tegwick
280da08455
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 1m9s
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834
97 lines
4.5 KiB
Markdown
97 lines
4.5 KiB
Markdown
# Dark deployment preflight — 2026-08-22
|
|
|
|
Evidence for `SBOM-WP-0002-T01`. This preflight made no caller switch and did
|
|
not create a production database, credential, namespace, workload, or Service.
|
|
|
|
## Product artifact
|
|
|
|
- Product commit: `0941a2e` (`feat: package dark deployment runtime`).
|
|
- Forgejo Actions: `image.yaml #1`, status `Success`, duration 54 seconds.
|
|
- Published image:
|
|
`forgejo.coulomb.social/coulomb/sbom-nexus@sha256:85245c395edc123cad9ad58f2b3d2443137e2dee132628b62307072e82d868dd`.
|
|
- Local product verification: Ruff passed; 13 tests passed and the conditional
|
|
PostgreSQL test skipped without its opt-in DSN.
|
|
- The image contains `alembic.ini` plus migration sources and successfully ran
|
|
`alembic upgrade head` as the image's non-root user.
|
|
|
|
## Placement decision
|
|
|
|
Read-only live inspection found four declarations on `platform-pg`:
|
|
`audit-core`, `core-hub`, `isolation-probe`, and `tenant-engine`. That is the
|
|
accepted cell ceiling. The dark deployment therefore targets the reviewed
|
|
`platform-pg-2` overflow cell. It does not request a ceiling exception.
|
|
|
|
`apps-pg` has two of three declared consumer slots and healthy daily backups,
|
|
but its documented consumer path still uses static application credentials.
|
|
SBOM Nexus requires separate short-lived runtime and migration leases through
|
|
the canonical OpenBao database broker, so the package follows the
|
|
`rapp-postgres` declaration path instead.
|
|
|
|
## Runtime package
|
|
|
|
Repo Manager's canonical wrap flow produced `/home/worsch/rapp-sbom-nexus`.
|
|
The reviewed local package commit is `5749b81` and includes:
|
|
|
|
- private Deployment and ClusterIP Service with no Ingress;
|
|
- immutable image digest pin;
|
|
- real `/state/health` startup/readiness/liveness probes;
|
|
- mounted `SBOM_NEXUS_DATABASE_URL_FILE`, never a DSN in Git;
|
|
- separate OpenBao runtime and migration ExternalSecrets;
|
|
- one-shot Alembic migration job for revision `0001`;
|
|
- default-deny plus DNS/PostgreSQL-only egress policies;
|
|
- PostgreSQL handoff for `platform-pg-2`, 12 runtime and 2 migration
|
|
connections, bounded timeouts, and 30-day retention;
|
|
- digest, PostgreSQL health, and migration-head live verification.
|
|
|
|
Verification results:
|
|
|
|
- package tests: 4 passed;
|
|
- family declaration: 14 declarations, 0 errors, one unrelated derived reef
|
|
projection warning;
|
|
- PostgreSQL consumer rendering: passed;
|
|
- Railiance01 server-side dry-run: all 11 resources admitted, with the dry-run
|
|
stream using the existing `default` namespace because a dry-run Namespace is
|
|
not persisted for later documents;
|
|
- no cluster resources were applied.
|
|
|
|
## Governed gates
|
|
|
|
Warden returned `founder_required` for both first-time operations:
|
|
|
|
1. operator OIDC/MFA to create `coulomb/rapp-sbom-nexus` in Forgejo;
|
|
2. one-time secret provisioning for the `platform-pg-2` bootstrap and the
|
|
exact-scope SBOM Nexus OpenBao/External Secrets credential lane.
|
|
|
|
No bypass was attempted and no credential value was printed, stored, or
|
|
written to a repository. State Hub handoffs:
|
|
|
|
| Owner | Message | Requested result |
|
|
| --- | --- | --- |
|
|
| `rapp-postgres` | `bc19f295-84dd-43bb-a648-1f7baa85087b` | admit the overflow consumer, database/roles, backup, OpenBao roles and exact-scope token |
|
|
| `repo-manager` | `c24b56f4-90be-4d2e-bca8-4100ab4cc9e6` | publish and register the verified managed workload package after OIDC/MFA |
|
|
|
|
`T01` remains in progress until those gates are satisfied, the dark workload is
|
|
healthy on PostgreSQL, and a restore is verified against the deployed topology.
|
|
|
|
## Post-preflight status
|
|
|
|
Later on 2026-08-22, the Forgejo package gate was completed and the package was
|
|
registered. A namespace-first apply correction passed five package tests and a
|
|
server-side dry-run, then was published as `rapp-sbom-nexus` commit `dd110d1`.
|
|
|
|
The database owner accepted the declaration under `RAPP-POSTGRES-WP-0005`
|
|
(State Hub workplan `d6d36add-27d9-5b5d-b6fe-ce80eb7b6dab`). The distinct
|
|
`platform-pg-2` cell and bootstrap secret were created and the cell reached 1/1
|
|
Ready. Acceptance remains blocked because:
|
|
|
|
- Warden still requires the attended founder act for the OpenBao connection,
|
|
dynamic runtime/migration roles, exact two-path policy, and renewable parent
|
|
token;
|
|
- continuous archiving is `False` and the first base backup is
|
|
`walArchivingFailing`; the value-safe pod log reports S3 `HeadBucket` 403 for
|
|
the governed `platform-pg-2` prefix.
|
|
|
|
The backup diagnosis and request for a successful base backup plus scratch
|
|
restore were sent to `rapp-postgres` as message
|
|
`31b72f4b-fcf8-4454-82b7-2dbf325c573e`. The SBOM Nexus workload remains
|
|
undeployed and no caller ingress is enabled.
|