coulomb/railiance-cluster
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Enable Knative fail-closed init gates
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source
This commit is contained in:
codex 2026-07-27 07:18:07 +02:00
parent b697778132
commit f1a32bd5a7
4 changed files with 39 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

32
workplans/ADHOC-2026-07-27.md Normal file
View file

@ -0,0 +1,32 @@
---
id: RAIL-BS-ADHOC-2026-07-27
type: workplan
title: "Knative fail-closed init-container support"
domain: financials
repo: railiance-cluster
status: finished
owner: codex
topic_slug: railiance
created: "2026-07-27"
updated: "2026-07-27"
---
# RAIL-BS-ADHOC-2026-07-27
## Enable and verify Knative init containers
```task
id: RAIL-BS-ADHOC-2026-07-27-T01
status: done
priority: high
```
Enable only `kubernetes.podspec-init-containers` in Knative
`config-features`, persist the idempotent installer patch, and assert it in
the verifier. This supports fail-closed workload admission after asynchronous
NetworkPolicy reconciliation.
2026-07-27: Enabled the feature on railiance01 and validated a
`rapp-qonto` Knative Service containing a restricted init container through
the live admission webhook. A disposable same-policy pod proved
`gate=passed` before `application=admitted`.