c562d7134c
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa
34 lines
1,019 B
Markdown
34 lines
1,019 B
Markdown
---
|
|
id: RCLUSTER-WP-ADHOC-2026-07-27
|
|
type: workplan
|
|
title: "Knative fail-closed init-container support"
|
|
domain: financials
|
|
repo: railiance-cluster
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: railiance
|
|
created: "2026-07-27"
|
|
updated: "2026-07-27"
|
|
state_hub_workstream_id: "05ef985a-656e-5d28-970a-db1300a7b648"
|
|
---
|
|
|
|
# RCLUSTER-WP-ADHOC-2026-07-27
|
|
|
|
## Enable and verify Knative init containers
|
|
|
|
```task
|
|
id: RCLUSTER-WP-ADHOC-2026-07-27-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "3e3f39d3-5070-5ba3-97db-19f5f361f264"
|
|
```
|
|
|
|
Enable only `kubernetes.podspec-init-containers` in Knative
|
|
`config-features`, persist the idempotent installer patch, and assert it in
|
|
the verifier. This supports fail-closed workload admission after asynchronous
|
|
NetworkPolicy reconciliation.
|
|
|
|
2026-07-27: Enabled the feature on railiance01 and validated a
|
|
`rapp-qonto` Knative Service containing a restricted init container through
|
|
the live admission webhook. A disposable same-policy pod proved
|
|
`gate=passed` before `application=admitted`.
|