset refused 9 records for exactly this reason. Canon (work-record-types_v0.1, CUST-WP-0066) settled the form as `{PREFIX}-WP-ADHOC-YYYY-MM-DD`, filename unchanged, and grandfathered existing ids on the condition they are never *silently* re-derived. This is the explicit migration that clause allows for. The hub id is derived from the record id, so a changed id is a different record: stale state_hub_*_id fields are dropped and fix-consistency re-derives. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
2026-08-28 00:28:23 +02:00
# RAIL-BS-RCLUSTER-WP-ADHOC-2026-07-27
Enable Knative fail-closed init gates
2026-07-27 07:18:07 +02:00
## Enable and verify Knative init containers
```task
fix(workplans): qualify ad-hoc identifiers with the repository prefix `ADHOC-YYYY-MM-DD` is unique per date but not per repository, so any two repos opening an ad-hoc on the same day collide. The 2026-08-26 fleet projection reset refused 9 records for exactly this reason. Canon (work-record-types_v0.1, CUST-WP-0066) settled the form as `{PREFIX}-WP-ADHOC-YYYY-MM-DD`, filename unchanged, and grandfathered existing ids on the condition they are never *silently* re-derived. This is the explicit migration that clause allows for. The hub id is derived from the record id, so a changed id is a different record: stale state_hub_*_id fields are dropped and fix-consistency re-derives. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
2026-08-28 00:28:23 +02:00
id: RAIL-BS-RCLUSTER-WP-ADHOC-2026-07-27-T01
Enable Knative fail-closed init gates
2026-07-27 07:18:07 +02:00
status: done
priority: high
```
Enable only `kubernetes.podspec-init-containers` in Knative
`config-features`, persist the idempotent installer patch, and assert it in
the verifier. This supports fail-closed workload admission after asynchronous
NetworkPolicy reconciliation.
2026-07-27: Enabled the feature on railiance01 and validated a
`rapp-qonto` Knative Service containing a restricted init container through
the live admission webhook. A disposable same-policy pod proved
`gate=passed` before `application=admitted`.
Reference in a new issue Copy permalink