coulomb/reef-railiance
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Complete fail-closed Qonto egress gate

Browse source
This commit is contained in:
codex 2026-07-27 07:18:38 +02:00
parent 70f72e4a92
commit 80ed9c315f
1 changed files with 13 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

15
workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md
View file

@ -42,7 +42,7 @@ remains the migration target.
```task
id: REEF-RAILIANCE-WP-0003-T02
status: progress
status: done
priority: high
state_hub_task_id: "2a6742f1-6fcf-4164-b885-a7a9ea39521d"
```
@ -61,11 +61,22 @@ included by the runtime Kustomization. T02 remains `progress` until
railiance01 NetworkPolicy enforcement is repaired and the three-way probe
proves allowlisted success, other-host denial, and direct-bypass denial.
2026-07-27 follow-up: Host firewall-chain tracing showed NetworkPolicy does
enforce after kube-router creates the per-pod chain; the failed immediate
probe exposed an asynchronous startup window rather than a disabled
controller. The runtime now uses an immutable curl init container as a
fail-closed startup gate. It retries until its own pod proves Qonto proxy
access (`CONNECT 200`), other-host proxy denial (`CONNECT 403`), and direct
Qonto denial. Knative init-container support is enabled and source-controlled
in `railiance-cluster`. Live disposable-pod evidence reported `gate=passed`
before `application=admitted`. The proxy bundle is now part of the active
runtime Kustomization and T02 is complete.
## T03 - Deploy and verify rapp-qonto
```task
id: REEF-RAILIANCE-WP-0003-T03
status: wait
status: progress
priority: high
state_hub_task_id: "ddf25c7b-23b0-4e67-8881-5d29fa71e9ad"
```